Welcome back, guys.
I would like to provide you some kind of bonus video regarding to the XOR encryption before we move
on with another challenge.
I mean, this one over here, it's not required.
And if you have solved this challenge, it's perfectly fine to move on with this course.
In this video, I would like to show you a different approach, which we haven't talked about so far.
And this can come super handy.
I'm talking about reusing existing view output and for example, this one over here.
Let's open the smartphone.
And here we have our challenge and this is the patch version.
So within the ADB logcat, we should find our secret key.
Whoops.
If we write it.
Correct.
Okay.
Many tables.
There we go.
Here we have it.
We have opened this up meanwhile three times and he has our output.
All right?
It works perfectly fine.
And there's nothing wrong with this one over here.
But now, wouldn't it be nice if we print out this text over here?
And this is my secret message at this place where there is.
What was the message?
So if you re-use this output for the original application to print out our output, it would be absolutely
nice.
I know.
I'm glad that you asked and therefore let's have a look into this, how we can achieve this task.
So this one, it's not that complicated and this is what we're going to do right now.
All right.
And to do this, let's first have a look into this application in the patched version and see how this
output is being generated.
So we go into EPS, XOR encryption, then this XOR encryption directory.
And within this we have our patched version.
We are now opening our patched version with shade.
Excuse me.
Oak Creek School is loading.
And here we have it within calm.
App hacking encryption.
We have this main activity and here we can see, yes, this is definitely our patch version because
we have patch to System.out.println into this application.
I mean, this looks absolutely ridiculous.
We have inserted this complete code just based on Smiley into this original app.
Okay.
So here we can see we are printing out this one over here, this part and this part is let's see, encrypt
decrypt.
This is the return value of this method and let's see, we are opening it within double click and we
can see this one over here.
It's in string.
So we are returning back and, and spring from this method and yeah of course because we are also printing
it out over here.
All right.
We are not assigning this string to a certain variable, but within Smiley, we know that this string
might be held in a register.
So underneath this one we've got this text view set text and this is exactly the text what we have seen
and that's opening it.
Yes.
What was the message?
So the only thing we have to do is we have to get rid of this one over here and this text in here,
and let's make this read.
And then we have to check out which register is being used for the return value over here.
Let's call it B, x, and then we are calling this method a set text with our register here.
And then instead of what was the message?
Instead of this one over here, we should have our encrypted text into this this application over here.
So we do not need to connect via ADB and fetch the ADB logcat output.
We can simply reuse existing views of this application to print out our text.
Absolutely amazing.
Right?
Let's do this.
To do this, we have to decode this application, the patched version.
So this one over here, APK tool, the out APK.
And so here we have this out directory.
And let's open this with Wizard Studio code.
All right.
And here we have it.
And we select Java.
Already done.
That's good.
And now we do not have to reverse everything in here.
We just start reverse engineering at this part over here.
So let's compare this.
We go into apps, XOR encryption.
Let's see what line this one is in our code.
I mean, it's line 21.
If we take a look at this line number over here.
But I guess this is just right before our system out.
So let's see this desk.
I should keep it simple.
Just open.
I guess that's easier.
All right.
Com app hacking and corruption.
Main activity.
Yes.
Line 21 and System.out.println.
I guess we were line 21.
We just have to reverse engineer upwards from here and then, yeah, we can do this task.
All right, let's take this to the graphic tablet and then have a look into this one.
Okay, let's do some speed run over here.
So we started this line and the rest will be simply ignored.
This little this one over here will be ignored.
Okay, so we see row at this line is holding our encrypted string.
Okay.
Then we call invoke static aesthetic method and we call encrypt decrypt this exactly the method we want
to have because this one is returning back in string.
And let's see.
Yes, here we can see this is the return type return and this will be a string and so our string will
be moved into V zero.
The result will be moved into v zero, which means we zero is now holding our decrypted string.
We are overriding the zero at this point.
And then we have escaped object.
So we fetch the system out.
System thought out.
And we can see we are invoking a virtual method on this on this field and we are calling the method
print line and we're calling print line with an argument and this argument is v zero.
And this one over here, maybe let's let's change some colors.
So this is our argument for this function and this one is our decrypted spring OC.
And then we can see the zero will be assigned to a label which is encrypted, but we can simply ignore
this part over here.
We zero is still holding our decrypted string.
And then let's take another color.
And then we've got an I get object and we are fetching in p zero.
This is this this object may have fetching main activity.
This is our this object and we are fetching the text view from the main activity.
So here we can see this one over here.
This is the type and we are fetching main activity dot text view into.
We won and so we won is holding.
And then we've got our screen.
Another color.
Me, too.
So we see it still untouched.
We still are still holding our decrypted string.
Here we have now another string.
V two.
V two is now the message.
And what was the message?
So what?
And so on.
And then back to yellow.
We are calling invoke virtual on V one.
We want we can see over here is our text view.
Oops.
This was a little bit off.
There we go.
So we want this our main activity text view.
I hope you can read this because it's barely not possible for me right now.
And we are calling the method set text.
So at this line over here, we are calling main activity text view and we are calling the method.
This one over here.
Set text.
Okay.
So here we have a kind of new line for our parameter, and the parameter is let's change it.
To which color didn't we had right now in this one, the parameter is now this one and this is not in
string, this is and char sequence.
So this is our, our, our parameter and let's do it in this way.
Okay.
And maybe to make sure.
All right.
This is our parameter.
And this function is returning back in void.
Okay.
So this means our parameter is within B two.
And this is our parameter.
And all we have to do is we have to replace this one over here.
This v two will be zero.
Whoops.
There we go.
Because if we replace the two with v zero, then we are not passing this string.
What was the message in this one over here?
And then we are passing this one into this function.
And this is our decrypted string.
So on the screen, instead of what was the message, there should be appear our decrypted string.
All right.
Okay.
So this was a little bit speedy, but I guess you could still follow because we have reverse engineered
it in the in the last couple of videos.
So yeah, therefore I hope you could follow in case if it's too fast, simply please drop me a message
then I will rerecord this and make it a little bit more slowly and also explain it a little bit more
extensively what we are doing.
Alrighty, perfect.
So let's get back and let's apply this patch over here.
Let's do this.
Okay, so here we are back on the Ubuntu VM and we can see in this one over here, this is the string
we want to replace.
This is our B tool and we have to replace this, this string, this register B two with v zero because
v zero is the return value over here and this register will not be assigned to a variable, but it also
won't be overwritten in our in our application code and therefore we zero is still holding the reference
to the string and we are simply just putting this register into this function right now.
Okay, perfect.
So the patch, I mean, it's pretty easy.
All we have to do is we have to change this parameter from V two to V zero, and that's it.
Let's save this.
Let's pull this application back again and then let's see if this works so this one is not longer required.
Okay.
Now it's a little bit confusing because we are within the dist this directory and now we have this out
directory which is our day compiled application from the disk directory.
So we have to reboot this one over here.
So epic two to be out.
I hope I have saved it 10,000 times, but I guess it should work.
Okay.
That's a bit later.
Whoops.
Sorry.
There we go.
And then within this directory, whoops, the disk directory of this out directory, we have now another
out epic.
So we are using zip line and that's correct.
It is not.
Oh, now we have to adjust this.
The second application.
This is now our supply line application and now we have to use the APK sign up for this out and thus
go patched.
So we are patching our modified patched version, which is a little bit ridiculous.
But yeah, I guess you can still follow on this one over here.
All right.
And here we have now our out patched apk.
This one has been signed and we can install it.
I guess we can override this application because the key is the same test only.
All right.
Looks good.
Now let's open our screen copy.
We have it open twice.
We only needed once.
Okay.
And now let's see if this worked out.
So let's open this encryption application.
And what should happen is we should see our text and system dot out print line.
So this shouldn't be affected at all.
Let's do this adb logcat and grab system out and let's maybe clear this first.
Okay.
Let's do it.
Okay.
But beside the system out.
So beside this step back output, we should also see it now in this application directly.
So let's see.
I'm opening it in three and one.
There we go.
This is my secret message, and this is exactly what we have here.
So this is a little bit more convenient to use right now, patching or using existing views to print
out our our secrets.
I mean, this wouldn't be a good approach if you had developer to print out the secrets on the screen.
But if you're a hacker, it definitely is.
Righty.
Okay, perfect.
This is all I would like to show you over here.
This can come super handy.
And yeah, I hope it wasn't too confusing.
So I'm looking forward to see you in the next section.