Okay, buddy, come back.
This is the bonus video.
So we take a look into another approach on how to solve this challenge.
And I would like to provide this to you to see there are lots of opportunities.
We've already got to solve this challenge.
Okay, so let's see.
First, let's get this application screen back.
So this is our route check here.
Yes.
Our device is routed.
All right.
So this is the application.
And now we want to bypass this by patching the labels.
So we close this one and we go into EPS.
Then about that root check, there we go.
We first decompile this application.
Then we open the whole smiley directory with results to code.
All right, then we go into app hacking and then the root util.
There we go.
We click away those annoying windows.
Select Java.
Click it away.
All right, let's open it up on the compiled version right next to us.
So, Shade.
Excuse me.
Root check, dot apk.
So I've got my graphic template out and we are still talking about the device's rooted method.
So if you go down.
There we go.
So here we can see.
Okay, we've got several checks.
Check route, method one, two.
And this one is three.
There we go.
Okay.
So this is the method on the travel side.
Let's take a look into the smiley part.
So here we have our method is device routed.
This returns a boolean value.
Then we've got our three checks over here.
And these are combined with our statement.
So with this one over here, let's analyze this real quick.
Okay.
We start at the beginning.
Is device
rooted?
No parameters, boolean return value.
So we've got a local variable.
Sorry.
Local register over here.
Then we've got our line ten and then we've got our first invoke static.
This is the class name route util dot check method check route method one.
Okay, this resort gets moved into v zero.
So this means our b zero is route util.
Thought Check route method one.
And so on.
Then we've got our if statement.
So we've got this and this.
Next we've got our if statement.
If we zero is not equal zero, we jump to condition one.
If we zero as not equal zero, we jump to condition one.
Condition one is this one here.
So we jumped down here.
And yeah, before we take a look into this, let's analyze this real quick.
What do we have here?
Okay.
This means if our Y0 is not equal to zero, it means our B0 is set to one, which means the return value
of this function over here.
And this one here has been one in the case of a true statement here.
This means we've got the rooting detection or the rooting detection signals identify something strange
on the device and it flex it as being rooted because we have here a boolean value.
So check root method one returns true and then we know this device is rooted.
This means we go into the condition one over here.
We've also got this go to label but we can ignore this and then we right one into our B zero and B read
one out.
But with the return value of b1v0, sorry, which is one and this means it's true and this means it's
device root.
It becomes true and this means this is bad, at least for us as an attacker, because then our device
is being flagged as rooted.
Therefore, we know every Trump condition which ends up here in this part.
Maybe the true case.
This means our device is routed.
And this means every jump to condition one and also the go to zero label will make or will flag.
Our device is being routed.
Okay.
So let's clean this up real quick.
These three here mean devices are routed.
Okay.
So regarding to our check with here, we've got our check over here.
This one is device routed.
Then we've got.
True.
The devices are routed.
And we've got Ford's.
True means we end up at condition one and also with the go to label zero.
Okay.
Let's see where we end up if you want to get our false statement here.
So which Trump instruction we need to get to have this false enabled.
Okay, so if this one is true, we go downwards.
Therefore this is our false statement.
Okay, then we have this once again for method two.
We move this in v zero.
All right, so we zero once again, not equal zero.
We've got exactly the same code over here.
All right.
Here we can see.
True.
We still end up in condition one, which means our device is being routed.
Therefore, if this one is also false, we move.
Check, check.
Root method three into we zero wrong column.
Okay.
And then we've got if equal 0v0.
So let's write this down here.
So if.
We zero.
It's equal to zero.
We jump to condition zero.
If we zero is equal zero, we jump to condition zero.
When we zero is zero, it means we zero is false.
So our check root method over here will return false.
If we go into condition zero and condition zero is this one over here?
So we move the value false into the zero.
And afterwards we go to label, go to one, which is this one over here, and then we return out.
So this means we are returning.
Me zero.
Okay.
If you look at this and let me clean this up a little bit.
Okay.
So if we get into this jump over here, condition zero, then we end up here, this will move forwards
into the zero.
And then this one is a jump we always take if we are at this line because this isn't jump instruction,
gold rule and also the label.
So if we end up at this line or let's say in condition zero, we also take this jump to go to one and
go to one simply skips this bad code over here which yeah.
Moves through into v zero and this is not what we want to have.
Therefore we know our false condition is set to let's see, condition zero.
Okay, so now let's adjust our labels no matter what's the output to always go this way, even if it
would have taken this way.
So we get rid of this path and we direct all of this, all of these jump instruction to this path over
here on the right.
And we can do this by simply adjusting all labels to condition zero.
So if this one is Condition zero and this one is condition zero and everything is condition zero, then
there is no option to get into another branch over here.
So we've got no option to get into this one.
This one is out right now and we only can reach condition zero, which means we are putting false into
the zero and then we are leaving out this function.
So this will be code that can never be reached again.
All righty.
Let's adjust this patch.
It looks a little bit messy, but I guess.
Yeah.
But I hope you could follow on this.
All right, so let me clear this up.
And now let's do the patch.
All right, by applying the patch, we do not have to consider.
Oh, it's just now a true or false statement.
Do we have our test keys, enabled or not?
This is things we need to care about if we flip the logic, but not if we adjust all labels over here.
So in this case, this is simply our fault, this one over here, and therefore we direct all to this
one right now.
So this becomes condition zero.
Also, this becomes condition zero.
This one also becomes condition zero.
All right.
And I guess that's it.
Yes.
Even if this check fails right now, we jump to condition zero, which is this one over here.
All right.
This was the only thing we have to take care about, because now we've got a reverse logic, let's say,
in this way.
Here we are checking if it's not equal to zero.
Now we're checking if it's equal to zero.
But by changing the label also to go to condition zero, which is.
We ask that there is.
It's directly underneath.
I do not see this.
Okay.
If you change it in this way, then yeah, we do not get into this one and this will become that code.
I'm also super excited how this application looks like.
If you patch it in this way, I guess there will be some hard statement, something like return false.
But let's see.
Okay.
One thing I want to additionally add to this video is if you patch those labels, you need to be pretty
careful because you can accidentally create endless loops and this can happen super easily.
I would like to show you what I mean over here.
So over here, for example, we have this jump to condition zero.
Here we are also having a jump to condition zero.
And this one over here.
Here we are having an additional additional jump to condition zero.
And here we are having our condition zero.
So this is our patched version.
And if the compiler is creating this code, the compiler makes sure that the that the program flow is
correct.
But now if we if we get into this control flow and patching it, we need to make sure that the control
flow is still correct, because what can happen is the following.
Over here, we're having now all these chump labels, two condition zero.
So let's say this one on the right is our program code.
Okay.
So here we are having our program code and this one over here.
And this is, for example, the jump to condition zero.
And let's let's write it down in the following way, condition zero.
This is also the case over here.
And this is also the case over here.
And this one over here.
Condition zero.
And now, finally, we have it here.
We're having it.
Okay.
So this one over here is.
Then finally our condition.
Zero.
It's not that straight anymore, but it's still our condition.
So this means all these chumps end up over here, and this is perfectly fine.
So here we are, ending up with all these chumps.
All right, this is okay so far.
But it could be easily the case that this condition zero over here is not related here at our program
code.
So let's say this condition zero is, for example, in between them.
Let's say this condition zero.
Sits here and this is now our condition zero label.
So what happens right now?
Let's remove this part.
So now our condition zero is here.
And this means the first or sorry, this jump.
The first jump and also the second.
Trump are referring to this one.
Okay.
But now, now we could have a problem because after this one over here, we are having a jump back.
This could be invalid case.
For example, if we're having a for loop, then we are also creating a case like this one.
So this is our for loop.
And within a four loop we are also having these these conditions, for example, this block over here.
So within the follow we jump, for example, back to this one.
Then we we subtract minus one from I let's write a different minus minus and then we will we will leave
this conditional trump this loop if I is less than equals zero and then we we break out of this one
and we move on with our original code.
So this could be a valid behavior.
But in our case right now, we have modified this Trump label and we are not having any condition when
we leave this code.
This means we are having now the following case.
So let me clean this up really quick.
So we're having now this condition zero.
And let's say we move on at this point in our program code and then we end up at this point over here,
at this point, we are jumping back to condition zero.
Then the program once again goes down until we once again are at this point, oh, we are jumping back
to this point once again, the program and so on.
I guess you get this point here we are having now an yeah, an endless loop.
Endless loop because we are not having any condition to break out of this one.
And this is the case because we have modified additional Trump instruction, for example, this one
over here.
This has not been I mean, I'm not sure if this has the case right now, but in our case right now,
let's assume this has been conditional one before, and this one also if conditional one is underneath
like this one over here,
conditional one and then does Trump's are definitely correct because they have been created by the compiler
and the compiler have taken care of this one over here.
I mean, Trump's doesn't have to go all the way down there.
Could be also correct if they go upwards.
But then there are certain conditions that we do not end up back in this in an endless loop like over
here.
But if we modify them that they are not going this way, that they are going back to condition zero
over here, then we need to really take care of this one over here.
All right.
Okay.
So if you adjust a lot of labels in your code, maybe draw this on the right and make sure that you're
not accidentally created an endless loop like we're having at this case over here.
So this one over here, that's an endless loop.
Okay, now let's get back to the video and move on.
First we apply our patch.
Okay?
So we hit the save button multiple times.
All right, then we build this application.
All right.
And no, it's not possible in this way.
ADB in style because our ipxe named our DPC.
Alrighty.
Screen copy.
Slide up.
We'll check.
There we go.
We've also successfully patched it y.
Yeah.
By adjusting these labels.
Nice.
It's not impossible.
Yes.
We've got really insane smiley scales right now.
Nice.
All right.
And let's have a quick look into what this application now looks like regarding to the java code.
Com and root check.
Root util.
Yes, exactly.
I didn't look it up.
But I've got this feeling that it exactly turn it in this way.
All right.
Nice.
Super nice.
Okay.
So we can also adjust our labels, but we have to understand the code, the code which is within the
Visual Studio file.
I already closed this one over here.
So if we identify what's the condition we want to end up, we can simply adjust all other label, all
other labels to jump to this condition, which is this one over here.
Okay.
So I hope this helps you if you tried this approach, it's not that easy to think about this if you
start learning Somali, but but I guess this approach can be also super helpful to you in the future.
Therefore, I would like to make an own separate video regarding to this one, because you also do not
see this very often in the wild.
Okay, so that's all for now.
In the next section, we take a look at objects and methods, and this will be even more exciting because
we are going to insert our own code into the Somali part, not just in single instruction like this
one, we insert own code.
So I see you there.