It come back.
So this challenge was really not easy.
It's a real world application and there's a lot of stuff going on in there.
If you have solved this challenge, really congratulations.
You definitely deserve your orange belt afterwards.
And if you have struggled a little bit, also, absolutely no problem.
We go through this challenge right now and we do the step by step.
You can pause and rewind this video on a certain point, and I will also provide you some hints.
Maybe you only missed a single piece to solve this challenge.
This is why I like to provide these hints, because with this hint, you might be able to solve this
challenge and it's really just a little hint.
So you might have done this if you would have spent a year, several hours or even one or two days,
you will get to this point investing that much time if you start reverse engineering real world applications.
But for this course right now, it shouldn't be necessary.
Therefore, it's good to go take this hint and then try to solve it once again.
Okay, so let's have a look.
Okay, here we are now the Ubuntu VM.
Let's have a look into the app.
So I've put mine into apps space playing the recompile and the first thing I like to do is I'd like
to get rid of old projects because if we have modified this version in the past and we are patching
it now once again, then we might run into trouble.
And this happened to me a lot in the past.
Therefore I learn from this, and yet we start with clean projects over here.
All right, then we can decompile this one apk to D.
Oops and displays paying application.
We go into this directory and we open the whole smiley directory within visual to code.
There we go.
Okay.
Now we can minimum.
Now we can minimize.
Minimize this one I.
This word is really hard for me to pronounce or to.
Yes.
Say it loud.
So we want to reverse engineer this application first, because what is our task?
Our task is to patch the player lives from five to, let's say seven, for example.
Therefore, we need to identify this in the Java code.
Of course we can do this in the smiley code, but yeah, good luck on this one.
So we go one directory back and I use shade.
Excuse me on this one right now you can also go for the text to try and change your approach, but for
me it's not easier to run it in this way.
All right.
So let's see.
We are looking for so we use the search function over here, the code or the app gets the compiled.
Okay.
And now we can enable, for example, field and disable all the other fields over here.
Field means we are now looking for the variable name we search for lives or a life.
Life would be the better approach because we've got here lives and also devalue life.
Somewhere.
Okay.
Can we sort this?
No, never mind.
So here we can see we've got play act lives.
All right.
We also have this default lives, and the attribution of the name life seems to be irrelevant.
So we are searching for lives.
There we go.
Now we've got the player game screen and the player class once again.
And let's first look into the player class.
And this looks promising.
We've got our player, we've got default lives equals five and we've got an instance field also lives
equals five.
This has to be our life's value in our program code or in our application.
Nevertheless, also, take a look into the other one.
In this case, it's game screen.
And here we can see.
All right, protected final in lives equals three.
We do not have three lives.
Therefore, we can skip this one.
We are starting and having five lives.
Therefore, this is definitely not going to be our correct value.
It's super interesting, or at least it's strange that we have these many lives attribution or these
many lives variables.
But yeah, we are having a real world application, so this is what we have to deal with.
Okay.
So put this side by side now.
And then we go into the small class.
We've got the big spice pan components and we've got our player class.
So the F cap space pen components and display a class over here.
I keep clicking these annoying windows and we enable Java.
Let's extend this a little bit.
Yes.
I guess this is good to go.
We have talked about this file already in the past, so we are not going through this once again.
We can directly see this once over here.
Public static, final default lives equals five.
So this value needs to be patched or we want to patch this value to seven.
Now we have changed this from 5 to 7, but we've got this one over here also.
So we also need to patch this one.
We can look into the player code over here and see if we identify this.
Yes, we can see this right here.
Line 39.
Let's see.
We've got no line attribution over here.
So this one seems to not match over here.
This there's also got to know we cannot rely on this one all the time.
But for now we can see we are having this value two times five here and five here.
So if we are looking in this code for 0x5, once again, we only have this one left.
So this has to be this value.
Now, let's patch this also to seven.
That should be right.
So let's save this file multiple times.
Then we can close this.
We keep this open, and we build this app once.
Build this app back once again.
App K two will be in this one over here.
Let's see if the build is successful, because if we patch the smiley code and we make an Yeah and really
hard mistake, then the app won't even build because the compiler figures out okay, this will not work
and therefore throws an arrow.
In our case we have built this application, which is a good sign, but this doesn't mean we have applied
this patch.
Correct.
We can still have some errors on the runtime of this app.
So if you're putting your values into strange registers and things like this and on the runtime this
happens and does not work, the app crashes, but nevertheless building an app successful is always
a good sign.
So we've got this now within our disk directory.
Let's make this a little bit bigger.
Okay?
And now we are using zip line that we for this one and we create a new application which is now zip
aligned on four bytes which is named out APK verification successfully.
Nice.
Now we use the APK sign on this command over here to sign this app.
You see password change it.
Or at least I have chosen the password change.
Then there we go.
This is our old APK file.
Now let's make our connection to our virtual machine.
ADB Connect.
Connect it.
Nice.
Let's get the screen over here.
There we go.
Let's see.
We have an app already installed and we can try to overwrite this file or we can simply uninstall it.
In my case, I uninstalled this because this is the most clean way of doing these things.
So let's see.
ADB uninstall the garbage space ping.
Yes.
The app is up here now we can install our old APK.
All right, let's start there and see if our patch was successful.
The app is loading.
That's also good because we can still have crashes, but for now it's looking promising.
We click start and that's bad.
At least the app is working, which is a good sign, but we can see we still have five lives.
Why is this the case?
This can have different reasons.
The first one is we did fail on our patch.
The second one is this is just in display.
So our lives are now really seven.
But the display is showing still those last five.
This might not be synchronized.
This might be two different types of values.
To find this out, we have to die four times once again.
And if we lose the game, then we didn't really patch this application.
And the screen was correct on this.
And the final cases that we patch this player lives value.
But this one is not going to be used in this code.
This code is using a different value.
And to find this out, we have to take a look into this code once again, but now a little bit closer.
Okay, so let's close this one over here and let's get back into this code.
So let's open this once again.
Okay, so we've got these three variables, but none of these seems to be our lives value.
I mean, this one can be theoretically still be possible, but it starts with a value three.
So I also don't believe in this one that this is the correct value.
Now we have to extend our search.
We do not look for fields.
We are now looking for the real code.
And here we can see, okay, we've got our components player.
This one is not the correct value because we have patches from 5 to 7 and this one also we patch this
from 5 to 7.
No effect and this one is value three.
Yeah, let's skip this for now.
If we do not make progress on this, we might come back to this one.
But for now, let's skip this next.
What's this one over here?
Entity factory creates player in four lives equals five.
If we take down a look, this seems to be the last value that gets initialized with five.
So let's have a look.
All right.
Here we have entity, create, play a word, and we can see this code.
Looks like it's creating a player.
We've got the position of the player.
We can also see the Sprite name of the player.
And we have also this one over here player.
We are creating here a new player object named info and this info lives gets now overwritten.
Oh, that's the case.
Okay.
So we have our player dot lives and this player dot lives got patch two seven.
This one over here.
But now when we create this object, it gets overwritten.
Therefore, our patch did not take place because this seven gets overwritten at this point with the
value five back again.
That's pretty strange, isn't it?
Yes, this is definitely strange.
And I'm also not sure what's the reason for this.
I guess the developer has created this player class to use it as the intended way that the developer
uses this player dot lives as an initial value.
But after writing this code.
But here the developer has chosen.
Okay, let's make sure that the player starts with five lives.
I'm not sure what I have initialized.
This might be some thinking process.
Why this could happen in this way, but nevertheless we have to deal with this.
This is also not blaming regarding to the developer.
I'm really thankful that we have this amazing app to keep practicing on and you will encounter this
also in tons of other applications.
So you do some reverse engineering process.
You identify this class over here, this player class, and now you know, or you think, okay, this
has to be our value over here.
We've got this player.
This player has lives and this life's value is five.
This must be our value.
And afterwards you patch this and encounter.
It didn't work because it's get overwritten here.
This is what you encounter a lot.
Therefore we have to dig a little bit deeper or like other peoples keep saying, we have to try harder.
All right.
So let's go into this class and figure out where this value is and try to patch this value we put aside.
We put the side by side once again.
Well.
Okay.
Yes, we have closed this one and this was good because we are also cleaning up this version.
We have modified this player object over here.
This lives and this lives.
But we do not want to patch or add an additional patch on top of this right now.
If it fails, we can try patching all those values afterwards.
But I like doing single task patching and this is also what I recommend to you, because if you patch
two or three things at the same time and you get an error, you do not know where the error queues.
Therefore you have to go back and do it once again.
And by doing this, yes, it's at the beginning slower, but at the end we might be faster.
Okay, so let's clear this up once again and then we use the APK tool D.
We go into this directory and we open the Smiley Directory within Visual Studio code.
Putting those sites aside, keep clicking those annoying windows.
Not yet.
The E of Capek.
And we are within, let's see, space paint services, services and then entity factory.
Okay, now there are those annoying windows.
We enable Java and there we go.
And now you might think.
Wait, what?
This file is ridiculous.
Massive.
Are we ready for this one yet?
So let's step back a little bit because this is now really massive.
But we do the step by step and we have to remember what we've learned.
First of all, click this away.
Okay?
So we've got the file structure and the file structure is the same.
Let's get rid of the distracting part.
So let's go through this real quick.
This is our class.
We do not extend an additional class and this is the fine name of this class.
Direct method means we are having private methods and constructors.
In this case, only this constructor.
All right, from this point until the end, we seem to have only public methods, public static or simply
just public methods.
Our create player method is public static and returns an entity.
Let's try finding this method and we can do this by searching for create player, for example.
OC and TB can see method public static create player.
This is our return value com.
Our team is entity.
This is correct.
This is this one over here and be providing world object as an parameter.
All right.
We have identified our method, and now we only look into this part of the smiley code.
We can delete all the rest.
But I do not recommend doing this because we have to add this afterwards and this will be a mess.
But if you want to get rid of the distraction, copy out all this from the beginning from here dot method
to the end of end method.
And then you have sliced this piece of code out and it will be a little bit easier.
Okay, I will suggest.
Let's try doing this.
So we make a new file.
Okay.
Then we have our create player method.
It still looks massive, but let's remember back again to our first Marley patching approach ever.
This might be the single piece that's missing for you if you haven't solved this challenge right now.
So let's recap this a little bit.
Let's have a look into the code.
Okay.
We are looking for this one over here.
This is our player object player object info.
And this player object has a name or this variable.
This instance field lives.
We have patched this one, but here it gets overwritten with five once again.
Now what can we do to identify this within this code?
Yes, we can search, for example, for info, but then we also find all these other info values here.
Next, we can do the same approach like we did on our first smiley patching.
We can search for the value five.
The value five is not going to be used within this code anymore.
So by having this value five, we might be able to identify this line of code.
And then we do not have to understand this line of code.
I guess we do.
I'm not sure about this one.
We will see this later on.
But we can do this exactly the same we did in our first smiley patching.
We simply change the hex value out of this.
And then we have applied our patch.
We put this application back again, sign it, install it and check it out.
So in case this was your missing piece to solve this challenge right now, I know this challenge was
really not easy, because if you try to make your way through this, this will be super hard.
But I have structured this course in a certain way that helps you to solve this further challenges by
getting back on this approach, we have learned.
And this is also the approach that helps you on real world applications.
This is why I have structured this course in this way.
So if you couldn't solve this challenge yet, please try this approach right now.
And afterwards, you feel super great if you have patched this app.
Yes.
You got a little bit of a hint, but let's do not call this hint.
This was just a refresher from what we've learned already.
Okay.
So please pass the video and then you can rewind this after trying this once again.
And for all the other people, I will move on right now with the challenge.
So let's see.
Okay, let me get this back.
So we are looking in this method and now we are looking for the value five.
Not over here.
We're looking over here for the value of 50x5.
We only got one hit.
Nice.
Let's have a look.
All right.
We've got our local B two info.
Nice.
This is now not in variable name.
This is now our instance name over here.
But who cares?
We found our instance so nice.
This one is our player object.
Great.
This means we are putting here the value five into v seven and here we can see v seven gets put back
again into v two, which is our player object.
I mean, I guess we talked about this, but not in detail.
Nevertheless, we do not care about this instruction because this is our value.
Five this one over here.
Let's patch this.
Okay.
If you pitch this here, it doesn't make sense because we have to patch this over in the real smiley
file.
But let's have a look once again here.
We can see that line 80.
Let's have a look at line 80.
Oh, well, nice.
We also got the exact line number where we are initializing or overwriting our lives object.
We can also navigate using this line eight number, but please do not rely on this.
We have seen this in the in a few moments before that.
This is not always accurate.
In this case, we are taking this because it seems to fit to our code.
We verify if we are really in this line right here by looking up and downwards a little bit.
Okay, guys, super nice.
Now we can search, for example, for this whole instruction over here.
Okay.
So we're looking here for Ock to make this clear here.
We have copied out the method only just create player to get Yeah.
All this distraction away and then it's also easier to search for this value five because here we can
see we are not using this value five anymore.
Let's close this one that it's not that confusing.
Here we are now at the original smiley file in this entity factory.
Smiley and we have used the string from the once before to identify this value over here.
Now we can patch this to seven.
We save this file.
I use the shortcut, but to make this sure.
Okay.
And now we can close this and we get back to our process building this app, signing it and so on.
APK Tool will be.
Let's see if we get build a rose.
No, that's good.
Then we go into this directory.
Now in this we can see we do not have an old file yet, so we have cleaned this code correctly.
Before I zoom in a little bit, we are using SIP Align Modification successful.
Now we have this old APK, which is the zip aligned version of this one and now we are using the APK
signer to sign this app change.
It is my password and I made a typo.
Change it.
All right.
Now we can install it.
ADB install out apk.
No, not yet.
We are uninstalling our first version.
So therefore we use ADB uninstall.
Yes.
And now let's get back the screen.
Screen copy.
And let's see.
All right.
Looks good.
ADB install out apk.
There we go.
We start this app.
No arrows.
Super good start.
Amazing.
We have changed lives from 5 to 7 right now.
I mean, this is not a big jump and this can be also a false positive right now.
As already mentioned, we can have our player lives and the lives within our display to make sure that
we have now seven lives.
We need to die seven times.
And if the game ends afterwards, we know our patch has been successful.
We can see life is already increasing.
Nice.
Super nice.
Okay, but this was not a real task.
Let's try to modify this value and get our lives up to 999.
We close this one.
So let's get back to the spoon.
We open the smiley directory once again with Wizard Studio code.
And we directly jump into the last location where we've been.
We now know this line 1417 is our player lives.
Let's make this 999.
The value is this 137.
Okay.
Let's save this and build this app once again.
Ooh.
We are getting an error.
Let's see.
999 cannot fit into a nipple.
Could not smart could not Somali file.
Interesting error message here regarding to this error.
What does this means?
We are trying to put the number 999 into a nipple and a nipple is a four bit value, but 999 does not
fit into four bits.
That's absolutely correct.
Let's see.
Why do we have this case over here?
So we go back into the Somali directory with code Somali.
Okay.
If you struck it at this point, absolutely no problem because Mali is really hot.
And if you if it's the first time for you acting on those registers and yeah.
Think about the space that those registers provide.
This is super hot.
It also takes time.
It took me quite a while to learn this, so please do not get frustrated.
Let's think about this together right now.
And afterwards you can also pause and rewind this video once again to solve this challenge.
What does this line do?
We've cut con slash 4v7 and then our 999 and this value did work.
But this one right now does not work.
So where's the difference?
Yes, of course, regarding to the value, but what is the problem here?
And therefore, we need to fully understand this line.
Let's look this up.
So I opening my web browser.
And now opening this one.
Let's have a look cons dash for.
Oh yes.
Absolutely clear right now.
Puts the forbid Constance into VIX.
Oh well, don't worry.
I made this mistake so often and I still do make this mistake.
So this is absolutely no problem if this was your strategy point at this challenge.
So now it should be clear this 1-4 only moves four bits, but the program now realizes, wait, I've
got way more than four bits for this value.
Therefore it throws an error because the compiler notice, well, I'm going to throw away a lot of numbers
and this might be not intended.
Therefore I do not move on.
I'd rather print this error that the developer can check this once again.
All right, so what can we do?
We can check if this value fits into 16 bits.
Let's do this to check this out.
We can do a simple math operation.
So two times four means this is the range we have for four bits.
16.
That's correct.
So if we do this on the paper, let's get out the graphic template real quick and then we do this together.
Okay.
Here we are now with the graphic template.
Let's have a look.
So two square four means we are having four bits and four bits seems to have the range 16.
Let's, let's check this out.
So four bits means we've got to square zero to square one to square two to square three.
This means we've got one, two, four, eight.
If we add all those values over here, we get the value of 15.
We start counting from zero.
This means we've got 0 to 15, which means we've got 16 values.
Let's find out how many bits we would need to store this value.
999.
We can do this on the paper.
Therefore, we have extend we have to extend this schematic over here.
So here we have two square for two square 512, 1024, 2000, 48.
All right.
At this point, we already have enough values to store this value.
999.
To not always do this on the paper.
We can also use Python for this.
So within the bin function, we can insert this value 999 and then we can see, okay, these many bits
are needed to represent this value.
999 And this is one, two, three, four, five, six, seven, eight, nine, ten.
Okay, we've got ten bits.
This one over here.
All right.
Therefore, these four bits, if we only store these four bits in our value.
Sorry, this was a little bit bad drawing.
So if we only store for bits.
Into our register.
I guess it was with seven, but this doesn't really matter.
Then the program now encounters count.
Well, what is what is happening to those bits?
Are you really sure you want to do it in this way?
I guess not.
Therefore, I throw an arrow.
Okay.
So that's the point behind this con slash for and the error message.
Let's get back to this one.
And now we know four bits are not enough.
If you check this, we can use concealer 16.
This will work.
If you want to be a nice hacker and also be resource efficient, then we use con slash 16.
In my case, I do not care about those resources.
We are just talking about a little bit of bits.
Therefore we use this one, which means we have the full range from 32 bits.
Puns and we remove simply this.
This means the default value is 32 bits and now we can save this.
We close this one over here.
So then we go into this directory upwards and let's see if we can now build this application apk to
be a space pinger.
All right, we can see the build has been successful.
Great.
The arrow has gone.
We cannot rely on this if we successfully patch this application yet.
But it seems like to fit the smiley requirements in our code right now.
Nice.
Let's have a look.
So we go into this directory list and here we can see we haven't clean this up yet.
We now just have to make sure that we are using or that we are deleting the old version and using the
new version.
So let's get rid of this one.
Okay.
And now.
Now we can align this one.
Correct.
We sign this application, change it, and then we use ADB, install out APK.
No, we uninstall the original version first.
So ADB uninstall the big space pane.
Yes.
And let's see.
No app available anymore.
ADB install.
That's correct, because we are using the old APK.
So you can see you can make a lot of mistakes if you are if you're not absolutely focused on this one.
I tried to install this version, which is the build version, but not design version.
We have signed this app and this is this one.
Okay.
So this also happens to me still a lot.
Also super annoying things like forgetting to safety, smiley file.
Okay, and space pain and let's see.
Still no arrows.
Pretty good sign.
Still no error.
There we go.
We have 999 lives.
Super great.
If you have done this, congratulations.
So you have already patched a nice mobile game and this was not that easy, to be honest.
If you would have done this at the beginning of this course, this would be overwhelming.
But splitting this up in these single steps, we are now able to patch this application.
And you know what?
You can also change your score over there already.
You can find this in the same class.
If you want some bonus challenge, go for this.
Apply some high score that no one else is able to reach.
Okay, so have fun about this and congratulations.
You deserve your orange belt.
Have fun with this.
And in the next one we take about or we take a look into if blocks.