May come back after this very short, very short introduction video.
Let's look into this as crypto function.
Let's see how we can deal with unknown smiling syntax.
For example, just try and catch block.
Let's see how it looks like and let's see if we are really able to understand it.
Therefore, let's go.
Let's decompile this app and then get it back on the graphic tablet.
So at first we decompile this application.
Got it open over here.
APK tool.
DD Yes.
APK.
All right.
And then let's open these smiling glasses, too, with Visual Studio code.
Me trust this out, though, and then come app hacking as crypto.
All right.
And here we enable Java.
Perfect.
Okay, so here we go.
We've got our class as crypto.
We are not extending and special class, so we are just having traveling object as superclass.
Okay.
And this is our source file as crypto.
Here we have our constructor.
All right.
And here we have now our method encrypt message.
Let's see if we encounter something unusual just by looking at this.
So we are not reversing it right now.
Let's see, we scroll down.
Okay.
We I guess we have found it.
And this one seems to be new, right?
So if God move, resolve to object before this is pretty known to us.
But then we've got this tri end, and then we've got this part over here.
All right, this looks absolutely ridiculous.
And then we also got some catch clause over here.
We can see exceptions.
And these one over here look new, but they are in a recognizable format.
So this one over here is just in invoke virtual method.
It's just invoking and in public method print stack, Chris.
All right.
And then we've got a bunch of other stuff.
This sounds different than the things we have seen so far, especially this one over here.
And therefore, I would suggest let's take this on the graphic tablet and let's see if we can understand
what's going on over here.
All righty.
Okay, perfect.
I will see you in just a moment.
Okay.
So here we are back at the graphic tablet, and we have already seen that this file is massive.
If you scroll down a little bit, we can see we've got 147 line numbers in there.
So at a point, we have to reverse engineer this, but not the whole file.
We have to figure out, for example, how to print out the secret key, the initialization vector and
things like this.
In this part, which is the second part, we only focus on reverse engineering those necessary parts.
But if you are absolutely insane and you want me to go through this whole file line by line, then simply
just drop me a message for me.
It's perfectly fine.
But I guess you don't want to watch right now.
40 minutes me reverse engineering this.
Let's focus on the new stuff and this is the tri catch stuff.
This one in the middle over here.
So this is something we haven't encountered so far, but we understand the core concepts of smiley and
these are enough to understand everything right now.
Even this part over here.
You don't believe it?
Then let me prove this to be a correct statement.
So therefore, let's have look into this one.
Okay.
So we want to analyze this part right now.
Let's see.
And this one over here, we know what this one is.
It's simply just a label.
We've got the label.
Try underscore and underscore zero.
So let's write this down.
Try underscore and underscore zero.
This one is a label.
Label means or we have seen some labels before regarding to jump instruction in our if statement we've
gotten condition zero.
For example, if the if statement has been true, we jump to this condition, otherwise we move on.
But we have also seen labels regarding to go to instruction and, for example, go to condition one.
All right.
Nothing new so far.
Okay.
So just try and might be simply just label.
Let's see how often it occurs.
So let's search for this one over here and we can see two out of six and let's throw it down.
So this one appears over here and also here.
So within this, the strange looking syntax over here.
Let's see.
Yes.
So these are the only occurrence of trial, Ed.
All right, that's good.
This is compact and this is it's clean.
So therefore, let's go deeper into this one.
And this one is our label.
Let's see.
Then at the beginning, we've got this thought catch.
We don't know what our catch is or what catch does, but we know what this one over here is.
There's capital, and then we've got the class reference.
And this class reference is no such algorithms exception.
Here we've got no such petting exception and here we've got invalid key exception.
So these are all our exceptions from the Java side.
If you remember this, maybe let's clean this up because it's barely not readable.
And there we go.
So these are simply just our exceptions that we can throw.
All right.
Okay.
We do not know more about this.
These are just class references.
We've got no clue.
This is now a returned type.
Is this a parameter?
Is this something else?
We don't know this.
Okay, then let's ignore this part over here.
So this one will be ignored.
In this one also.
Let's see.
And then we've got this tri start.
Try start underscore zero and we can see once again this is just in label.
Try, underscore, start, underscore zero.
Then we've got the strange looking dot dot.
No clue what this one is.
But after what?
We've got another label or this already familiar label.
Try and this one over here.
So here we have our try.
And underscore zero labor barely not readable, but they are stands tri and zero oc oc.
So I mean, we do not need a 200 IQ to solve this.
We've gotten start and we've got an end.
So this is some kind of some range given over here and let's call this dot simply range.
I'm not sure what's the term for this one and if this is even correct, but we got the beginning and
we've got some stuff and we got an eight OC.
So let's see where Tri start occurs in our code because this is a label we haven't looked up so far.
We already know TRI ends over here.
So let's search for tri start over here, here, here and here and oh that's interesting.
We've got encrypt message, then we've got our plaintext, we've got B zero and here we've got the tri
start label.
So this one over here, this is our tri start label.
So could it be that simple that we've got this tri start label, then we've got our top stops maybe.
Let's make this.
Oh, let's make this screen.
There we go.
Dot, dot.
And then we've got our tri end.
And of course, zero.
So could it be simple as this, that we've got our start over here?
This one.
This is our start.
Then we've got a lot of thoughts.
Until we came to this one over here.
You try and let's say down there, there are some birdies.
Try underscore and underscore zero labor.
So is this simply just to try and catch block?
Let's find this out.
So let's clean this up.
Okay.
925 We've got our tri start and over here we've got our tri.
And so this one is the start.
Here we have our end and everything in between there is within our tri bloc.
Tri.
And then the end.
This would mean after the stripe log we have to sketch block and this catch block has now certain conditions
and we can see those conditions already occurring here.
So therefore let's get back to the Java code and verify if our trip log starts or includes.
Let's see.
Yeah, this key generation.
So this one at least it's hard to tell if this one is already included because it's smiley.
And smiley has disassembled into certain parts.
This one over here, I mean, it's just in label.
It's not sorry, in this one over here.
I mean, it's just in reference to an variable name.
They cannot go something wrong regarding to this one.
Our error could occur in here.
This is where we could have an error.
So therefore, my suggestion would be that our try and catch block the first instruction is our key
generator get instant.
Okay.
So therefore let's find out if our trip blog directly starts with one key generator and this one over
here.
All right.
Okay.
And therefore, we open a new terminal.
We go into EPS.
One challenge to recap all and we are opening as APK with Shadi.
Excuse me.
Then we go into comm app hacking as and then as crypto.
And this is absolutely correct.
Our our first instruction in here is the key generator.
So this is exactly what our trip log looks like.
So we've got our try and we've got it over here.
We can also see that our last instruction in our trip log is to get initialization vector method, this
one over here.
Then we are moving the result into V four and then we have to try and block.
So if you go into this one back again, we can see.
Yes, we can see get initialization vector is pretty close to be the last instruction I mean after what
we simply just have in return out of this one.
But regarding to the try and catch block the return type, this one over here is not being included
in this block over here.
So in the Java world, once again we can see return is also included in the try and catch block.
But technically correct it isn't because we can see over here the result would be moved into the register
before.
But if we return out of this function, let's see where we return out in this one.
Do we have another return?
So let's search for return.
Yes.
Here we can see we have this return object.
Me three So this is from our get initialization vector move result into object.
Before then we've got our try entry block and here we can see we are returning out.
Sorry for the interruption over here, but there's a slight mistake regarding to the return value over
here.
And I definitely want to clarify this.
I mean, the code, everything we have discussed so far is absolutely correct, but I have mixed it
up in the last 2 minutes.
So let's get through this over here.
We can see on the line number 65, we've got this method invoke virtual Java X and crypto cipher get
initialization vector.
This method is returning back byte array and the spider array will be stored in the register.
V four So we move the result object into before and then we've got our try and block, we've got all
these catch instruction and then on line 78 we've got this local before which will be assigned this
label, this initialization vector label, but then we've got return object B three, this is the line
number 79.
And if you take a look at what we three is, we can find this in line 59.
So then we have invoke virtual Java X crypto cipher to find it.
We have the parameter and byte array and we also have a return type or return value as in byte array.
We move the result of this function cipher to final into V three and then we are returning back B three.
I guess I have said we are returning back before, which is not correct.
We are returning back b three, which is the byte array from the method to find it.
The rest is absolutely perfect.
Fine.
And now we can move on with this one over here.
So let's go.
So technically, it's not 100% correct.
This is not included in our catch block.
But we can only see this if we enter the matrix.
So if we, if we have look into Smiley over here, it looks like the return type is the return instruction
is also included, but that's not true.
Nevertheless, we don't want to be that piggy.
We are super excited that we can understand, try and catch blocks already.
The last thing we haven't talked about so far is this one over here, this catch block.
So here we can see we've got catch, then we've got Java Security.
No exception and no such algorithms exception.
Very hard to pronounce.
Okay.
And then we've got one, two, three, four, five exceptions.
Let's have look into the Java code.
Okay, catch.
We've got one, two, three, four, five.
These are all these exceptions over here.
All right.
So this perfectly matches with this one over here, back into this one.
So what else do we have here?
Because we are not we are not done right now.
And let's get back to the graphic template.
Okay.
So now we know we've got something like try, we've got a bunch of stuff and then we've got this catch
catch, which includes those exceptions.
And this one also have some code in there.
So we've got a lot of catch instructions over here.
Okay.
So this means this one over here seems to be this part.
Okay.
So we can understand in this part and this one over here, I mean, no such group most exception.
This is it's our parameter.
So let's call this to be in parameter.
This might not be technically correct.
So even if it's not fully technically correct, I mean, it is what it is.
We are providing an exception to this to this catch clause over here.
So we are listening for this exception.
And this one is it's the exception that gets triggered.
And this is the parameter in our catch clause.
All right.
Okay.
And then finally, there's only one thing left.
So after this one and this one, maybe let's let's do it this way.
And then we've got this label at the end which might be overlooked.
So therefore let's make it yellow.
So here we have now another label and this one, for example, this one is catch for catch underscore
four.
So let's see where this label occurs in our program code over here.
Let's copy this, insert it over here and here we have it and we have it only twice in here.
Yes.
So at this point, for example, no such algorithm shows exception.
This one over here, that's label and this one over here appears here.
So we know that if we go back, can we have both?
Then let's maybe take another one, which might be closer.
This was a mistake by me.
Let's see.
Do we have catch one?
Yes, this is.
It's a little bit better because it's closer to this one.
And now we've got the full picture.
So we've got here and oops, our label.
Now we've got catch one.
We can think of this like an if statement.
It is technically definitely not correct.
But let me explain it to you what I mean over here.
So let's say we've got something like if we are having, for example, block size exception in this
one over here, be as exception.
Chum to label catch one and catch one is over here.
So here we can see this one.
This line is the end of this variable.
So do not get confused by this one.
So we are jumping into this one, catch one, then we've got move exception into V one.
Okay, so now we are moving this exception maybe into V one.
So we want a snow B as.
Except.
Okay.
And then we've got the one is being assigned to this variable E.
So we've got this this exception.
Maybe.
Let's write that out.
Yes.
I've taken, I guess, the longest name.
So there we go.
Illegal.
So this is now being assigned to we want we want this now, this variable name E and T we can see we
are invoking a virtual method.
This one prints take trace.
So it'll be invoking the virtual method.
Prints that trace on v1, which is E, which means we are calling e dot oops.
Sorry, wrong color.
This method has no parameters and it's returning back.
What?
And this is all we are doing right now.
So, I mean, this if is definitely not technically correct, but you can think of this term nevertheless,
I would like to remove it over here.
So when we have an exception, let's call it not if let's call it a van block, which is it's now being
introduced by me right now into the Somali world.
So we are now having a new block.
It's the when block when we have an illegal block size exception between try start and try and then
go to catch one, which is this one over here.
This is my complete free interpretation of and try and catch block.
I didn't look it up and therefore these terms might not be 100% technically correct, but it doesn't
really matter because we are we are able to understand everything in here and we could easily modify
every single part in here and also at this part into new applications.
And this is all we need.
We understand it well enough to modify it in any way we like to have it.
All right.
Okay, perfect.
So let's get back into the application once again.
So here we can see illegal block size.
It's E four.
So these numbers, I'm not sure they don't have to match.
Yes, this is catch one.
And within our exception, it's its exception for these numbers.
All these cases doesn't align to them over here.
So F4 might not be or has to be the fourth instruction or catch instruction in our block.
But we can see we've got this illegal block size exception.
We can see this parameter E four is printing a stack price.
And then we didn't look further, but we are returning out of this function.
So this is how try and catch blocks works.
We haven't seen them before and we haven't learned or looked up anything else.
Based on our smiley knowledge.
We were able to understand this complete new block over here in this one, which is absolutely amazing,
in my opinion.
So maybe to finish this over here, let's let's do this return type.
Also, let's get back into our exception, which was catch one over here.
So here we have seen print stack trials.
Okay, this is something we have understood.
It's returning and void and here we can see a label go to go to zero.
So let's see where this label appears.
And this label appears.
Perhaps.
Maybe.
Let's clear this over here.
Here.
Here and here.
So it appears in every catch block and we end up over here in this line.
This one is the end of the local variable.
So this one is being ignored.
We start at this point, Knop means no operation.
This is absolutely amazing.
I haven't encountered this quite a while, so this is simply just do nothing process.
Not sure why it's included over there, but after this knob we can see this one over here.
This is also just a label which can be ignored because we we have no jump instruction to this one anymore.
And then we write we one equals zero.
So we are writing zero into V one and then we are returning out.
Which means are returning not.
All right.
And it doesn't matter in which exception we end this will this will be the end over here.
So we are having here an exception here, an exception here, an exception.
But all come down to this labor.
Go to zero.
Let's do this maybe for another one.
Let's see here we have catch three.
In this one we move exception into V one.
Alright then we've got V one, e print stock price and so forth and returning watch.
All right, then we've got the end of our local variable.
And then we've got this go to label, which means we end up over here.
So also catch.
What was it?
Catch three.
So this happens for all exceptions over here.
We end up over here and this one is simply just return null.
So, yeah, this also fits perfectly into our code right now.
This one over here.
Let's clear the screen.
There we go.
Yes.
And so we are having returned null all the time over here.
But smile is a little bit more efficient on this one right now.
Okay.
So this is all for this video right now.
This wasn't just picked up because we can understand this.
This wasn't completely random case.
For example, switch cases.
We haven't talked about switch cases, but the approach is the same and everything else is just consisting
of smiley instructions.
So.
So everything else is just smiley line after line.
The only difference is we have two constructions like this one over here.
We have some jumps, but the rest is simply just.
We go through this line by line and with this knowledge we can understand 95% of smiley.
There might be really some edge cases which we cannot understand right now, but if you encounter them
and you're not sure, then simply, please just write me a message.
I'm glad to help you out on this.
Or maybe just by looking them up online, you might be able to solve this on your own because with this
knowledge you have been wrapped up right now.
I'm pretty sure you can do this.
Alrighty.
Okay, perfect.
So this is part one which has become another long video, but I guess it's pretty amazing how far we
already have achieved.
In the next one we will look at printing out some yeah.
Some hard objects.
For example, we want to get the the initialization vector value out of this one or for example, we
want to have the secret key to be printed out as in string because the return type over here is the
secret key.
So how can we print out the secret key?
If yeah, if it's a completely different object, this is something we will figure out in the next video.
And afterwards we will look at another amazing example, which is inserting complex smiley code into
an into an existing application over here.
Therefore, I'm really looking forward to see you at part two.