All right, guys.
Bye.
Come back.
Now it's time for a challenge.
So we take our system out, approach and try to print out the encrypted or the encrypted method.
Regarding to XOR, it doesn't really matter because our input gets X or within within value or on key
and then we have our output which is encrypted or decrypted.
If you take the output X or it back again with the same key, we get back our input.
Therefore, it doesn't matter if it's an encryption or decryption method.
Okay.
However, we've got our application and we need to find out the secret message.
We can see the secret message is not being printed.
So I would assume that we have to deal with an encrypted text and we need to get the decrypted version
of this.
Okay, we can see the application underneath and yet the layout has been also improved.
I promised this to you.
So.
So yeah.
Let's simply analyze this application and see how we can use the system, our approach to get out the
message.
Therefore we switch to our Ubuntu VM and you can find this challenge in the section as an attachment.
I have already downloaded it and it's called XOR encryption.
So I take this app, put it into our well-organized apps directory over here, X or encryption.
All right.
And now, yeah, let's simply take a look into this.
So you have once again, we use the excluded part and let's see if me.
Yeah.
Decompile that fully correctly or if there are some errors where we need to take care of so shady.
Excuse me then we've got this lock level and we also want to get the errors.
Okay, let's see.
Application is loading.
Slowly click into the Android Manifest XML over here.
All right, let's have a look back into this.
Okay.
So far, all good.
Okay.
In the Android manifest, we can see we do not have any certain permission.
That's good.
We only have one activity, which is the main activity, and that's the launcher.
All right, let's have a look into the classes.
So this is our main activity.
Let's get back to this one.
Okay, so here we have some problems, but these are not regarding to our code.
Okay, so.
Yes, it looks fine.
Okay, so here we have our main activity.
Let's see.
We've got our own create, we've got set content view, we've got the text view and we also got XOR
encryption, encrypt, decrypt.
All right.
And this is our message.
So I would assume this is the encrypted version and this one decrypts it.
But after what we can see, there's no return value, or at least we do not use this return value.
So we never know what this decrypted message looks like.
And this is the task we have to find out.
Okay, so let's get into this encrypted script.
We can see interesting this method gets in return value from type string, but it's not being used in
our Java code, so therefore it gets thrown away at the Java side.
All right.
So this is a static method encrypt, decrypt.
It gets an input string and it returns backing string.
Okay, here we have our key, which is epic.
We've got a new string builder, so we've got a new output buffer.
And here we can see we've got the for loop, which is based on the input length.
All right.
Then we've got output append and we take one char from our input and xor it with the key modulo key
length.
Okay.
And then we return it back.
Okay.
So if you deal the first time with an XOR encryption, I guess we should recap this a little bit.
So I get out my graphic tablet and then yeah, we have a look into this.
Okay, let's talk about this function.
So we've got this function encrypt decrypt.
We have a string as an as an parameter in there.
All right, so this one over here, this is our message, our encrypted message.
Let's say it looks like.
This one over here.
Then we've got a for loop or let's say, okay, we've got a key first.
So here we have a key.
Key is equals.
And then we've got single letters, a, p, p and so on.
So this is our key.
Okay, now what we do is we take our encrypted message, this one over here, and we put this into this
for loop.
This means we take one char out of this and we explore it with the first char over here.
So this means this dollar sign gets now x ord with a we do this for the length of this message.
So we do this as often as this message here gets input data.
This is what this length at the beginning is about.
Okay, now we've got the super strange looking part over here.
And this makes sure let's assume we've only got a sun key.
Three letters, these three charts.
So that's the end of our key.
But now we increase the count over here.
So we take the next letter from our message, which is the hash tag.
We export this now with P, then we take the next one, which is one, we export this oops, we export
again, we export this with the other P and now we have a problem because we take the next one, which
is S and yeah, we do not have any letter left in our EP key.
This is why we have this modulo key length.
This means if you run out of characters in our key over there, this one, we make sure to start at
the beginning once again.
Therefore, it doesn't matter how large this message is, we simply start at the beginning.
So this one now becomes an a peg again.
So if you reach the end over here.
Then we go back to the beginning and this is what this AI model, low key length does.
Therefore, it doesn't really matter how many charts are in there.
For example, if there are more than on the right, it doesn't matter because the key length, the four
loop of the key length will abort afterwards.
So let's say our message only contains two characters, so this one is not available anymore.
Then this first condition over here in IE is equal to zero.
IE is less than input length.
So in this case, the input length defines how many rounds we take over here.
And if the input length is less than the key length, it doesn't really matter.
So the only problem with this one is that the key gets cut off.
And at this case, we do not have more than two characters.
So our keys are only two characters long and P, but that's also the case for our message.
All right.
So this is what this function does.
So now let's see where we can place our system out to get the to get the decrypted message out.
So let me clean this up.
Okay.
So we have different options.
The first one is within this one.
So here we have output to string.
This means this method over here returns our decrypted string and this will be stored in there.
So before we return out of this, so let's say it looks something like return me one for example, or
V two, we just know this.
So before we return out, we simply add our system out over here, system, dot out print line we want.
By having this before the method returns out of this one, it simply prints out the encrypted or decrypted
message to our console.
And this is exactly what we want to have.
But at this point, we also see some typecasting over here.
So this output is from type.
Let's see.
String builder.
And here it gets typecast to string.
So yeah, we also have to typecast it first.
Otherwise we are returning a string builder and I'm not sure if this works.
So this approach is working, but it's a little bit more complex.
So let's have a look into the main activity and maybe we can do it over there, which is a little bit
easier.
So I clean this up and yeah, let's get back to the main activity.
So here we can see we have our XOR encryption, then we've got encrypt, decrypt and our message which
is being which is encrypted but will be returned as in string decrypted.
In this case we do not have an we do not have a variable assigned to this output.
So the return value of this one and we can see yeah, it's not going to be used, but maybe we've got
this in the smiley part.
So at first look it doesn't seem like to be invalid option for us because yeah, we do not have a return
value there or a return value that's being used.
But let's have a look into the smiley code.
Maybe the smiley code is a little bit different.
So let's see.
Okay, so I have decompile this application and now we simply open the smiley file.
Let's have look into the main activity and change this to Java.
Okay.
So let's see.
We've got our main activity and we extend AB compact activity.
Okay.
That's our source file.
Here we can see we have an instance field from text view.
Haven't seen this for a while.
Then we've got our constructor direct method.
Here we have our public methods.
Oh, it also accounts for protected methods.
Okay, so at this point, sorry, on this, virtual methods are regarding to public and protected methods.
Okay.
Then we can see we have three local registers and there's a lot of stuff going on here.
But let's have a look back into the Java code.
So let's see.
Okay.
So here we have the line numbers.
If we left click, we can see these are the original Java line numbers.
So we click once again.
These are our line numbers regarding to our smiley code.
So we are not interested in this super on creates that content view and also this text view.
So let's try to skip this one and also this one at the end.
So we are only interested in this part.
Let's see if we can encapsulate this a little bit.
So let's see.
Line 1617.
Here we can see.
Let's see.
Here we have our own create set content view find view by ID.
This is all the stuff we are not interested in.
There we go.
Here we have our encrypted message.
Okay.
I told you to not only rely on those line numbers, but if we take a look at this right now, we can
see, okay, here we have our encrypted message.
It's being stored in V0.
And if you take back a look, okay, this should match regarding to the Java code over here.
All right, then.
Let's see if result.
What's the message?
Text view.
So this is the part we are interested in.
This is line 21.
And if you take back a look, this is exactly what this one does.
Okay.
And now let's see if we can use our system out approach over here.
So we've got the string which is being stored and we zero.
Then we have invoked static and here we can see nice.
We've got a move result object into the zero.
And if you take a look into this, this is XOR encryption encrypt decrypt.
So we are we are storing the resource value in our register V zero.
But this one is it's not being used anymore.
Let's see.
Yes, we simply have a name for this one which is encrypted, but it's not going to be used anywhere
else.
Therefore the Java code throws this return value away, but not this smiley code.
So the smiley code, it's it's like the matrix.
We can see the whole code in there, not just the surface of this, which is shown here within the smiley
code.
We are we are seeing the whole code and this one is super nice because we have in reference to our,
to our string over here and now we can print this out.
Okay.
So first, let's analyze this code over here that we make sure that we understood this and then we we
insert our approach.
All right.
Okay.
So we are putting our encrypted message into we zero.
Okay.
So we zero is holding our encrypted message.
Okay.
And then we have invoke static.
So this one is clear.
Next we have invoke static box static.
This means we have an argument over here, but now we need to be sure it's this now the this object
or is it the parameter of our function?
Do you still know what's the case?
One invoke static.
If not, please look this up.
So is it this or our first parameter?
Yes, absolutely correct.
This one is our first parameter of dysfunction.
We can also cheat a little bit on this because if you take a look so we are calling the method encrypt
decrypt.
And here we can see we we are having a parameter in there.
So this one is our parameter.
It's from type travelling string and this parameter needs to be mentioned in our in our parameter list
at the beginning.
Therefore we know we zero is not the this object, it's our first parameter.
By the way, invoke static.
Never has this object in there because the static method does need an instance to be called.
It's just simply the class and method name.
Therefore, yeah, we can simply we can simply remember this or we can do our analysis on this to figure
out what's the case over here.
I like the second approach a little bit more because this helps us also for other instructions.
Okay.
So let's get this cleaned.
There we go.
So let's see what this does.
Okay, so we are having here our X or encryption class X or encryption.
And now we are calling.
Dot encrypt.
Decrypt.
Encrypt decrypt with our v zero as the first parameter.
Lips won't color.
Well, it's a wrong color.
There we go.
And we are returning back and string.
Yes.
So this is exactly what we have seen and analyzed in the Java code.
Okay.
Next, we've got this instruction move results object into V0.
This means our V0.
Contains now the return value of this function.
And this function encrypts or decrypts our method.
And this function over here returns the decrypted message.
In our case, because we are inserting an encrypted message and by calling this, we get back the decrypted
message.
If we put in our decrypted message into this function, we will get back the encrypted message.
So regarding to XOR, please have a look into the cheat sheet because we will encounter XOR a lot and
I have mentioned the whole operation in this cheat sheet because it's really important.
All right.
So now we know our V0 contains the string we want to print out.
The only thing we have to do is we have to insert the print out statement over here.
And this is what we're going to do right now.
So I clean this up real quick.
And now let's have a look.
So normally I would take out my cheat sheet and have a look and how an Yeah system out works.
But regarding to our slides.
Yeah, let's try to reconstruct this a little bit.
So we know if you want to use system out, we have to first get the object reference and this is done
by asset object.
Afterwards, we need to invoke the method print line.
Okay.
So here we are fetching the object system out and then we are using print line which ends up in system
called print line.
Let's try to get these information together with the things we know.
So therefore, we open up the cheat sheet, the not the not system, our cheat sheet, the dalvik up
code cheat sheet.
And we're looking for a asset object.
Reads the object reference field identified by the field ID into b x.
Okay, so we are having a reference field which is being identified by the field ID.
Yes, absolutely helpful, isn't it.
So let's see, we simply copy paste this command over here.
We have to take care about the registers.
But this one is clear right now.
We have to put this object into a register.
Now let's see how we can get the field ID and therefore we take a look at the official Android developer
guide regarding to system out.
All right, so if you search for Android developer system dot out, we have a Stack Overflow entry,
which I already clicked off, cause then we've got another Stack Overflow entry and we've got the developer
reference.
In this case, we use this one over here because this is regarding to the the system reference.
Okay.
So system is from travelling system.
This is important because we need this type reference for our object.
Let's note the star.
Okay, so maybe let's write this underneath, ask it, object our register and then we are using.
This reference over here.
Yes.
And now we want to access and field ID.
So therefore we have this arrow and this field ID.
Let's see, this field ID.
Can we find this here?
Yes, we have fields out.
So does exactly what we want to have.
System dot out.
Out is from public static final print stream out the standard output stream.
This stream is already opened and so on.
Okay, so we need to type reference of out also because system can have more than one out, but we are
looking for the print stream out.
Therefore, to get this type reference of out, we click on print stream.
It's loading.
There we go.
And now we know this is from the type java i o print stream.
Okay.
So we copy paste this one.
So we want to get the field ID out.
And this one is from thai java i o print stream.
Therefore we just need to add this app and that's it.
This is how we can get the field ID from system dot out.
So this one here does system dot out.
But now we need to take care about the registers.
So we can clean this out.
Okay, now let's have a look at the registers.
So let's see.
We've got three local registers, which means we are having the zero.
We want and be to.
All of them gets used beside the zero.
But we need to keep a zero because this is our string we want to use.
Therefore we cannot override it over here.
This means if you want to keep the code underneath which we want to, then we do not have any other
options than introducing a new register.
But that's not a big deal.
How can we do this?
Yeah, let's go back.
So instead of having three local registers, we're having four right now, and that's it.
Now we can use the additional register we have created, which is V three in our case, for example.
All right.
And yeah, that's all about this line over here.
So let's recap this real quick.
We have our system outfield, which gets identified by this type reference system.
And here our outfield is from type Java IO print stream and we put this into V3.
This means system dot out is now being stored in B three.
We can get these information, these type references from the official documentation over here.
So if we go back here, we are in the system reference and system is from shovelling system and the
out field is from type print string.
If we click on this.
We can see Prince rim is from Java I au Prince dream and we have to be precise on this which fields
we are using therefore we have to add the exact type references over here into our code.
Okay, one last thing.
We need to close this one here.
Yes.
Now we've got that completed.
This semicolon means this is the end of the type reference.
All right, now we've got this syntax correct.
So let's see the next one we want to call the sprint line.
Let's see how we can find this information.
So we get back into this developer reference.
Let's see, maybe we've got it already here.
Yes.
There we go.
Println is a method which gets overloaded with different here arguments and parameters.
Over here we are looking for string this one print line string.
So we click on this.
Okay.
Print line is a public void method and it doesn't return anything, but it hasn't string as a parameter.
Okay.
So to call a public method, we need to have invoke virtual.
Therefore we go back into our code over here, invoke virtual, invokes a virtual method with parameters.
Okay, let's see now we have to take care about this parameter.
So here the first one is our this object.
In this case, it's system dot out and then we have the additional parameters in there.
So let's copy paste this.
And insert it here.
Okay.
Parameters.
The first one is really easy because this is our system out our this object.
All right.
The next one is now our decrypted message.
And this is being stored in V0 over here.
So we also take this one as the first real parameter of this function.
Which function?
Print line.
Therefore, let's get the type reference of print line.
So let's see.
Print line, this one over here, and then print line.
Let's click on this method.
All right.
And let's get let's get back on top.
Okay.
So print line is from print stream java i o print stream.
This is our type reference of print line.
So we need to copy paste this one.
So now we want to call the following method.
First, we have to add the reference of which type this method is.
It's from Java, a o print stream.
Therefore, capital L and the semicolon to signal the type reference has ended right now.
Then we need this arrow and we need to call.
Print line.
Returns.
Void.
Let's check this.
Println for string.
Yes, it returns void.
And here we have now our parameter.
And our parameter is V zero and P zero is from type.
Let's see.
Travelling string.
So we simply take this one over here and add it as this parameter value.
Okay.
Now everything should be set up correctly.
Let's see.
We've got our asset object.
We are getting the field ID out, which is referenced by travelling system and this field ID is from
type java I print stream.
We get this into B three, then we want to call the method print line.
Therefore we are using the invoke virtual on V three, which is our system dot out.
And now we want to call a print line which is from Java I o print stream and has a string as in parameter
in there returns what?
Okay.
And this should be all.
Okay.
So now we can through this very detailed and yeah.
One hint is if you cannot find or if we do not deal with the official documentation functions.
So let's say we want to call an an internal function which has been created by the developer.
Then we can also get these information within the JDI output.
For example, this type over here travelling string.
So within the inputs it might be not absolutely clear, but if we decompile this code then we can take
a look at the smiley code over here and see what type this object has.
We can also look up existing objects and simply copy paste this type reference into our code.
We have to make sure that we are using the correct one and we will also do this in some other examples
later on.
But I want to mention this right now, that it's not only working for the official documentation functions,
it's only working, of course, for every other functions because simply unlimited power.
All right.
Okay.
So let's see.
We need to clean this off because this is not valid Somali code.
And yeah, I guess that's it.
Let's try compiling this app and see how it works.
Okay.
So now I see this arrow and this arrow is super dumb because it's regarding to the copy paste.
I was wondering why this is mentioned in blue and the reason why it's mentioned in blue is we still
have these dots in there.
But Smiley is regarding to directories.
So therefore we need to replace these dots with.
Yeah.
Slashes.
So let's see.
Okay.
And I guess that's also what this arrow mentioned.
So let's have a look.
Andrew Ford Yes, so at this point I mean the, the error message signals, okay, we do not have a
dot laying dot system, dot iota print stream and so on.
Therefore we know we, we have to take a look into this and yeah, if it gets marked as blue because
this is Java syntax right now, then you, you can directly see what's the problem here.
All right.
Okay.
But nevertheless, I guess this is a really good example because we have seen if you make some really
bad syntax errors, or at least I have done this, then the smiley compiler is trying to point this
out at an error message over here.
And then we can take a look into this and figure out what's the problem.
If you copy paste this and you see an blue underlining here with Java syntax enabled on, then you can
see it directly.
So I'm not sure why I overlooked it that long, but yeah, I also make mistakes.
All right, now let's see.
We save this file, we try to build it back again.
And this one was the version without those two statements.
Let's see if it's now working.
Looks good.
All right.
The app has been built.
That's a good sign, but it doesn't mean that our syntax is working.
There could be an error that occurs while accessing those objects.
And this is during the runtime.
But building an app without Somali errors is a good first step.
Okay, so let's see.
The screen copy is not available anymore.
Let's see.
Okay.
So it seems like we have lost the ADB connection.
So let's get the screen copy back again.
Maybe we connect
in case if you also encounter these arrows, simply just restart the Android virtual machine.
Then then we are good to go.
Okay, let's keep this in foreground.
So we still got our original version installed.
Let's see, maybe we've still got this system out grep somewhere and there we have our system out grep.
So.
Yes, that's the original version.
Let's uninstall this and see if our system out prints out the decrypted message.
So let's see.
ITV shared p m list package shows.
I'm not sure about the package name, so let's search for encrypt it.
Be uninstall account.
Oops I need to go back and be uninstall com app hacking and corruption
so the app should be gone.
And now let's run this system out Grub Command and here we are going to install our build version.
It's not even signed right now.
Have we already have built this after making this error?
So let's see.
Okay, so here we have the destination.
I have built and signed this app.
Right now let's install it is our modified version OC install test keys only.
No problem.
Okay.
There we go.
Here we have the encryption app.
Let's open this and see.
There we go.
This is my secret message.
This message is our decrypted version of what we have entered.
Super nice, isn't it?
Even without having root privileges or an debugger attached to this, we can print out a secret message.
We can also print out the key, for example, and we can also verify that this message is correct.
We can use this over here and we can simply close this one.
We can simply replace it with this one.
So if we now build a setback again, we should get the encrypted version.
Let's do this real quick.
Okay.
So here I have the new version already signed.
Lets in.
So let's uninstall the existing one.
Okay.
Let's install our new version.
And the test keys.
And this one now has our decrypted message as input of our XOR encryption method.
So by opening this one.
We can see.
Yes, we get back.
Whatever is going on right there.
But we get back our encrypted message text here.
So super nice.
This is how XOR works.
We have an input, be it within key or on value, we get an output and if you take the output xor it
with the same key, we get back our our input.
Alrighty.
So what I wanted to show is how you can write the system out on your own.
And in case if we have some missing registers, we can simply introduce new ones.
And by having this, you can print out whatever you like.
Okay, sorry.
Maybe not whatever we like, because if you do not have a string in there, let's say an object, we
need to figure out first how we can print out this object.
But you guess what?
This is what we are also going to do in a couple of videos.
Okay.
So for now, that's all about the system out.
I mean, we have coded this now on our own and we have seen how we can get the necessary informations
to, for example, how we can fetch this information that it's Java print stream and things like this.
We have also seen a dump mistake by me, which is having thoughts instead of slashes, but the solid
compiler point us to the problem.
And yeah, I could figure out what was the case.
All right.
That's all for this challenge right now.
But don't worry.
Within the next video, we take a look into another challenge.
So we have a lot of challenges right now.
So I see you there.