Welcome back.
In the last video, we did some type of prototyping to write a small Android application which can be
used to train certain topics, for example, if statements.
This bonus video focused on the app development process in Android.
On a very high level, it can be useful to know these things, but they are not required for this course
over here.
This course is about Android application hacking and this is exactly what we are going to do right now
in this video.
We simply reverse engineer the application we have written in the last video and it is therefore not
required to watch this bonus video or that this application is doing is is simply just reducing our
lives by one.
If you press this button, you will find this apk in the attachment of the section and you can simply
download and get into this video right now and therefore let's go.
Okay.
Let's have a look into this code over here because we want to keep practicing smiley as often as we
can, and we do this together right now.
So yeah, we will go through this together and we will learn new instructions and figure out how the
if statement works.
Therefore, let's go.
So let's see what we've got.
We've got our virtual method.
This means we are having a public method over here which is labeled get hit.
This is our method name.
Let's write this down.
Get it.
Okay.
We can also see this method does not have any parameters.
Nice.
We can also see the return type is void.
So we are not returning anything.
That's also nice.
All right.
There we have our function prototype.
Already done.
One line of smiley code.
Nice.
Next, we've got locals, too.
This means we are having two local registers.
But we do not know if these are variables or placeholder for certain values.
We do the top to bottom approach.
Therefore, we go through this instruction after each other.
We do not look this up right now.
So we just keep this in mind.
We've got two local registers.
Okay.
Next we've got I get v0 p zero OQ.
We know p0p0 is a special parameter.
This is holding out this object.
Okay.
Let's see what this instruction does.
We have faced this.
Yeah, many times right now.
But anyway, let's look this up to be 100% sure.
It also doesn't take that much time.
You will see this.
So let me switch.
There we go.
We have our dialog up codes over here.
And yeah, we simply search for this instruction.
I get the X with y field ID reads an instance field into which the instance is referenced by v y.
Alrighty, we go back.
So we've got an instance field over here and we can find this instance field after this error, which
means our instance field is lies.
We've got this dot lives.
This one over here is just regarding to the, this object that we know it's from the class player.
So this is a player object.
Okay, so this is what our P zero is holding and this value gets now put into v zero.
And let's write this down.
Zero is equals.
This dot lives.
Okay.
This or the PC register.
Let's say the PC register is the only one I like to replace.
Otherwise I like to keep sticking to the original register values.
So next we've got constant slash four.
We want 0x1.
We are putting this value into v one and we are only putting four bits because of this slash four.
But this doesn't matter here because the value one is 0001.
So let's write this down.
What this line does is it initializes the register, our second local register with the value one.
Alrighty then we've got sub dash int to address and we only got two registers.
I mean it's clear what it does.
But anyway, let's look it up to be sure where the result is being stored.
Is it here or is it here at do we subtract this from this or vice versa if you're not 100% sure, simply
just look this up.
So we are looking for sub dash int.
This one has now three registers.
So we have to add this one.
Yes.
Okay.
Calculates we x minus v y and puts the result into v x OC.
So we are calculating this minus this and the result.
Let's do this, this, minus this.
And the result is being put back again into v zero.
So we are having we zero.
Let's switch back is equals be zero minus v one, which means if we replace now our v zero with the
with the reference over here.
So V zero is holding our this dot lives this one.
This means our v zero is now equals.
This dot lives minus we want and v one is one.
So minus one.
This is what this line over here do regarding to the setup of the registers before.
Okay.
Next we've got I put I put the 0p0.
So we are putting this venue over here into our instance back again, our instance filled lives.
Anyway, let's have a quick look to be 100% sure.
I put wi x puts wi x into an instance field.
The instance is referenced by wi fi.
We have to take care.
I get reads from right to left and I put this one reads from left to right.
Therefore, we are putting this value now in PC row.
Here we are fetching the value from p zero into V zero.
So if you're not 100%, you get this point.
All right.
So let's see.
This means we are having p zero and this stop lives.
It's now equals v zero and v zero is this dot lives minus one.
So at this point we are just reducing one or subtracting one.
From this Todd lives.
Okay.
Let's put them info that we know.
This is not an instruction.
It's just an reminder for us that we are subtracting one from this that lives.
Okay, now finally we've got our if statement.
Let's have a look.
Let's put a dramatic color for this on.
So we've got if there's less, maybe less equal, and then this one is zero, maybe we zero, and then
we've got this one.
This looks strange over here.
All right.
Let's have a look into this.
So we look this instruction up first.
If dash less equals yes OC.
Let me scroll down.
There we go.
Checks we x and trumps if we x is less or equal.
We've got zero square two, but having an yeah zero squared anything is still zero.
So I'm not sure why it's pointed out in this strange way over here, but this means if we x is less
or equals zero and after once we jump and we jump to this one over here, the target here we can see
an example.
If less equals zero, we zero.
And then we jump to this one over here, jumps to the current position, plus this offset.
All right.
This looks even more strange, in my opinion.
So let's get back to our code.
Let me do not get too confused.
Okay.
The first thing we need to do is you need to read this out loud and we need to read this in the following
way.
The first one is if we see a row, that's the first read, and then the second read is less equals zero,
then jump to condition zero.
Okay, if you read this out loud in this way we can write it also down in the exact same way.
Let's do this if.
We zero is less equals zero.
Then we jump to condition zero.
All right.
Let's clean this up real quick.
Okay, let's find this conditions here right now.
So we've gotten the code on condition underscore zero.
Let's go in.
Scan.
There we go.
Here we have this one over here.
Okay.
So if this condition is true, we jump from this one to this one over here.
We move one at this path in the code.
And this is super amazing because this is now our branch.
We're having our code and this code has some branch, true and false.
And by going to the one branch, we are skipping the path of the other code and this is what we are
doing right here.
We are skipping this code over here right now.
We have to move on in the cold.
Maybe we will come back to this one.
But for for now, we are just keeping it.
All right.
So this is also our true condition.
Let's put this.
True.
So if this statement is true, which means this is our true condition.
Okay.
Then we move on over here.
Let's see what we're doing afterwards.
So we've got our if statement and now we are putting the value of zero into v zero.
Okay.
So we zero is equals zero.
And now we've got an input boolean.
This is interesting because our value zero can have multiple meanings.
It can have or can be used as the number zero or as a boolean statement.
Boolean statement or boolean.
Yeah.
Boolean state is for example, true or false.
These two states.
And in this case we are having a zero, which means a zero is the state false?
So these values can have multiple meanings in this case.
Okay.
And then we are putting this false back into our this object.
And what kind of this object we will find this after the error here.
It's the this dot state so we've got this dot state instance field and we can also see this over here.
This this dot state is from type boolean, which makes sense because we are putting a boolean into this.
Okay.
This means we've got our this dot state.
It's now equals zero, which means our this dot state.
It's now equals false because our zero is a boolean value and it's false.
Alrighty.
Let's get back to green.
What's going on right here?
Then we've got this one.
Let's.
Let's mark this real quick.
So we got this one.
We also got this one.
This is just a line number.
So regarding to our Java code and then we've got this go to over here.
This looks interesting because this is the second condition if we have a go to starting with those colons
over here.
In this case, go to zero.
We can skip this.
This is really important because I also struggle a lot at this point.
If you later on patch some code and then you came across this instruction, you're thinking about,
oh, well, now what I have to do, do I have to jump or can I just leave it?
Do I have to delete it?
The rule of this is if we forgotten colon and then what some go to, we can simply skip this.
This will be ignored.
So we just go over through this instruction here.
Hey, it's me from the future.
But then my quality assurance.
I stumbled across this one over here, and.
Yeah, you know what?
We can make this a lot easier.
It does, of course, not only affect go tos so we can keep the following rule in mind if we are having
a colon and afterwards our label.
This is a label where someone else in the program is referred to so we can simply skip this one.
But if you're having an instruction and condition something like this in front of our semicolon, then
we have to investigate this because this is a decision which is being made and afterwards we are taking
this jump or not.
So this instruction cannot be simply skipped.
And to summarize this real quick, having a line, starting with the colon, this is just the champ
reference.
We are ignoring this, but having an instruction in front of our colon, then we need to consider this.
So we cannot simply skip this.
We have to find out what's going on over there.
And then if you take this jump or not.
All righty.
Perfect.
Okay.
And afterwards, we return from our function.
So we also understand this one and this one return afterwards.
All right.
Okay.
This is our if statement true.
It looks a little bit messy, but, yeah, we introduced some new commands over here or new instructions.
We've got our IFF, which makes an yeah.
And statement and condition.
If we zero is less equals zero.
That's what the set over here means.
We are comparison against zero.
Then we jump to this condition.
So this is our true statement.
Okay, let's clean this up before it's getting even more messy.
Okay.
Now we have discussed our true statement, but we also have an false case.
Therefore, let's have a look how the code looks like regarding to defaults or in this case, the ads
case.
Let's have a look.
So we start reading this once again.
We say this aloud to ourself.
We say, if B zero is less equals zero, then jump to this condition.
But now we do not jump to this condition because we are assuming we have a false state.
All right.
Regarding to the state, we simply move on in the code line.
So we are now right here.
This means line 22 and line 22.
This is just our Java reference.
So nothing nothing special about this one.
Then we've got our input boolean once again.
Interesting.
Let's see, we are putting now we run into P zero and it's again P zero is our this.
And here we are having the instance field of this which is state from type boolean.
So we can simply write our code here, here on.
So what do we have right here?
We've got this dot state.
It's now equals we want.
And this is why I like keeping those registers, because we can now look up our code.
What was we want the last time?
In this case, we can see this one over here.
Afterwards, we subtracted this one, but we didn't reassign this.
Therefore, the value is still the same and we can see okay, we didn't use it further.
This means our v one is holding this value over here and now we are putting a boolean into our this
state, which means we are putting the value one, which means the state true in our desktop state.
So this total state, it's now equals true based on this one.
Okay.
So we also got this one over here.
All right.
Now, now we've got to go to let's mark this different.
Some purple color.
All right.
We have now here our Trump instruction, because otherwise we would go on in this code over here and
this is this code over here.
So the go to at the beginning signals afterwards there's no label.
And we jump to this label right now and this is the difference between this code two and this go to
this one has this go to in front and then this code on go to underscore zero.
So in this case, we are looking for this label over here and we find this at this line.
This means we are jumping from this one over here to this one.
Okay.
I guess you cannot read this anymore.
Therefore, let's clean this up real quick.
So we are jumping from this to this way better.
This automatically means we are skipping the following part.
This, this, this and this.
All right.
And what is this part?
And this part is exactly what's in here.
And therefore, it's good that we've skipped this.
Otherwise, we would interfere with this code over here.
Okay.
So some rules we have to mention.
If, captain, if dash less equals zero, then we've got one condition afterwards, which is in label.
If the statement is true, we jump to this label.
In this case, it would be here.
If the statement is false.
We simply move on with our code until we reach this goal too.
It doesn't have to be in go to for example.
We could also leave the function right now and there might be no goal to in there.
That's also possible.
But if you reach this goal too, then we have to check the label behind this.
Go to in this case, it's starting with the colon.
And then yeah, most of the time I guess every time it's having this go to underscore one, zero two
and so on, and then we have to look in our code for this, go to label and then we jump to this one
over here.
By doing this, we are skipping some code which is intended, and then we move on simply right here.
So now we've got return board.
Let's see.
So afterwards, we are returning out of this function and this is what the code looks like.
And this is super interesting, isn't it?
Because if you take a close look onto this, maybe you'll figure out something.
I will give you some moments and yeah, I will come back afterwards.
Let's have a look into this code and see if there's something strange going on.
A few moments later.
Let's let's create some space first.
So let's get rid of this one.
All right.
And now, can you still remember how the Java code it looked like?
Yes.
Interesting.
Isn't this our Java code was looking like this.
So we've got our if then we've got this dot lives.
Is greater than zero.
I'm pretty sure this was what our Java code looks like.
So did we make a mistake over here?
Did we do something wrong?
Absolutely not.
We did interpret this code absolute correctly.
We go through this line by line and this one is the correct code extracted from the smiley part.
So now the question, do we get the same result?
It would be ridiculous if not.
Right.
Let's have a look.
So in our case and our Java code, we have this dot live creator zero, then move on.
Otherwise we lose the gain.
Let's see now we've got if we zero is less equals zero, this means we are having we not having any
lives left right because this is what we get if we are having zero or less than zero lives.
Then we have the statement over here.
Interestingly.
That's correct.
We are putting our this dot state into a false mode.
This was exactly the part we got in our Java code in the ads case and here we've got OC.
This means we are having more than zero lives.
This part over here and here we can see yes, we can move on with the game because we have our this
date equals true.
Okay.
So now it's the question, why is the compiler doing this?
Well, this might be regarding to compiler optimization for the computer.
It might be faster to calculate if you've got less or equals zero lives, then calculating if you've
got more than zero lives.
And this is why the compiler has chosen to build this code in this instruction over here in this way.
And in my opinion, this is really amazing.
Why?
Because we are even more or even closer to the original part than the Java code, because here we can
see what's going to be executed.
We are not checking if the value is greater than zero.
No, we are checking if the value is less than zero.
And then we go into this instruction over here.
Otherwise we move on on this part here.
And my opinion, I find this super amazing because we are more exact than the Java code ridiculous if
you check out the smiley code over here.
Okay.
So you see I'm super hyped up about this.
And the first time I was really confused because I thought, okay, there must be mistake over here.
Then I checked the code and I realized, wait, what?
This is exactly the same code, but a little bit different, just in a different order, but still correct
result.
And yet this was absolutely mind blowing for me.
Okay, beside all my hyper right now let's get back to the if statements.
What have we learned?
Therefore, let's clean this up real quick.
So okay, if we get to an if statement, we have several points to consider.
First of all, we have to check what's this statement?
We read it in the following way If we zero less than equals, zero, go to this condition and this is
our true statement, then we ignore the rest of this and we jump to this condition or this label over
here, this one.
Therefore, this code will be ignored for now.
We simply move on.
And if we encounter and go to starting with in Colon over here, we simply ignore this because this
is not regarding to our instruction.
Then we have to do this once again regarding to the false statement and within the false statement.
We ignore this target over here and we simply move on with our code until we get to go to end this label
afterwards.
Then we jump to this label and we move on on this part right here.
This means we are ignoring all the rest.
All right.
I know if I look at this picture over here, it might be a little bit confusing.
But don't worry, we go through this several times.
We will also take a look into some slides and we will keep practicing a lot because this time we are
only comparing against and zero value.
There's also an additional if case.
If you've got to register values, something like if B zero is greater then we want, for example,
then we get an additional register over here, but we will learn this later on.
For now, we just focus on the comparison against zero and then we simply introduce a new register into
this and the rest keeps the same.
Okay, that's all for this video right now.
And the next one, we do the same approach, but on our slides, which looks a little bit more clean.
And here we will go through this further and further.
If you've got some questions, feel free to write me, of course.
But maybe they might be also clarified in the next videos because we will keep practicing this over
and over again if statements are super important, and therefore, let's move on in the next video.