Very come back to our one challenge to recap all section.
So in this video right now, we will have a look into printing out more complex objects.
And we will also have to look into inserting more complex smiley code into an existing application.
So I will show you an approach how we can easily do this.
And therefore I would suggest let's simply dive into this one.
So let's open a terminal and we're still working on apps.
And one challenge to recap on so this is our as crypto challenge.
We are opening it with Shady Square and have once again a quick look into this one.
So let's see within column app hacking as here we have this as crypto class.
In the last video we have seen how we can deal with unknown smiley syntax.
And this was pretty amazing because we have never ever reversed engineered try and catch blocks within
Smiley, but we could immediately understand what's going on over here.
We could figure out how they work and therefore we are able to manipulate, delete or interact with
them.
And this is all it matters.
We understand the functionality of them and we can play around with them.
In this video we will have look into printing out more complex objects.
For example, despite array over here by the right doesn't sound that complex, but we will have a look.
Then we are having an as crypto function, so we have some key initialization vector how to deal with
these objects.
We want to get them on our terminal.
We want to have them print it out that we can work, that we can encrypt and decrypt our text.
How can we do this?
Our key is simply just an object from secret key.
So can we write System.out.println?
Secret key?
I guess not.
And this is not possible.
So therefore we will learn how to do this.
And last but not least, we will also have to look into inserting more complex smiley code into an existing
application.
Let's say you want to insert the smiley code that works with certain objects, certain encoding methods,
and print out some stuff and perform some other actions.
How can we achieve this without writing everything in line in Smiley there?
So therefore, I would suggest let's start with this one and we start with the secret key.
How can we print out the secret key?
And this secret key is from the type Java X crypto secret key.
So this is in generic class, which means we have a really good documentation on this one and those
classes often have Seta and get our methods to work with them because this is encryption method has
to work with the secret key at a certain point it needs to get all these single bytes out of this key
and therefore a good starting point would be having a look into the official documentation.
Maybe we find some additional methods which are not used over here to get out this key in a certain
format.
If we cannot find anything for this one, maybe we want to have a look into the key generator because
this is generating a key.
Maybe we can we can do something with this one over here.
All right.
And therefore, let's go.
We simply take this Java crypto secret key and append Android because otherwise we might get some Java
references and this could differ from our Android developer documentation.
So let's see here we have the secret key Android developers.
Okay.
This is a public interface.
Alright.
And let's see here we have those methods and these are inherited.
Let's click on this one.
Okay.
Those methods come from Java Security Key.
Let's see, we've got a method get algorithm returns.
The standard algorithm name for this key doesn't sound that interesting for us.
Get encoded returns the key.
Oh, this sounds good.
Returns the key in its primary encoding format or null if this key does not support encoding.
So not sure what this one means, but it returns the key.
And this is all it matters.
The return type is here.
It's byte array.
Perfect.
We already have to deal with by the right because we want to print out this plaintext.
This means we have now a method that gets out this this key in a byte array and this method is named
get encoded.
So what we could do right now is the following.
We could add between those two lines.
Now our key does not get encoded method.
So we we perfectly know how to do this in Somali.
We know it's something in bulk.
I guess it's not virtual if you're dealing with inherited methods.
So we would have to look this up, but then we simply cut our class reference, which is this one over
here.
We provide our error.
We call the method get encoded.
Let's see.
Do we have parameters in there?
I guess not.
Not no parameters.
Perfect.
So we could easily do this.
But now I would like to show you an approach which is a little bit easier and also which handles more
complex syntax a little bit better.
And this approach is definitely not rocket science.
So what we are going to do right now is the following.
Let me draw this on the graphic tablet real quick.
Okay.
So what we do is the following.
We take this code out of this application.
For example, in this line we want to call the line key dot get encoded key.
That's a small key, get encoded, no parameters.
And we are taking this line into our own application.
So we will create an own app with this line of code because then we can also adjust the the other Java
code to make this working and we could modify this code in any way.
For example, we could print out if this even works, we could use system, dot out, print line and
then we use this part over here.
And if this works, then we can we can compile this into an application so we can build this APK file.
So here we have this APK.
This is our APK.
And then we could simply take our APK tool.
To get out these modifieds out of this one.
By having those smiley files.
We already have our code in a proper way, how it works in Smiley.
And then we can take this code out of the smiley file, only the necessary part, and we can pull it
in in between those two lines directly here.
And by doing this, we can play around in the Java world over here.
If everything works, we can experiment around with this one.
We can insert more additional code.
And then we we slice out this this little piece and pull it in here.
Absolutely no rocket science.
And you might ask if it's that easy and we can simply copy paste this code into this application.
Why haven't we done this earlier?
The reason for this is we have to consider a few things, and these things can be only considered if
we fully understand the smiley part.
Let me show you what I mean.
So here we have our application.
This is the original application.
This is this part right now.
Okay.
Now we are inserting our smiley part, let's say in between here we're inserting a little piece of smiley.
This is between those two lines, for example.
Now we have to be a little bit more careful because let's say we are overwriting certain registers,
let's say we are using V two and B three in this part.
But these registers might have been already set up over here.
So here we have the original code and this is now, and we have to consider this as an single part.
So in this part we have no and register v one and v two.
Let's say v two is an very important object.
For example, this let's see.
Let's say it's this key chain object.
This key generator might be used in this part over here.
Somewhere in between here.
And now, if we do not understand Smiley, we will overwrite this this key generator object here with
something like, for example, system out.
System thought out.
And then at this point, when it references to the key generator object over here, for example, we
are not having a generator object anymore.
This is now in system out object and it will crash.
It doesn't have to crash.
So it could also work quite a while until something happens.
So therefore what we need to do is we need to insert our code in between those two blocks.
So this is the first block.
This is the third block.
And in between, this is our block.
The block number two, we need to insert it and we need to make a transition.
So in case if you want to override registers, for example, this V two, we have to restore this V
to register afterwards.
So here we have to assign it back again to the key generator.
What?
But we, of course, can also do this.
We could increase those registers.
So let's say we increase the number of registers to a number.
For example, let's see, eight.
So let's say before we have five registers, but now we are using dot locals eight.
So not locals five.
And we are increasing this to eight.
This means we have now additional registers available.
For example, we have now oh, that's pretty hard.
Let's do this from the beginning.
We zero we want me to be three before.
So these are our five registers, our original one.
Now we get additional three which is we five, maybe six, maybe seven because we start from zero the
counting.
This means we do not have to override a certain register like this one.
We could simply use a new one we have created, for example, v five.
All right, perfect.
So therefore we will now write this application and we will figure out if everything works.
So back to this one over here.
If we get finally our key and this one here in the readable format and for example, a single bytes
as byte array or as some kind of other format, then we can take the whole smiley code we have created
over here and we can apply this patch over here.
So this is the approach we write our application, we test everything in the Java world and if it works
there, we compile this app and then we make the transition into the original application.
So we are doing this part afterwards.
Okay, let's do this.
Okay.
I'm not sure if you have already written an application in this course over here, but it's not that
hard because this application will be completely set up and all we have to do is we have to insert some
line of smiley.
We can already understand the whole concept of this one, what an activity is, what you on create method
does all the stuff and therefore you do not have to be afraid about this app development.
It's not like that.
We are writing a complex, multi functional, highly layout application.
We are just inserting some line of code.
So therefore let's go.
We go into Android Studio Bin and we start the studio dot as script.
If you do not see anything, then simply just click on here because the view has not been loaded right
now.
So if you do not have this view, if Android is already starting with my project, all you have to do
is go onto file and then close project and then you are also here back again.
Then we can click Create New Project.
And then we choose empty activity because we do want to have it as simple as possible.
So we do not want to have fancy button navigation or floating buttons and things like this, just an
empty activity.
Then we give it a name and this is our our smiley supporter.
So then in package name will be automatically being granted.
This is now com a pecking smiley supporter.
This is the location you can choose in directory where you want to have it, but I like to keep it in
the home Android Studio Projects folder.
Here we have language and I like to say to Java.
Now this one is important in case if you run it on your real smartphone and you read smartphone is version
seven, then you need to go back to version seven.
So this is the minimum requirement SDK.
So we can go back with this application to version seven.
If we select it over here.
I will do this right now because it's simply just an app.
And yeah, it doesn't have to have this many features.
So therefore the backwards compatibility shouldn't be that hard right now.
Okay, we click finish.
And that's it.
Now, the great debate will be started, and this might take a while, but this great bill will set
up our app completely.
So all we have to do is simply run it afterwards and it will work.
And therefore, I will see you in a moment until this process has been finished.
You can observe this at the bottom over here.
Okay.
The creative bit has been finished.
And now what we want to do is we do not want to copy paste this whole code.
Why?
Because this is an interpretation of the original code.
And we cannot simply take the whole code and overwrite the original modify.
This might sometimes work, but most of the time example regarding to real world applications, this
definitely doesn't because we cannot compile most of this code here.
We only have generic classes, which is pretty nice.
This might work, but on a real world application you would have so many dependencies that are unable
to be resolved that you cannot you cannot fix this code right now.
Otherwise you could simply re-implement this whole application.
And yeah, this is unfortunately not possible.
Okay.
Beside this, even if this would work right now, I am not a big fan of patching something where I'm
not fully in control of.
So if we only take some single lines out of this, then we can understand them and we can insert them
in the original application where we want them to have.
In case if you simply just copy pasting everything blindly, then we might encounter some errors.
So therefore let's do it this way.
You want to have this one?
We want to have some secret key object.
Let's take this line and simply insert it over here.
Now we need to import it and it already says, Oh, this might be java x crypto secret key.
If you hit option enter or alt enter then this will be automatically be imported.
You can see this over here and we are good to go.
Now we've got this key again and we have an initialize this key and yet this might be also the error.
Yes, we have to create a local variable, but we could also use this from the original code.
So back to the original code here we have this key chain and it's also using this method before.
So let's simply copy both of them.
All right.
Once again, we have to import these files, and we have now an error.
Let's see.
This this method can cause an exception, and therefore we have to surround it with try and catch.
We simply have to click it here and then it's done.
So now we have transferred this code into our own application and we could verify if this works by simply
saving it and then building this application.
So we click on Build, Build APK.
OC and TV have it now so boot epic successful here we have now this application we are not going to
install it right now or yes let's do this.
So let's connect to our smartphone.
Do we have already in connection?
Yes.
Which means we can simply use it in our Android studio.
So here we can see it's now switching because we have killed the ADB server.
Android studio is using the ADB server also.
So therefore we stay here.
Let's simply install it here.
And yet please wait with the screen copy until this installation process has been finished.
So now we can get this screen.
And here we have now our application.
Smiley supporter.
Hello World.
Looks perfect.
Okay, next, we want to call the method get encoded because this is the method that returns our secret
key in form of byte array.
So key get encoded here we have it.
And we have also seen this method is returning back by the array.
If we build this application in this way, then one instruction will be missing.
So if you're doing it in this way, the object will not be moved into register.
So this result object despite array finally in our smiley path right now.
And we can force this this instruction by simply assigning it to an variable.
So therefore let's simply create an own array and byte array.
Let's call this my array.
Oops.
And let's assign it over here by having it.
In this way, we can be 100% sure that we are having this get and coded method and after what we have
the instruction move resolved into register v zero, for example.
All right, so now let's see if this approach even would work.
So can we print out an byte array in this way?
My array.
Okay.
So far, so good.
We do not get errors.
Let's see.
We have saved this file and we simply click run.
So you can see this prototyping.
It's pretty easy and it just takes a few seconds.
So here we have it.
And yeah, we do not have to observe this application anymore.
We simply have to take a look into the ADB logcat output and you can find this over here.
So here's the logcat output and now we can search for system dot out and this looks a little bit strange,
right?
So we've got this spider array, we know this part from Smiley and then we've got an address.
So this is only the reference to the spider array.
So the system out approach doesn't work on a wide array.
What we could do, of course, is the following.
We could iterate over the spider array within for loop, but there's isn't better option.
The better option is already included in the in the original application because the original application
is printing out the encrypted text, which is also consisting of bytes in the visual format.
Do you still remember how.
No, no problem.
Let's have a look.
So let's open a new terminal.
Let's get this screen here.
We have this application.
And tbf our ace application.
And now.
Yes, you might remember.
Read me if you can then we've got this, this encoding and the equal sign at the end base 64.
Base 64 is a really nice encoding to get those bytes into visual ASCII output.
So why not simply take this by the array and yeah, encode it with the base 64 encode method.
Let's have a look into the original application, how they have resolved this issue.
So let's do this.
Okay.
Main activity.
And here we have it.
So this is from Android Utility 64.
We've got ENCODE two string.
We have already figured out this takes two parameters.
The first one is byte array pretty good.
And the second one are just those flags, which is.
Yeah, it's being initialized with zero over here.
Okay, let's take this method.
So let's take this over here.
We can delete this right now and let's do it in this way.
By 64 encode two string.
If we hit alt enter, then this one will be will be inserted over here and we can use it.
So now we are using my array, all right?
And we are missing one parameter.
So we are also choosing the value zero.
Okay.
We could now save this into another text.
Or we could do it in this way.
I guess this is now the better approach.
So let's see if this works.
We click on Run.
And there we have it.
Nice.
So this one over here this hour, page 64, encoded text.
This is our secret key and the base 64 format.
So we can simply use base 64 to encode the string and then we can use our system out approach to print
it out.
Pretty ridiculous.
Nice, right?
Absolutely.
And therefore, I would suggest let's try decoding it first
by 64.
DX All right.
X 60 dash p there we have it.
So this is the way how to get out.
So get out those bytes of the secret key and now we have to verify this.
We are not doing this right now.
You could do this on your own if these keys or these bytes are really working right now.
If you're not sure how to do this, I have provided you in a bonus video where you learn all the stuff
because this would make this video unnecessarily long and I've got a feeling that it will already become
long.
Okay, so now we know how to print it out.
The only thing I like to change maybe over here is this can get messy in these smiley parts.
So I guess a better approach would be simply split this up.
Let's create also in string variable write string and use it over here.
We have to swap them.
Now.
We're good to go.
So this means those two can be ignored.
These are not relevant in the this part right now.
These are just necessary to create complete smiley syntax.
Okay.
This one is the old original code.
Old original code.
This one is still the old original code.
And this is our code.
Our code we want to insert.
And then we need to print it out over here.
Yes.
So this is our application right now we want to have so we we want to have these smiley lines regarding
to these Java code lines.
And then we are taking them and simply inserting it over here, not here, but here between secret key
and the ciphertext.
Okay.
Let's do this.
So we go on to build, build, bundle, build apk.
Here we have not the epic.
We click locate.
There we have it.
We'll rename this to what was the name Smiley Supporter.
Then we are using a K tool DX on the Smiley Supporter and then we're using the third studio code on
this whole directory.
Okay.
I trust the other thought because I'm the author and I'm absolutely trustworthy.
So let's see.
Smartglasses to come.
App hacking.
Main activity.
This is where we have inserted our code.
Now we need to separate this.
So we need to make sure or we need to figure out what's the old code?
This one over here.
And what's our code?
We need to insert the old code.
Is this one secret key?
Generate key.
This is the last line.
We can find this in the original application over here.
We want to insert our code afterwards.
So we are reusing this line and then we want to have the instruction after this one.
So we are searching for generate key.
That's such and heavy effort.
Yes.
This is the, the result will be moved into v1 and then our code starts.
So this is the beginning of our code.
Beginning of our code.
Okay, let's maybe check this out.
Is this line number 35 matching with the with the Android studio?
And it does.
Okay.
This is.
This is pretty awesome.
I wasn't sure if Chadwick's sorry.
The K tool is matching this one over here, but this is.
It's perfect.
We can identify our line number directly.
Yes.
Do not rely only on line numbers.
Also verify this code.
So we've got my array.
Get encoded.
Let's see.
Yes.
We've got key.
This is our secret key.
This is we want and we've got invoke interface.
Oh, it's not invoke virtual.
It's invoke interface.
We've got invoke interface on our method get encoded.
So this one here is secret key dot get encoded and returns spec and the array which will be stored into
v two if we do not assign this variable in this way.
So let's say we are just calling it then sorry and then this line will be missing.
So therefore it's good to assign this stuff.
I mean, we could easily add this by ourself, but yeah, it's good to have complete smiley code in
here.
All right, so this means all we have to do is.
Let's see.
We have to take these three lines and we need to insert it into the original application.
Maybe we can.
Let's see.
Maybe we can make this a little bit more clean.
I mean, we do not need labels in our new original application, so therefore we can get rid of these
labels, I guess.
So let's see.
Okay.
And then also this one over here.
Yes.
These are all the lines.
This is the beginning of our code.
And this one over here.
This is the.
The end of our code.
Okay.
Now, let's open them side by side.
We put this on the right.
I guess if you click the Explorer or if we if we click on this one, yes, this will be closed.
And now we have to take a look into the A's smiley file into the original as application.
This one over here.
See the apps.
One challenge to recap all.
Let's open the whole A directory.
And let's put this on the left one.
Okay.
We are both in the as crypto Somali.
That's correct.
So we have to open from the last time.
Okay.
And now we have to find maybe, maybe let's focus first on the original application.
And so we have to find this generate key line in this application.
And I guess I can already spot it.
Line 21.
Let's see, let's put now the original code next to it, line 21 So this is now the code and here we
have to check the output.
It's line 21.
Yes, this is correct.
This is our generate key.
And after what we have to we have to insert our own code and of our own code.
Okay.
So far, so good.
Perfect.
Then we can minimize this one and then we can go into the right side.
So here we have this.
I guess it's a little bit better if we do some more hash tags, then it's it's easier to recognize.
Okay.
So now we copy paste this in between those two.
Okay.
And now we need to make sure that the transition is working properly, because we have used maybe different
registers here than here.
So the transition from the original code into our code, back to the original code, therefore we can
now close this part.
The our code is not relevant anymore.
So this can be closed.
And now this is something I definitely want to have on the graphic template.
Let's see.
Yes, here we can see enough.
So we take this on the graphic tablet and we dive into those part right now.
We will go through this a little bit faster because we do not have to reverse most of the stuff before
this.
Okay, let's do this.
Okay.
Let's have a look into this one.
So this is our beginning of our own code and this one over here, and it goes down to this one.
So within this code, we have to verify if we override registers which has been used over here.
Therefore, let's have a look into this one.
Okay.
So here we can see in this part we set up DB zero register me zeros initialized with the values zero
over here and then let's see, this one is it's not relevant.
This is our parameter right now.
We've got Ki Chen local be zero.
So now v zero will be assigned to ki generator.
At this point, mi zero will be aligned to key generator.
Okay.
Then we've got our tri start.
We want.
We want is another one.
Maybe let's let's change the color to yellow.
So we want this being assigned to a string which is a as.
Okay.
Then we've got invoke static on V one and we move the result into v one.
So we one has been already overridden at this point and we've got V one is now our key generator.
B one is now our key generator.
Okay.
So this one is not not relevant anymore.
And then we move the result from the one into the zero.
So at this point, P zero also becomes our key generator.
So now also this one.
Back then, we already knew if we're having two registers with the same with the same object, one of
them will be reused.
And there we go.
Here we've got 100 in hex.
So we one will be overwritten with hex 100.
Then we've got invoke virtual.
We do not care about this one.
And it's returning void so we can move on.
Then we've got and work well.
And now we are returning a different object, this one.
So this is our secret key.
All right, let's make this a little bit.
More clearly.
This is our secret key.
Our key, and this will be moved into V one.
So at this point we one will be overwritten with this one.
We want us now holding our key.
Our secret key and sorry, secret key.
Secret key.
Okay, so therefore, let's clean this up a little bit.
Okay.
So this means in this code block over here in this one, we are not allowed to touch the zero and we
want.
Let's do it this way.
There we go.
Okay.
And do not over.
Right.
So then let's have a dip into our code right now.
So let's see.
All right.
We've got invoke interface on V.
Is this correct?
We want it to be from the type.
This one in Java x kryptos secret key is we want at this point secret key.
Yes, it is.
We've got it over here.
So this is this is perfectly fine.
We've got the method get encoded and we are returning back and bite array and the spider array will
be moved into b two.
V two is fine, v two is free for use right now so we choose good to go.
B two is now our byte array.
This is our key in bytes.
Key in bytes.
Then let's have a look.
So far so good.
Then we've got b3v3.
Also no problem because we are not allowed to touch v zero and we want we can of course reuse v one
like we have done it over here, but we are not allowed to overwrite it.
So v three We are now at this line.
V three will be assigned with zero and this is also perfectly fine.
Now we've got invoke static.
Okay, we are using the method or we are calling the method.
Let's do it this way.
So we are now here and we are calling base64 and base 64 and code and let's see what's the parameter
in here.
The parameter is we are having two parameters and byte array and byte array which is V two and let's
change the color.
We are also having an integer value which is v three.
Let's see byte array v two.
Does this fit?
Yes.
V two is our byte array this this fits perfectly and then the integer value is v three let's make a
comma and v three is our integer value zero.
So this is also perfectly fine right now this method works.
Now we have to take care because we are overwriting b three and let's, let's take another color.
So V three is now the base64 encoded string.
So the result of this one will be now stored into v three.
We three as equals this one right now and let's clear this maybe up a little bit.
Okay.
So we are now at this line.
Everything looks good so far.
And let's see.
And then we've got a set object.
And now we fetch out our system out.
So let's take another color system out.
So we have fetching system dot out, system dot out, and this one will be stored and let's see.
And this will be stored in V for.
Before.
It's all too.
No problem.
It's not B zero and V one.
And then let's see, we invoke virtual on our object.
So on our field ID and we invoke print line.
So now we are calling System.out.println.
This is the last line over here in our own code.
So let's write this down.
We are invoking system dot out print line.
This returns white perfect and we are having only one parameter which is from type string.
Our string is now with 3b3 and let's verify if this is correct.
So let's see B three is our basic C four and code two string.
So this all fits perfectly into our code right now.
The reason for this might be because we, we already start at the beginning of our code and we, we
have copy paste that the first three lines over there into this form and within our own application.
We haven't set up anything yet.
So this might be the reason why everything looks that perfect.
We will encounter things in the next example where this doesn't fit that perfect anymore and we might
have to adjust a lot of stuff, but I mean, this one right now, we have verified it and this should
work out of the box, which is super amazing, right?
Absolutely.
Nevertheless, let's check if the transition really works.
So over here, we move on with the original code and this means our register.
We one should be still our secret key.
This one.
Let's see if this is the case.
B one has been used over here.
Yes, and it is secret key.
So this is this is perfect.
Maybe it's it's maybe cleaner if we do it this way.
So we are not assigning it.
We are reusing it.
Let's keep it in this way.
Okay.
And then we only got the zero left, which is not on the screen right now.
Let's see.
Okay.
We have to scroll down then later on and verify if we see Roe needs to be what is we zero our key generator
so maybe we zero is not being used after what this would have meant that we could have used with zero
in our code.
We have to figure this out.
But in case if we see Roe is not being used down here, if we see roads not being used anymore or if
V0 is being overwritten, for example, if we zero will be overridden and it's not in check and key
generator anymore like this one over here.
Then we could have also used it in our code.
But this is something we we have to figure out first.
So therefore I would suggest let's simply have a quick look into this one.
Okay.
So here we are back at Ubuntu VM.
Let's see me zero me zeros only used here.
Then we've got the beginning of our code, end of our code and then let's scroll down a little bit.
Yes.
I cannot see it anymore.
So we zero is not going to be used anymore, which is pretty interesting.
So it's not being recycled even in the original code.
So yeah, this means we could have simply reused to be zero in our code over here.
So beginning of our code, we zero can be reused.
All right, this is it.
And therefore, I would suggest let's simply build this application and see if it's working.
I mean, this fits perfectly right now, our code in this one over here into this code over here.
And in case it doesn't, we know how to do this right now.
So you have to get out your paper sheet and you have to go through this line by line to see if these
registers are are being initialized or used before.
And if you override them and sometimes you also have some some other parameters.
And for example, let's say we have a parameter over here, which is we want then we want would be our
secret key.
And it's not an integer value and therefore we have to adjust it that this parameter would be would
be correct afterwards.
All right.
Okay, let's revert this.
So this has been B three.
That's our integer value.
So yeah, you have seen how you can do this.
And now let's simply play this application and see if we get out our our secret key.
So let's do this.
Okay.
Two would be one challenge to recap all.
Oh, it's.
It's in here.
It's A's.
And now let's see.
And here we have now this, this.
And let's simply verify with Shadi.
Excuse me.
What's going on over here?
So we are now opening our patched version before we install it and see if everything is correct.
Com App hacking a yes a yes crypto and there we go.
We've got now an System.out.println base64 and cultural string key get encoded as a parameter and there
we go.
So this one is in parameter and returns back in binary despite array will be transferred into a string
into an base64 encoded string and this string will be printed out.
All of our smiley line adjustment has been has been put into one single line over here, but it looks
absolutely perfect.
So let's run this and therefore we have to skip a line at first.
Skip a line that should be a yes out.
Okay.
And then we have to use the APK signer
and then we have to uninstall the existing version.
The smartphone got disconnected.
Yep, that's correct.
There.
We have it back.
Okay.
So this is the original version.
Then EPS one challenge to recap all east.
We install our version of this test only saltash tx.
And now let's pull out the ADB logcat and let's search for system dot out.
And let's open this application.
So keep this in foreground.
And there we go.
3 to 1 nice encrypted text.
This is regarding to the main activity, I guess.
And here we have now our key.
This should mean this base64 should change all the time.
So we could now take this one.
Echo dash PN 364 DX Yes.
So here we can get now divides in this way.
Here we have no the parts of our secret key.
This is the message we want to print out the message also and the initialization vector.
This is also something that's missing right now.
Let's verify if it might be correct on the first attempt, so therefore we can leave this open.
But we are restarting this application because the key changes all the time.
Oops.
So this means we should have now another one?
Yes.
Looks good.
Okay.
Same size, different value.
This looks perfect.
The things we are missing so far is the initialization vector, the parameter and also the return value.
But all three of them are byte arrays, so we can take the same approach.
In my opinion, this is now a little bit easier to do directly in Smiley because we're having four instruction,
I guess, two to get the basic C four encoded string and two to print it out by a system dot out.
Of course, you could also do this in the Android studio, but this video was designed to show you how
you can prototype things in the Android studio to make them work.
For example, to play around until we have an Yeah.
A method and way to print out the secret key as in byte array within a base64 encoded format.
Figuring this out directly in smiley is way harder and it's absolutely not required or unnecessary.
So we have in Java environment where we can where we can prototype this stuff and then if it works,
we can simply decode it to get out how it looks like in smiley.
All right.
So if you want to do this, I leave this as a task for you to print out the missing three spider race.
I will do one quick solution in the beginning of the next video, because I would like to finish this
video right now.
What we have seen as prototyping things in Java is pretty awesome.
Decoding it and getting the smiley code is even more awesome in this case right now.
It wasn't that hard because the transition from the original code into our code back into the original
code was pretty smooth.
I guess we hadn't have to adjust any register right now in case if we would have.
This is absolutely no problem.
We have to skill and knowledge to deal with all of these issues and we will do this in the in the next
video where we have a little bit harder task.
So there we will have to look into printing out and by the rate without the 64 encoded method, not
because some 64 encoded method is not available.
It will be always available on the Android system.
But let's assume we are having an object and we cannot base64 encode this object.
Let's say we have to iterate over this object in the memory and print out every single value.
And therefore I would like to show you also the for loop approach.
And yeah, this is this will be a little bit rough.
So therefore I'm looking forward to see you in the last part when we finish this journey over here.
So after this one, we, we are very prepared to perform every task we want to have in Somali.
We could write really complex smiley code and put this into an own application so we could we could
do a ton of stuff with Smiley and this is pretty awesome.
So we can circumvent all these security features, print out certain keys, debug information and things
like this and this all without root privileges because we have directly modified the application.
Okay, so this is it for now and I'm really looking forward to see you in the final video of our challenge
over here.
So let's go.