All right, guys, welcome back.
One challenge to recap all this is exactly what we're going to do right now.
So this is encrypted challenge.
And we will we will recap all the things we have learned so far.
Besides this, I have split it up into three series.
So the first one will be about dealing with unknown smiley syntax.
We have learned a lot in this chapter over here, but we cannot learn everything.
The things we have learned so far are more than just the concepts of Smiley.
So we have we have done a lot of huge patches into existing applications, but now we are facing unknown
smiley syntax, which is absolutely no problem for us as we will figure out in lesson one.
So there we have to deal with unknown syntax, but we can reconstruct the functionality of the syntax
simply by adjusting our knowledge on Smiley into this application.
So this is freaking awesome the things we have achieved so far.
Alrighty.
Lesson two will be about getting out those informations of this application, those crypto informations,
keys, secrets, tokens, things like this.
So far we had absolutely no problems regarding to this one because most of the time we had simply already
in string in there.
But now we have to deal with complex objects because this is in real world application and printing
out complex objects is nothing we can do easily within systems or out, and therefore we have to find
ways on how to print out or get out these information into other objects that might be able to be printed
out.
So this is something we will do in lesson two.
Lesson two is the easy approach, and it's the most common used approach from my site right now.
So I always recommend doing it in in the easy way.
There's absolutely no need to go for the hard way.
The hard way.
You already guessed it will be less than three.
And I have inserted this hard way because in the hard way we will we will do an and huge smiley patching
right now.
So we will insert, I guess about, I don't know, 50, 60 lines, maybe 50, 60 lines of smiley into
an existing application to achieve a certain task.
So this will be this will be ridiculous, but it will be also pretty awesome because we we can see over
there how much power we have regarding to our smiley patching.
Right now, you might not even realize this, but with any lesson three there, there you will find
out.
Alrighty.
Okay.
So therefore I would suggest let's have a look into this application.
What is this challenge about and how to deal with this one?
Alrighty, let's go.
Okay, so here we are back at the Ubuntu VM.
And now let's have a look into this challenge to see what we are facing right now.
So I have already created a directory with an EPS of one challenge to recap all and this always you
can find this challenge as an attachment of the section.
So here we have it and it's named as APK.
So my well educated guess would be this is a challenge that has to do something with the advanced encryption
standard.
But who knows, we have to find this out.
We shouldn't guess about this one, so therefore let's install it as a BK and nice.
We get our first error.
Let's see.
Install fail test only.
All right, so we have to provide this test parameter to fix this.
Yes, but this one, we can also install test only packages.
Okay, now let's see.
Let's get back to the screen.
And here we have this this lovely icon of this challenge.
So let's start this one.
All right.
Read me if you can.
And then we've got some some text over here, so we cannot read it.
Or at least I cannot read it right now.
This text has an pretty obvious signature, and this one is the equal sign at the end.
Equal sign at the end points out to be base64 encoded.
So base64 is an encoding which is three byte aligned.
If we are now having a text which is three by the line, everything is working properly.
But let's say we want to encrypt the text UDP.
Let's see you.
You do me two three or let me count once again, two, four or five.
Here we are having now five characters and be append this this dash and to not include this new line
character at the end.
So this means we are having only those five characters.
All right.
If we now type this through Base64, we can see we're getting an equal sign at the end, and this equal
sign is some kind of padding.
So we are having five characters, but we need to be aligned to three bytes, two times three is six,
and therefore within our five characters there's one padding missing.
So therefore we are pending one equals sign.
If you are now going for UDM, then you should have absolutely correct two equal signs because now two
bytes are missing.
We are having four characters and now two bytes are missing.
So two two bytes padding of equal sign gives six, which means it's probably three python lite.
If we go back one character, then we are having yes, we are not having three equal size because we
are having we are having three characters in there and three characters are probably aligned on three
bytes.
All right.
Here we can see we are just getting this text over here.
No, no padding at the end.
So this is something you should be familiar with because you will encounter this quite often.
Base64 is it's pretty awesome because we can we can print out binary values that are non printable.
For example, we can print out characters like a new line character.
We cannot print out new line characters on our screen because we won't see them.
It's just appending a new line.
There are other characters which which are even less obvious, so base64 is pretty nice to get back
and inform it and ASCII format and printable ASCII format for non printable characters.
And this is, this is quite often used in, in every kind of application.
The only downside to this one is our, our payload will become a little bit longer.
So I guess it's about 30%.
So regarding two messages, it doesn't matter if you're dealing with large files, then base64 might
be in problem.
All right, perfect.
So now we know a little bit more about Base64.
Let's see if we can if we can decode this text over here.
So therefore, I'm using Echo Dash and or maybe this this dash and parameter.
Let's let's type UDP and pipe it to base64 here we can see we are not having an embedding anymore because
we are having you d e and y which is five and we are having a new line at the end.
So we are having six characters and they are probably aligned if we apply our dash and then we are not
appending this new line character at the end and therefore we are having just those five characters.
New Line can cause a lot of problems, so therefore you should also have knowledge about this one.
Alrighty.
Okay, perfect.
So now let's let's decode this text and see if we can read this, because if you take this one over
here in this text and if you pipe it to more by 64 dash dx, then we get back our utme.
All right, let's see if this is also the case over here.
Okay.
Let's see.
60 4-d if I made a typo.
It shouldn't be that huge because we should have most of the stuff.
As in plaintext if this one is here.
plainText.
So yes, this is what non printable characters look like on a terminal.
These question marks, I mean, we have no clue what value is behind this because it's binary data.
Therefore we are using an base64 encoding to print them out.
So over here we can see it's binary data and we cannot read this.
If we pipe this through XD dash p and then we get the hex representation of those bytes.
But this helps us or doesn't helps us further.
Right now we could do an entropy analysis on those files and then we would see, okay, these are pretty
random, which means this text over here is probably encrypted.
We do not know this right now, but we've got the skills to find this out.
And therefore I would suggest let's have a look.
Therefore, let's go into EPS and one challenge to recap all and let's have a look with Shadi going
into this application.
Okay.
The first thing I like to do is taking a look at the manifest.
Let's see.
We only have one activity.
There's also our launching activity, which means this is this activity over here.
This is our screen content.
Then let's see.
The rest looks pretty normal.
We are not even using a permissions right now.
So this app is it's not that huge in the Android manifest.
All right.
Here we have our main activity so we can see we've got our familiar on create method.
We still ignore this part over here.
We've gotten set content view, which is the layout of this application.
And to be more specific, this one over here.
Whoops.
And this one.
So this is the layout.
It's defined in layout activity main.
Then we've got the text view.
So this text view might be yes, this text view is this part over here.
This part because we can see down here we have we are setting this text to base 64 encoded string.
But before we dive too deep into this, let's see.
Beside this, we are having an System.out.println encrypt the text.
So this is interesting.
We, we can see in system out approach, which means we're having something in the logcat.
Let's see adb logcat and grep this AI system out here.
We have it.
We have started this application twice and we can see this one over here that's in system out.
Okay, nothing in or nothing special in there right now.
Then let's see.
We've got this text to use, set text.
So this is this part over here and we can see base64 and cultural string.
All right, this is our text and let's see what we are using.
Oh well we are using as crypto encrypt message.
So we are using the return value of function in our base64 and cultural string method.
I guess we have to make this a little bit larger otherwise.
It's not readable.
Okay.
So here we have it now in one screen.
So we are using basic C four and CO two string.
So the return parameter of this one has to be in string because we are using it within a set text function.
Okay.
Then we've got a script crypto encrypt message.
This is an function call.
And here we are having this strange byte array and we're having an and second parameter comma zero.
All right.
This line is massive, but we can split this up into single pieces because the output is just combining
everything into one line.
And therefore, I would suggest, let's do this over here.
So we start from the outer brackets and we go to the inner brackets.
In this way we are not messing it up.
So here we've got set text.
So let's see, this one over here is set text.
Oops.
Okay.
And then we've got base64 and cultural string.
So let's see.
Base64 and cultural string.
These are those brackets in this one.
And over here, the next one.
So these two brackets, which means we can see we are having two parameters in here because we've gotten
comma.
So this one.
And this one is our base64 encode to string method and we are taking two parameters.
The first one is this that's not visible.
This.
And the second one is this one over here.
And this is the second parameter of our ENCODE two string method.
So within this method as crypto encrypt message, let's see, I guess I'm running out of color.
So we are reusing red once again.
We've got this bracket and this bracket.
Yes.
So this is working perfectly fine right now.
We're not having any bracket left, which means encrypt.
Encrypt message is only having one parameter.
So let's clean this up over here.
Okay.
And this is this parameter here.
Okay.
If we are now going from the from the inner classes to the outer classes, we can reconstruct how how
these methods are being called and what's being returned to what.
Okay.
So let's see.
We start with the first one.
The first one is as crypto and crypt message.
Okay.
And this has only one parameter which isn't byte array.
Okay.
The next one is it's the Coliseum and this one is basically four and cultural string.
We can also take green.
So this one is.
It's the second one.
It's base64 and cultural string.
And this one is as first parameter taking our return of the function one.
So.
So this line over here.
And the second parameter is this zero.
Okay.
And this one is returning back in string, which is being used in text, view, set text.
So this is what happens in this line over here.
And I can hear my friend spinning around because also for my CPU, this is absolutely crazy right now.
Okay.
But we we made our way through this.
So we've got as a encrypt message.
This is the one where we are first having a look into this one.
And then we will we will have look into this one and then you should be done.
So then you should have understood what's going on over here.
So therefore, let's have a look into a crypto encrypt message.
Okay.
Before we go into the as crypto encrypt message method, maybe one last thing I didn't mention.
Right now, the base64 encode to string has two parameters in this one over here, which we do not know
right now what this one is and the zero.
And therefore we should look it up that we understand what's going on over here.
And the easiest way is if we simply click on this one, then we can see it's from android dot util base64.
So let's search for this one in.
Yeah, in your search engine of choice.
All right, so here we have it.
Developer Android dot com base64.
Okay, let's see.
He has kept this public class.
And on the right we've got those methods.
We've got to methods and code to spring.
That's good.
Let's let's check them out.
The first one is using an by the right, an offset length and flex.
So we are having four parameters in here, which means this is not the method we are looking for.
So the ENCODE two string method is being overloaded within different amount of parameters and this one
is not what we are looking for.
Therefore it has to be this one.
So let's see.
Perfect.
We only having two parameters input and flex and we can see the first one is byte array.
So now we know the the as crypto encrypt message function is returning back and by the array oc base64
encode the given data and return a newly allocated string with the result.
All right.
The Base64 method is returning back the string.
And this is exactly what we have seen.
The basic C for string, which can be used in the set text function to get it out on our application.
All right.
Okay.
So let's figure out what are those parameters.
The first one is input.
It's an byte byte array in this case and the data to encode that, that sounds easy.
Then we've got flex and flex is an integer value controlled certain features of the encoded output,
passing default, whatever this one is, results in an output that adds to the RFC 2045.
Okay.
So the Irish see it's an it's in standup and that's described how this encoding works and if you pass
into the default value then we can simply look it up over here.
Four can be also used with different character sets, for example, but if we're using the default value,
then we can be sure that this character sets fits with this one over here.
So let's see what's default and we can find this over here.
Constants default.
Default is zero.
Perfect.
This means we are not dealing with some really strange character sets in our base64 encoding.
We are having a basic basic C for encoding, which means we could simply yeah, we can.
We could do this on our terminal over here like this one.
All right.
Okay.
This is something you definitely should up, because in the past, I have encountered some base64 formats
which are using some some really strange character sets.
And this will mess up your whole encoding.
So this is something you should definitely check out if if that's the case for you.
All right.
Now we can get back to the to the a crypto message.
This one over here encrypt message.
Sorry this way.
So we double click on this one and here we can now see we have an as crypto class.
But this doesn't mean that it is as.
So sometimes developers do some strange things and we cannot rely on this one.
We have to.
We have to reverse engineer this code.
Okay.
We've got the method encrypt message.
This method is taking.
And by the way, this is something we have already seen and it's also returning in by the rain.
So the first parameter in our base64 method encode to string this one over here.
This isn't byte array.
All right.
Okay then let's see.
We've got key generator get instance as now we can be sure that it is really a yes because this key
generator comes from the from the generic class Java crypto key generator and it's getting in as instance.
Then it's initializing this key generator and then we're having a secret key channel.
Right.
Key.
This is pretty interesting in as we have certain parameters or values regarding to the to the encryption
algorithms in this application right now, we can see that we're using is in CBC mode.
CBC is I guess, cipher block chaining mode, but we will have a separate video on as.
So this is some kind of bonus video because as it's a very common encryption algorithm and you will
find this a lot in in every type of application also for Android applications.
So there are some neat tricks that can help you out if the developer has implemented it wrong.
And this is something we will take a look into the bonus video.
But back to this one.
So here we are generating and key and this key is being used within our encryption and we can see we
are not having an input on this one.
We are generating it.
And this means this key is most likely being generated randomly, which means every time this method
is being called, we are using a different key for our encryption algorithms of our plaintext.
This is also pretty nice.
We can already see the parameter we are inserting in this function is already the plaintext.
So the challenge is not getting out the plaintext or the ciphertext.
The challenge is getting out those those objects.
For example, this secret key over here.
Okay, first, let's verify a few things.
So this one is generating a new key and this one is being generated in this message.
Call over here.
If we go back into the main activity, the message or this this method encrypt message is called every
time we are calling the on create method, which means every time we are launching this application,
we are using or we are generating a new key for our for our encryption over here.
So this is why it's absolutely necessary to print out this key, this one over here.
All right.
This will be this will task in our one challenge to recap all challenge.
Okay.
And then we've got this one over here as CBC mode.
Then we've got cipher in it.
So we are initializing something with our key, by the way.
And then we've got our ciphertext, and that's the text we're going to return.
And we can now see our cipher instance, which has been initialized with our key, is now performing
the two final method on our plaintext.
So this is now where the encryption is finally taking place and we get back the ciphertext.
So the, the encrypted text which will be returned out of this function as in binary over here.
Okay.
The ciphertext will be returned and this line is also pretty interesting.
We can see we have cipher dot get IV.
IV is the initialization vector and this is also a parameter which is being used in our as crypto function
or maybe not being used.
And this is also something we have to figure out if this value which is being generated over here is
being used in our as encryption right now?
I would assume not because we have already created our ciphertext over here, but maybe this one is
being called in in between over here also.
So yeah, we will have look into this one.
Okay.
And then we've got return ciphertext.
So then we are returning out OC and then we've got this try and catch block.
So the Stripe block is observing this code path.
If there is some error occurring, if there's an error, for example, no such algorithm as exception.
For example, if you're using an accurate MOS that's not known, let's call this UDP.
I guess that's not known in the Java crypto class.
Then this exception would be thrown and this exception is printing out the stack price and this method
will return null.
So we will go out of this method with the return value null, which will crash later on the whole application.
But in this case, it's designed because there shouldn't be an error within the encryption part right
now.
All right.
Okay.
So this is all for this part right now.
And let's go back to the main activity.
And last but not least, we've got the spider ray and we have already seen this is some kind of plaintext.
And we can also observe this because the number 51 let's see, the number 51 is occurring more often
than others.
I mean, it's occurring pretty often and therefore it's most likely not being encrypted, this text
over here.
So we could simply use some python shell and we could restore those characters or not restore.
We can we can simply print them out by converting those decimal values into into characters.
So the character of 83 is as OC, let's see what's 51 three.
That's interesting.
Then we've got 99 C and so on.
We, we've got the feeling what this word might be about, but we could also simply, we could also
get back those characters and this is simply just an ASCII table.
So if you type in main ASCII, then we get this, this pretty nice table.
And here we have all these representations, for example, the decimal value 83 let's see.
83.
Here we have the OCTA representation, data value representation hex and also the character representation.
83.
There we go.
It's it's character se.
So that's the whole secret behind this one.
What's interesting is sorry.
What's interesting is the is the number 51 because the number 51 is in three.
And this is the it's the most basic text and it loses you could do regarding to cryptography on on things
like this one.
Let's assume we've gotten text and the text has been scrambled.
For example, the letter A has been substituted or changed with the letter C.
The letter B has been substituted with another value, for example, X and so on.
Within an English text.
Some letters occur more often than others, for example, E and I.
So by figuring out what E and I is, we might get some conclusion, what the what the scrambling is
about.
For example, a fixed value of 13, what 13?
For example, rotation, which means we are rotating this character by 13 characters.
So this is some kind of basic analysis we could perform on this one.
But in this case, right now, it's not even necessary because it seems to be.
Yeah, it seems to be clear text the letter E has been substituted with the with the number three,
but that's all.
So C could, might be something like secret and here we can see C so e Cree here we have it once again.
Yes.
So this might be secret as well.
All right.
Okay.
So what is this challenge about right now?
We have seen we can get the plain text pretty easily.
That's not the point.
We have also seen that we can get the ciphertext because this one is being printed out on our screen
over here.
If we start this application or restart it, then we can see, Oh, that's interesting.
The input does change because every time we are we are calling the on create method.
Those key material is going to be newly created, it's being changed and our text will be differently
encrypted.
And this is exactly what our challenge is about.
We need to find a way to get out those those information, the secret key and the initialization vector.
So the things we need to do is we need to get out within the crypto method.
The key, which is this one over here and also the initialization vector which might be returned by
this method over here.
This is our task and this will be done within the next three lessons.
So lesson one will be about dealing with new smart syntax.
For example, just try and catch.
BLOCK We have never encountered this before, and we will we will be able to understand what's going
on over here in this smiley part.
I mean, here in the Java world, it might be easy, but smiley looks a little bit strange, let's say.
All right.
Lesson two will be about printing out complex objects.
For example, the key out of the secret key object or the initialization vector of this method.
However, it's being returned over here.
So we will learn how to deal with more complex objects.
And less than three will be about inserting a huge block of smiley lines into an existing applications.
Because there we have to consider a lot of things and we have to adjust even more.
So this is an that's a perfect ending for our series over here.
We do not get really an advantage out of this because everything we are doing in lesson three or maybe
most of the things we are achieving in level three, has been already done in level two and leverage.
We are figuring out on how to print out complex objects, those return values and things like this.
Level three is more about if you if you are trying to apply a huge patch into an existing application.
I mean, we are not limited to certain classes or methods.
We we can patch whatever we like and we can also interact with whatever we like.
And this is something we are doing in session three, in session three besides this patching of those
written values in an in a hard way, we will also figure out on how to interact with you I components
and this is freaking awesome that we will learn how we can interact with existing activities so we can
print out new messages, we can interact with the design.
We can also we could change background colors and things like this.
Tasks regarding to the eye are not really easy in Android, even in Java and it's Mali, it's it's even
worse.
But this is something we will learn in session three.
So my suggestion would be if you're feeling absolutely comfortable regarding to Smiley right now, maybe
have just a quick look into lesson three.
If this is interesting or new for you and in case if you say, okay, that's easy peasy, I know this
stuff, then you can easily move on with the next one with our space ping application because they'll
be having even more fancy and nice patches to do right now.
Alrighty.
Okay.
In case if you'd like to recap certain things, this video series is for you right now.
Okay.
So therefore, I'm looking forward to see you in the next video.