Welcome back.
This is the final part for our one challenge to recap all challenge.
So this one here, this will be it will be really insane.
So what we are going to do right now is we will make this challenge a little bit more complex than it
is.
So therefore, if you can use basically four methods to get an easy way, go for this.
Absolutely.
Do not do not make it more complex than it is.
But in this challenge right now, we want to have a look into writing more complex molly code and insert
it into an existing application.
So we will use Norton 64 and go to string method.
We will write an own for loop where we iterate over this array and print out every single value.
Maybe we will also append them to an ASCII string tool yet to print it out directly.
And beside this we will also have some UI interaction.
And this is really not an easy task because within the ace function where we are going to inject our
code, there is no UI interaction and we have to make and we have to create a connection from the UI
to this one over here to display some text or some messages.
All right.
So this will be it will be really insane.
And I guess that's not good.
This is an absolutely perfect final to finish our smiley journey over here.
It will be a little bit intense.
And it could be also the case that it's a little bit overwhelming because we are going to do much stuff
right now.
But I guess it's better to finish in in this way instead of just increasing the things we have learned
so far.
So therefore, let's do this.
Let's jump into this right now.
Okay.
So we are still working on EPS.
One challenge to recap on let's remove the old directory that we do not have interference with all projects
and now let's have a shady excuse as apk.
Let's see what we want to do.
We go into comm app hacking as a as crypto.
So we are still working on this one.
And let me enable my pen quick.
All right.
So here we have the original code.
Then let's see.
Over here.
Yes.
Here.
We want to insert our own code.
And then once again, we have the original code.
So this is our task.
And I mean, it's exactly the same like the last one beside the fact that now the code is a little bit
more complex.
So we are not having just a few smiley lines, we have tons of smiley lines and therefore the transition
and let me clean this.
So the transition from the original into our and back into the original might be a little bit more complex
besides this.
But we also want to do is let's see with any main activity over here and let's clear the screen.
Okay.
Within the main activity, we have some sort of layout.
So this is our, our is crypto layout.
So the one with the with the base64 encoded output, I simply blend it in right now.
So this is an activity and this activity is able to display things on our screen within our A as crypto
function.
Over here we do not have the ability, but we want to have it.
So we want to insert our code over here and we also want to have the ability to print something on our
smartphone.
So here's our smartphone and we want to make some text appear.
And this means we need some kind of interaction between the as crypto class and also the main activity
over here.
So our code transition is not just based on one class right now.
We will make and code transition into another class over here and this is freaking amazing.
It's a little bit complex.
I'm not going to lie, but I will show you how we can do this.
And then you have.
Yeah, yes.
I mean, you already have unlimited power.
You might not realize it right now.
Okay.
So this is what we are going to do right now.
And therefore, I would suggest let's start we start once again with prototyping our application in
the Android studio to see if everything is working correctly, and then we paste it in here.
And the second part will be about this interaction between activities or, let's say, between a class,
because this one here, it's simply just class.
It has no UI components available, but we will make it happen that we that we get an interaction with
a new component over here.
And then we can also display some, some fancy things on our activity screen of our original application.
All right.
So therefore and let's let's open Android Studio New Terminal Tools, Android studio, pen bash studio
is a little bit complex.
You can also add it to your path environment if you want to, but I keep it starting in this way.
Okay.
Now we create a new project.
We do not want to mix them up right now, so let's keep them separate, empty activity.
And now, let's see.
This is now our Somali support.
A hard way.
I still go back to new cards.
Yeah, I guess that's a good compatibility.
Yes, my smartphone is running high up, but we keep it to look it and I keep Java over here.
All right.
So now the creative process has been started, and this might take a while.
So I see you after this has finished.
All right.
So the creative bit has been finished.
And in the last video we did insert our code over here, which is absolutely fine beside the fact that
we have here a little bit more components available that we do not have in an original application,
but we will get to this later.
So I guess it's really a better solution not to write it into the main activity, to write it into a
separate class if this class where we want to interact has no other dependencies also.
All right, I'm sorry for this blame on me, but yeah, this time we will do it in this way.
Okay.
So we want to have our secret key and this one over here, and then we can iterate over this one despite
array.
So therefore let's first get these three methods and now we create once again a new Java class.
So simply sorry this was a little bit fast and right click new java class.
Yes.
Okay.
And now we also create a method, but this is the name and things like this are not relevant.
We call it the same encrypt message, but we are not having a parameter in here.
Okay.
Oh, we need a return type.
All right, so here we have know our code.
So I'd enter to import those classes, all right.
And get instance we have to surround with try and catch we could also an exception signature.
This means when we call this method, this method has to be in and try and catch it.
I guess let's do it this way.
So it's also perfectly fine in this way.
All right, so now we've got our key.
And to get the byte array, we need to call the method key get encoded.
This is returning back our byte array.
Perfect.
Now, we should assign this to invite array.
So therefore byte and we call despite array to get a little bit of diversity right now.
Okay.
We assign this to the return value over here, which means this gets assigned, which means our smiley
code has this move result object also in there.
Okay.
If we now want to print this despite array out, we could do it in the following way.
I mean, base 64 is the better approach.
But let's say we we make it.
We want to write our own code.
So therefore for int I as equals zero is less than the type array and we have something like length
perfect i plus plus OC and then we could use something like system dot out print line and then we call
byte array with the index.
Yes.
So this should work, I guess.
Let's see.
I mean, we are prototyping over here and we can experiment around with this one.
So to call this method right now, we have to create a new instance of us and then we call encrypt message.
And we have to do this in the main activity because this is our entry point and this is where the code
gets loaded in the on create not loaded executed in this way.
So we are having a as a s equals new as and then we want to call as a encrypt message.
All right.
And now you see we've got this this hand handled exception because we've got it over here, which means
we need to include this and then try and catch.
I guess I would enter so around with try and catch.
Perfect.
But now we do not have to staff this try and catch stuff in our in our ace code right now.
All right, let's select our device already selected.
Let's run this application.
We do not have to observe the the graphical output.
All we need to do is have a look into the locket if we get printed out our byte array over here.
So the credit build is still running and now it's loading in style already.
Blockheads.
Let's see.
I'm not seeing anything so far.
We get an exception.
Let's search for system out.
There we go.
These are now these bytes.
So this is already perfectly working for us right now.
That's good.
But let's make this a little bit more convenient.
So, for example, let's get this typical hex representation one bite at a time.
How can we do this?
We've got something like in string format for this task, so we could use string dot format and then
let's see me have to use something like percentage or zero x.
This is the the ASCII string via append at the beginning.
So everyone has an zero x and then we want to have percent zero to x.
Yes.
Okay.
And this bracket should be closed over here.
Yes.
So I guess this works.
So now we are printing out zero x and then hex representation of one byte as two hex values over here.
And the zero is if we are having an zero in front of our hex value, it will be also displayed.
So let's see and run.
Perfect.
This looks absolutely perfect.
So, I mean, we are getting a new key every time we start this application.
But we can see, for example, here we've got this leading sero.
If we remove this one over here and run it again, then there should be something, placeholder or nothing.
Okay?
There's nothing in here right now.
So that's the missing zero.
And we want to include it.
I mean, this looks even better right now, but let's take it to another level.
So let's write all of this into a single.
Into one single line.
Yes, into one single line on a string.
This is our key string.
All right.
And now we need to get this.
Let me see how we can do this.
Okay.
First we need to append key string with the current values from this one over here.
Yes.
Okay.
What's the problem?
Okay, we need to initialize it.
Let's initialize it with zero x, then we've got needing zero x and then we've got our values over here.
Yes.
And we want to have these values in this format.
So we should take it in this way.
Yes, this looks good.
So the zero x can be removed and then we want to print it out, but not in the for loop and just afterwards.
Okay.
So now we are pending every single value here fch14 into one string.
The string has a leading zero x and here we are printing it out.
So to make this, let's see if this works and run ab.
Perfect.
So now we've got our string as an ASCII hex representation over here.
This can be easily used in any A's encrypt decrypt function right now.
Awesome.
But one thing we do not want to search all system outs because there can be a lot in there.
Let's add some identifier.
So for example, this is our crypto key.
Let's make this a bit larger that you've got it all in once.
All right, run up.
Yes.
This looks perfectly fine right now.
Okay.
Here we have now our crypto key.
I mean, at this point, it would be even enough to transfer this into into the original application
into this one over here.
This one.
Because I guess these lines of code will create a lot of smiley syntax.
We do not need everything.
I mean, we we dive in over here.
Secret key channel.
Red key.
This is what we've got in the old code also.
And the original code.
Yes, it's this line.
And then we have to add everything underneath.
This has to be added over here between those two lines.
All right, but now let's go the insane way and the insane way.
I would like to show you what what I have planned for this.
Let's see if this works out.
I'm not sure about this.
Okay.
So we can create text messages on our screen.
I will show this here and toast.
Then we can call, make text, and we've got three parameters.
The first one is the context, and this is the hardest one.
Then we've got our string char sequence, for example, and then we've got a duration.
How long we will display this string?
So let's see, make text.
Now, the first parameter is the context.
And how can we get the context or what is the context?
An Android application if it has an screen.
The screen is the context.
So the current activity, the main activity, which means if you want to print out some text on our
screen, the application needs to know where or what is the what is the current context, what is the
screen where I should put this text onto?
So therefore, in our case, we want to have it on our main activity because we need some sort of graphical
output for this one.
Well, let's say an activity which has some graphical components because we've got an on create method,
therefore we are creating a layout.
So the context is simply just telling.
I am now on the main activity.
Please print this out on the main activity and therefore we also have method which is this.
So that's the main activity.
Get application context.
Okay, now this toast message knows.
All right, I need to be printed out on the main activity over here.
So this is the activity which is in the foreground, and I need to be printed out over there.
All right, perfect.
So let's see.
Hacking into your application.
This is the text we want to show.
And then we've got the last parameter, which is the length.
And we've got predefined values length, short and length long.
I mean, short is pretty enough because we just want it to be displayed just in just a few milliseconds.
All right, let's run this application and then oh, yes, I have missed something.
I always keep missing this.
So this is now just creating the text.
If you want to show the text, we have to call the DOT show method.
So yeah, this happens all the time to me.
Let's run this once again and then I get back the screen that you can also see what's happening there.
Okay.
So screen copy, screen copy is interacting with the ADB.
And you can see it's killing this connection right now.
And yes, something
like this wasn't mentioned.
So let me let me unplug this real quick.
Okay.
I haven't thought that screen copy goes that far.
But let's see, we've got an ADB shell now.
It should work.
Yes, this is why I would like to install it first and then play around with this, because it could
be it could be even worse.
So let's see.
Yes, this application has been already launched and this message has disappeared.
Let's see.
Let's relaunch it.
Well, I guess it's this one.
Yes.
Hacking into your application.
Have you seen it?
Maybe.
Select Long.
Then it's a little bit longer.
I guess we can also provide time values.
For example, 2 seconds or maybe more.
So let's see.
Okay.
There we have this text.
Is there a typo?
No, it looks good.
Okay, so this text is also something we want to inject into the original application over here.
This one.
But now there's the hard task.
So let's take this code.
And paste it into, for example, at the beginning where we want to have our transition over here.
And then also maybe at the end.
None.
Then check the ADB logcat output and here we can already see.
This class over here has no such context.
So this has no context where it can print some text over there.
And what we need to do is we need to inject the code into the main activity also.
So we need to get this context as an static value and then we can use it over here.
And this is the transition we also want to make in this application over here.
It's the same approach.
We need to inject a little piece of code into the main activity, and then we've gotten constant or
static value from the context which can be used in our code over here.
And this is freaking awesome because we can also perform UI interactions.
So if you present this to a customer, when you have this application and there's some fancy stuff going
on, I mean, this is this is absolutely perfect.
All right, so let's do this.
Okay.
How can we do this?
I mean, it's a little bit of Android's programming right now.
And this topic, this context, it took me quite a while to understand it.
I tried to explain it, and I hope that's a little bit faster for you.
So first, we need to create a static, static variable, static context, context.
Then we need to import it.
Okay.
Now in the on create method there we have the access to this context because the create method is creating
a screen, a screen layout and this screen layout has a context.
So this is something that the application can reference to.
Okay, I need to be printed out over there.
So let's assign this over here.
The context is equals to this get application context.
All right.
And now we can use this context because it's in static field.
We can use it in our as method, so we can reference it now in the following way.
Of course, we need to make sure that we have established this context correctly, otherwise this would
crash completely.
So main activity dot context.
But we will make sure that we establish this context because this is the code.
This one over here, we are going to inject into the main activity.
Also over here, just underneath set content view.
There we are creating a new static field and we will reference it in our code afterwards.
All right.
Okay, so let's see now we're having a context.
It's working in this way right now.
This text needs to be printed out on the main activity.
And now I would suggest let's simply run this so we are not having it in the main activity anymore.
This is now within a class that has not directly access to some graphical output.
So we run this.
Okay.
And over here?
Yes, we can see.
Perfect.
It's working in this way, but it's a little bit of more effort.
So besides only injecting into the a class into this one, we also have to take care about the main
activity.
But we will handle this.
This is absolutely no problem for us right now.
I mean, it might be harder to write this code over here to to understand that it's working in this
way, but patching it for us right now, absolutely no problem.
So therefore, let's build this application.
Bird epic.
Then let's see, locate OC and now we are taking an and first look into the code.
So let's see how many lines of code we have produced in here by creating this for loop the system out
those toast messages and things like this.
Will be at the back.
And now let's open this with Visual Studio code.
So we have within Smartglasses to come hacking and then let's first have look into the as class.
So here BFD as class let's select Java and now let's see where do we have it?
Here we have this encrypt message and generate key.
This is the last instruction we have copied from the original application.
Okay.
And then.
Oh, okay.
Yes.
So this is our code right now.
I mean, this is intense, right?
So we need to make the transition.
Let's write this down.
Beginning of our own code from here.
To hear.
Yes.
This is where it ends.
Okay.
This whole code and this code needs to be placed into this application.
Here in between, I would suggest let's first do this and then we will have a look into the main activity,
how we can adjust this patch right now, and then we make sure that the transition is working absolutely
smooth from the original code into our code.
Back to the original code again that everything we might overwrite or we might reassign will be patch
probably that that it works correctly.
So everything we keep overwriting over here needs to be restored or needs to be circumvented in a certain
way that we can that we are not messing up some existing code.
This is no problem for us.
We will do this in just a moment.
Okay.
So first let's patch this code and therefore we go into EPS one challenge to recap all and now HBK Tool
DX as APK.
Please make sure that we're having a clean new state because if you're working on this one, this will,
this will be a huge mess.
Okay.
So here we have it cold as we are opening this with Visual Studio code.
Okay.
Also, my PC is absolutely hyped about this one and defenders spending crazy.
Therefore I have moved the mike to the other side.
I hope it's a little bit better right now.
So here we've got our Visual Studio code, so let's see.
And Smiley Clowns is to come packing as crypto.
So this is the original application.
Let's enable Java and then here we have encrypt message and let's see.
Secret key channel.
Right?
Key line 21.
Let's verify this real quick.
Secret key channel.
Right?
Key.
Exactly.
This is line 21.
So we will insert our code afterwards.
Yes.
In between those two.
Okay.
Let's do it in this way.
So now we go into our compiled code.
Oh, that's.
This is the feedback.
It's this one.
And we copied this one, this part.
Yes.
And we select those two and insert it over here.
And then we've got them perfect insertion into this existing code.
All righty.
This looks good.
It looks intense, but it looks good.
This is the first thing we need to do.
And now.
And this one over here.
These are things we need to adjust.
So this is now the reference to context from our code over here.
From this activity.
And this context is being referenced by the package name.
So we need to adjust this to the original package, of course, which means this part.
Com a package.
Smiley support.
Hard way.
This activity is not existing.
This activity over here.
Let's see.
What's the name?
Main activity.
It's this one.
Yes.
So we need to adjust those two lines.
But let's not.
Oops, sorry.
Let's do it.
Not right now.
We will take this to the graphic tablet and discuss this over there.
Okay.
So besides this, we also need to apply our patch into the main activity.
So over here we've got this main activity.
And what we need to insert here is the following.
Let's put them side by side.
So we need to insert this part.
Line 13.
We need to insert it after the text, for example, and we need to insert this part directly after the
content view.
Yes.
Before we start initializing this text view, I mean, we could also use the existing text view to print
out our text right now.
But yeah, I mean, I guess the toast message is a little bit cooler in case if you want some additional
modifications and you stuck at a certain point, write me a message.
I will drop my bonus video if there's a lot of response regarding to this one.
All right.
Okay.
So let's see those two lines.
Let's see line 13 in our EP code.
Let's also put them in this way.
So let's close the Explorer on both sides.
There we go.
And let's enable Java.
Here we have it.
It's missing.
So now main activity.
We need to go into our main activity.
And this is over here.
Let's enable Java A left a C code we have written.
Right is the original code.
So let's see.
Line 13.
Was it 13?
Yes, it is.
Line 30.
I'm not sure if we are having a correct line reference right now and it seems like it's not the case.
Yes.
And therefore do not rely on line numbers.
So we can see we've got an aesthetic field over here and this is missing over here.
So simply let's copy this static field into this part.
Okay.
Beside this, we've got p zero.
So here we can see zero is being used as this this object.
So if you're having an activity like this one over here, we are using p zero.
Most of the time, as in this object, if you are not having an activity, if you just have an simply
poor Java class, then PC row might be reused like we have seen it in some few examples over here.
And just as an S.A..
Okay.
And then we've got this one over here.
Here.
Set content for you.
Maybe.
Let's enable a word wrap, then.
We've got it in one line.
Yes.
And all we have to do is this.
We have to copy paste this one.
On the right side.
Yes after set content view.
So this is the only adjustment we have to take.
Let's create some space.
Begin.
And so now let's take this one here.
And let's replace it in here.
All right.
And now the last thing we need to do.
Yes, we will take this to the graphic tablet.
Okay.
One thing we need to adjust over here is the package name for our activity, because this one is from
our code and therefore it will be referenced as com a pecking smiley support, heart rate, main activity.
So this application would look up in this directory if there is an main activity.
And if we go into this directory, let's see.
Let's see how far we can get.
Not even close.
We've got comm app hacking as and we're already out because we are not having a smiley support heart
way package right now.
But we do not make this modification right now.
We will take this to the graphic template and then we have a more transparent view on the things we
have added, where are and why.
And we will also keep track on what we need to do to adjust this in the original application.
Okay.
So let's take this right now.
Not this one.
This is now gone.
We do not care about this anymore.
This is completely gone.
So let's take this file first, this one over here to the graphic tablet.
Then we will have to look into the main activity and we will discuss all these things.
I mean, we do not have to go through every line because this will take quite a while for this part
over here.
We just want to make sure that the transition from the original code into our code is correct.
And therefore, I would like to show you some some neat tricks that can be super handy to perform this
task and also, of course outwards.
So from our code back into this application code once again.
OC So let's start, let's do this, let's take this to the graphic tablet and I see you in just a moment.
Let's go.
All right.
So here we are, backlit graphic tablet, and this method is absolutely massive.
So let's grow it down here.
We have our beginning.
All right.
So we need to understand a little bit of what's going on over there to make the transition from the
original code into our code and backwards.
But we do not need to know every line in case if you want to know every line, write me a message.
I will drop you on video wherever you go through every line, step by step.
Okay, so for now, let's be this a little bit up.
Okay, here we go.
We've got our method encrypt message.
And this means this is the original code here will be here.
We begin with the original code and it ends up over here.
Okay, this is the first part.
And then we have the second part, our code.
And this begins over here.
And now let's see, it goes.
It's even not visible.
So let's, let's start drawing already.
Oh, well, it goes down all this way till here.
And then over here we have the transition into the original code once again.
Well, right.
So let's see.
Let's start analyzing this.
And we will do this in several steps, because otherwise we we will run out of space right now.
So the first thing we want to make sure is which register are being used for what in the original code
over here in this part.
So this is the first thing we want to know.
Let's see.
And the easiest way is to go backwards so we can see we want is being initialized over here.
And let's write this down.
We want is equal and we want to see return type over here.
So this will be stored in V1.
So based on the last instruction we know we want is java x crypto secret key.
So we want is our secret key.
Then if we have a look into v zero, this is the last time we do something with v zero.
And the amazing pattern smiley is all those type references are next to us.
So this 1v0 is our key generator.
We zero is our key generator.
All right.
This is all as far as I can see right now.
Let's do this.
Yes.
Oh, yes, of course.
One important thing which is missing the parameter this time we are not extending an activity.
So therefore the this object is not reserved for the P zero register.
P zero is now our parameter.
So it's plaintext, but let's keep it parameter.
And this one is from type byte array.
Alrighty.
Now let's have look how many registers we are using in the complete code path.
So not just within our code one port within our path, let's call this three.
So this one over here is part one and then we have this code and over here we have the part three.
So this is the complete original application, part one and three without our code we have inserted
right now.
Okay.
Let's scroll down a little bit.
There we go.
So here we can see we got five local registers.
So within both code path one and three, we are using five local registers.
We are using.
Let's write them down.
Zero.
We want we to be three.
And before we have already seen we zero, which shouldn't be touched and we won.
Which shouldn't be touched because we need to.
Otherwise we would have to restore them in the in the third part.
So these two are gone with zero and we won.
But we two, we three and before are free for use because they haven't been used over here.
Now we have our inserted part, this one, this is our part two.
And within our part two we could easily make use of these register we to be three and four because even
if we assign and yet if we play around with them, they will be they will be only used in part three,
which means let's say we assign we three to some zero zero register.
This would be overwritten over here once again to something more important, important.
So therefore it gets recycled.
And we are not we are not using it anymore.
So therefore, those three registers are free for use right now.
All right.
Okay.
One neat trick I would like to show you is you already know this, but I mean, you're seeing this in
an example like this one makes it a little bit more clear.
We will immediately increase those registers because we do not want to play around with a lot of reassigning.
We want to have freedom and maybe we already use higher registers.
Let's see.
Yes.
We are using the nine.
All right.
This is a very high register.
So therefore, let's go beyond every limit.
The the maximum amount of righteousness we can use as 16.
So therefore we can, we can increase this value to 15, which means besides those three, we can also
use those registers from five, six, seven, eight, nine, ten, 11, 12, 13, 14 and also 15.
These are now all registers which are free for use because they haven't been known in this part right
now in this one or this one.
These registers know only values from 0 to 4, which are five.
But now we have introduced a lot of more and they haven't been known before.
Therefore, they are absolutely free in our code part.
All right.
Okay.
So far, so good.
Now, let's clean this up a little bit and let's take the most important parts out of this one.
So I will write them down a little bit more clear right now.
Let's give me a let's give me a minute for this.
Okay.
So here we have it.
Now we've got an overview about the three registers.
We've got our own registers and we've got the ones that has been already set up.
And let's draw this line, this thin line between the original code and our code right now.
What we need to make sure right now is that if we are using those registers of example, those two or
also the zero register, that they are being used in the correct type.
So therefore, let's make sure that this is that's the point right now.
So let's scroll down a little bit.
Okay.
Here we've got local one and local one will be assigned to key, which is secret key.
Okay, so let's do this right now.
We start over here at this line and here we can see local.
We want we already are.
We are playing around with an already set register.
This one is from type secret key.
And we can see.
Yes, this is working.
This is working probably.
So we want let's write this down.
B one is from type secret key in our code.
This is correct.
So we are reusing this one correctly and then we've got me two and here we can see V two.
This is now a thing we need to, we need to write down on our to do list.
So we, we've got a set object and we've got this context object right now.
So this is our context object.
Okay.
And this will be fetched into v two.
So v two is our context.
This is absolutely no problem because we can we can see over here, which has been free, maybe let's
deny this right now so we shouldn't re-use be two in in an in another state right now until of course,
we are not using this context anymore.
So, yes, this is this part, but we can see this is something we have to adjust.
So there is no package smartly support hard way.
And therefore this is something we need to to do.
We need to adjust this in our in our application code and this needs to be adjusted to let's see, maybe
we can see this if we scroll up a little bit.
No, we cannot see it right now because we have no activity context right now.
I mean, it should become a hacking as com EP hacking as and then we should have an main activity.
But let's verify this.
Package name.
Okay, so in this way, we will not miss it later on.
And then let's see, we've got considering B three, so b three will be in string.
So far so good.
Okay.
Next we've got before and before will be assigned to 0x1.
And this could be everything.
This could be an integer value, this could be a boolean value.
We just know before as being assigned to 0x1.
Okay, let's recap this a little bit.
We are using the three right now.
It has been free and also before.
All right.
These are all registers that has been set up in the original application.
And we can see our transition is now working properly because everything else underneath this code should
work out beside our to do over here.
This is something we have to observe a little bit to be to context part, but the rest should be this
should be probably fine.
That's not missing now it's the string.
Okay, so let's move on just a little bit right now.
Okay.
Here we've got now we are at this point right now.
So let's maybe also draw a little bit of line that we notice.
Okay.
We are here right now.
So we are invoking aesthetic method.
Oh, yes.
Now we need to get back to purple or something that that looks like purple.
This one may be and we have now our UI interaction.
So Android which a toast make text.
Okay this is fine.
This is an that's the Android toast class.
Nothing.
We need to adjust over here.
And now we've got three parameters.
Now it's getting interesting.
The first one is this part over here.
So let's let's try to skip it in this way, okay?
This is me too.
Let's see, we two is context.
This is correct.
We can see Android content context.
Perfect.
What are those other then we've got java lang char sequence.
This is this part over here.
This is v three.
All right, we three.
Yes, we've gotten string in here.
Perfect.
And last but not least, let's see.
So this one over here.
This is an integer value.
It's before.
So, yes, now we know this is an integer value.
Let's write this down.
Integer value and this is one.
So this is also working properly.
And then we get back this graphical, this graphical UI.
So we, we write this down and this toast into V to.
This means at this point we are overwriting B two.
V two is now our toast object.
So therefore we choose overwriting this part.
But this is absolutely fine because we are not using the context anymore.
So therefore if we scroll down a little bit, let's see.
In this context?
Nope.
No, I cannot see it anymore.
Maybe we dive a little bit deeper into this, but I guess this is now the transition where everything
is working probably fine.
We have tested our code, our code works, and now we we are within our original registers without having
overwritten anything so far.
We should take care about the zero and we want that those two are really not being overwritten.
And also this PC raw object.
So this is unreal.
This is a real danger approach.
We need to take care about them, but the rest looks absolutely perfect.
Fine.
So let's change the color to make sure till here everything is fine.
Okay, then we call the method show.
So here we've got our toast, make text, and then we've got our three parameters.
We, to me, three before thought show.
So this is this line of code.
Next, let's see.
We are overwriting b two once again.
So our text has been shown.
Therefore, we can also get rid of of this toast message here via assigning me to and sorry this toast
object to another string and zero x.
We are reassigning B to this is now working.
Probably the only thing I would like to do is in keeping track of these types.
So for example, let's jump in between over here.
This one, for example, new array this line.
Let's see if everything is working correctly over here.
If this is the case, then it's probably most likely that this code is working so far independent.
So we do not need to adjust anything right now in case if we have a mismatch regarding to certain types,
then of course we have to take a look.
But we do not need to go the whole code.
We just have to focus on these values.
So here we are creating a new array and we are creating it into V V7 and this one over here.
Let's see, what's this one?
I'm not familiar with this instruction totally.
So therefore I would like to to look it up.
So let's have a look into new array.
Okay, here we have it.
New array we x, we by type, it generates a new array of type ID that's the type ID and we why element
size and puts the reference into the this is the amount of elements, this is the type and we put it
into X and perfect, let's get back.
So this means we are creating a typical traveling object array with the size before and we put this
into V seven.
So we seven is our array array and the size is before.
Let's see where before has been used the last time.
Let's see.
It goes back a little bit.
Okay.
Well, right before has been the last time set over here.
This is correct.
Let's see.
Okay.
So we are creating an array and the element size is one.
So this is not the length of the array, this is the element size.
And then let's see, we've got const V eight, so let's write it over here a little bit.
We eight is now being assigned to zero zero.
Okay.
Next we've got a get byte and this is something I also want to look up because I cannot memorize if
we have this this array and what's the size parameter and what's getting stored anywhere.
Okay, so let's look this up real quick.
Okay.
Here we have it gets a byte value of a byte array into v x OC.
This is one bite into the x of our array.
The array is referenced by V by OC this our this is our array and it is being indexed by V set.
All right.
Yes.
Okay, let's write this down.
So this instruction simply means we are having something like A9.
This is our byte value is being referenced by V three and the index v five.
This is what this line does.
Let's see if these parameters are correct.
We scroll up.
Where have we been using the last time we three.
Over here.
Yes, this is trusty array length.
So we get the number of elements from our byte right into V six.
Oh, that's also an interesting point.
We will have to look into this one, but then we do not analyse everything.
But this is a really important thing over here.
So let me do this real quick.
Okay.
But first, let's finish this one.
Okay.
We know we three is being initialized over here.
So maybe let's draw some lines.
So we three is being initialized or set to an byte array.
Okay.
And then let's see what was the other parameter v five and we can see v five is being set to zero afterwards.
V five is being referenced as i.
So MI five is our zero zero and that's the reference variable ai.
Which means do we use v five?
Nope, we are not assigning it.
So this one over here is it's working perfectly.
This line means we are having the following.
I will clean this up afterwards because otherwise it will get very confusing right now.
So this one over here, we three is our byte array and B five is the index.
So we are referring with three index zero and we write this into.
Into V9.
This is also working properly, no type confusion or things like this.
Everything is set up correctly.
Okay.
Let's have a look into this part.
But first, let me clean this up a little bit.
All right.
So far, so good.
Now, what's that?
Interesting point with this one over here.
So this line here, we can see we've gotten in casual if statement let's see if we five is greater else
we six we jump to condition zero.
So let's write this down.
Okay, let's see where condition zero is.
Okay, so let's get it on and screen.
There we go.
So we jump downwards here.
So this is condition zero.
Okay, so far, everything pretty normal.
We are just skipping this code right now.
And this code, this is now interesting because we've got an go to label over here.
But where's this?
Go to jump.
Did we miss something?
I guess not.
So if you scroll down, we can see.
Oh, that's interesting here.
Let's go to labor.
So if this one over here is not true, then we go into into this into this block over here.
And this block right now can go to at the at the end.
And this go to is referencing back to the beginning.
So what this one over here is it's our for loop.
And this is the followup where we iterate our over our array and yeah, this is, this is pretty amazing
in my opinion because this is how a for loop looks like.
So we've gotten label over here.
Okay then we've gotten condition.
Let's see what are those parameters.
We five and we six.
What are those.
So let's get back a little bit.
I mean, here we already see this.
We do not have to go back.
B five is zero.
Be five is being initialized to zero zero and we can see v five has been has been assigned to ie afterwards.
So this one is our ie oc.
This means we five is ie this is our increasing counter variable.
Let's see.
What's the other part?
Let's take another caller.
The other part is we six and we six is the array length.
So let's see what array length is doing.
I mean, array length is taking.
Yeah, I guess we can guess it because array length is taking the length of our array into v six.
Yes.
In case if you are not 100% sure, you should definitely look it up.
But now after seeing this instruction, I yeah, I can remember what's doing.
So this means v six in this part over here and this is our array length and this is exactly condition
we, we have here.
If I is greater than our array length, then we jump to condition zero.
So this means our our counting variable has become larger than the array we want to iterate over.
So we jump out to condition zero, which is here.
If this is not the case, we go into this code and we will go through this whole code.
So I will I will clean this up once again.
So therefore let's, let's write into this.
So we go down into this whole code until we hit this line, this go to line, and then we go back again.
So we start over here and then once again we are checking our eye has been increased over here.
This part is I is equals I plus one or so I plus plus.
And then it will be checked once again over here.
Is I now bigger or larger than V six?
Yes.
Then we jump out.
Otherwise we go back into this once again and then we've got this this jump backwards.
Why is this now so important?
Because this is something you could accidentally create.
But this time we're having an we're having a break condition, which is this part over here.
So this is our break out condition, this one.
So if we wouldn't have this break condition, so let's say this one has gone, it's not available.
And we have played around with those Trump labels.
What's happening right now?
We have created an infinite loop.
This one over here, it's an infinite loop.
The application will crash and you might search for this error quite a while.
Because what's happening over here.
So we come to this, go to label and then we go back into our code right now.
All right.
But then over here, we jump back to our code and to the beginning.
All right, then we go downwards all the way, and then we realize, okay, we need to go upwards once
again and so on.
So this is happening all the time.
This is our our our infinity loop.
So therefore, if you play around with these sharp labels, make sure you're not jumping upwards.
And in case if you does, make sure that you have some breakout condition, that it's really leaving
this code at a certain time.
All right.
The stress and short note, it's it's not super important for this task right now.
I guess it's just interesting to see how how far loops gets constructed over here and how how you can
accidentally create an infinite loop.
All right, perfect.
Let's clean this up once again.
Okay?
I mean, so far, so good.
We can go to this part right now because everything else has been has been already analyzed.
Yes.
Here it's getting interesting once again.
So string builder.
Okay, we seven let's take a random line.
For example, let's take this line over here.
Is everything still working correctly?
We've got B five and V six.
B five should be in print stream.
Let's see, MI five is being used over here.
OC Yes, here we've gotten print stream.
This is correct.
And then we've got this.
Sorry, we are here, we've got v six and V six is now from type travelling string and we can see yes
this is the return value or return type.
It will be moved into v six, which means V six is from type travelling string.
So these are aligning probably.
I mean, it could be luck.
It has to mean that there's no error in between there, but it's pretty unlikely right now.
Okay, let's move downwards here.
We've got our toast.
Oh, this one.
This one?
Yes.
We should observe this part right now.
Okay, here we can see we are reusing or reassigning v five.
We have used that just right before me.
Five has been and and print stream oc.
So V five is being recycled at this point and it will be assigned to the context.
So this one over here, this is the field type OC.
So the field type is from context OC and this time once again, we need to make sure that we are not
having this package name in there.
So we need to replace this package name with as this is something we need to, to do.
Okay.
And then we are jumping out of this code.
All right.
So now we need to make sure that the transition outwards is also perfectly fine.
In this case, it's an easy task because we can see secret key needs to be in register we want.
Secret key.
And me too, is being.
We have already realized we too can be anything else because it's been recycled.
We have to take care about the zero and zero because these were the only registers that have been set
up before in our code.
In the original code.
This part over here so we zero needs to be key generator and secret key needs to be in V one and p zero
needs to be our parameter.
So this is something we need to look down right now.
So we need to get into our code and we have to look for these values.
But as far as I can see, we are not doing something with V zero and also not something that we want.
I mean, yes, he had spy being assigned to a secret key, but that's correct.
And otherwise we are not using it.
So let's let's scroll down.
Yes.
That's it.
Easy peasy.
We want a secret key.
Let's figure out if we zero.
Is this key chain object and p zero should be our parameter.
Let's see if this is correct.
So we want a secret key.
All right.
Where do we use the zero?
Do we have it over here?
No, I cannot see v zero.
So maybe this key kitchen object has already been recycled because it's not being used.
After our first initialization, we are not doing anything with keychain anymore and therefore it can
be simply ignored.
All right.
The last thing we have to check is p zero.
P zero.
Let's see.
sp0 has been used over here.
Anywhere else?
Not perfect.
We can see we are calling Cypher to Final.
And this is our parameter.
Our parameter is despite array.
And if you take a look into the original code to find it will be called with the original parameter
with this one, which means the transition into the original code is also working perfectly.
We cannot find keychain anymore.
This key generator object in be zero, but it simply has been recycled.
It's not being used after what and we want it still being set to secret key.
I guess we didn't.
We did an amazing job, so we got most of this stuff over here.
And also the approach, I mean, it's it's pretty nice, right?
We've got to to lose right here.
But we do not have to adjust anything else besides those two package name.
This is everything we need to change.
And then the code is working absolutely smooth.
We have taken care about all all those registers.
We have seen the code is working correctly.
Those types are working correctly.
We haven't taken a look into an for loop.
So this is really, really nice.
Yeah.
Wrap up of our smarty task or smarty journey we have already done so far.
One modification is missing in this part over here.
So we also need to take care about this one to do.
All right.
These are our three two rules right now to increase the number of register and to change the the smiley
support.
Hard way.
Let's do this right now.
And then we will have look into the main activity or maybe we will see if this builds or if there are
some errors in there right now.
Okay.
So let's patch this first.
Yes, we are in the correct method.
Please make this also sure that they are not accidentally patching the other method.
So first we want to increase increase this registers to 15.
I hope they are 16.
But yeah, we will figure this out and then this might support hardware.
Let's see what's the what's the real main activity over here?
So we go into main activity.
I mean, this could be also something completely different.
This could be some other activity or things like this.
So it has to be the main activity.
But this is the the only activity we have in our application and therefore we want to print it over
here.
So here we've got set content view so we can take this whole in this whole part over here.
And now we are searching for let's see, there's some some replays.
Let's see how we can replace it.
Replace Control h.
So we want to replace it with this way, and we want to replace this part over here.
Yes.
So can we make this a little bit larger?
No, but it should work.
So let's observe this really close and let's see if we can replace it.
How can we do this?
Okay.
By clicking enter.
So let's see.
Com and picking main activity as a main activity.
All right, this is perfectly fine.
Okay, so we have increased those righteousness.
We have adjusted those two pictures.
So let's play this back again.
I'm super excited to see if this works.
We're getting an error.
This is already a label with that name.
Oh, okay.
Yes, 250 to 4.
I'm not sure if it's now this line number or this one, but we have problems with our labels.
Those labels haven't changed right now, so we haven't changed these labels, which means we've got
to go to zero or we've gotten condition zero and I guess we have two of them right now.
Let's see.
Condition condition zero.
Condition zero.
Looks good.
Let's see what's with go to go to zero.
Here we have and go to instruction.
CB Oh yes he if you have to go to label and also here so we've got now to go to labels and of course
the program doesn't know where to jump to to our for loop or into the region out stuff.
So let's adjust this over here.
I mean, the easiest way is to provide our own label, own label, and then we need to figure out the
reference to this one which is here and this would be the patch.
So condition zero is are we not using Condition zero anywhere?
No.
Interesting.
Cool.
This means they should build right now, in case you could also, of course, adjust condition zero.
But let's see.
Nice.
This looks perfect.
So this part has been done.
If you try to install this application, it will crash because we are not having this the static context
right now in our main activity.
So therefore, let's take this back to the graphic part and let's do part two.
I know this video is already long.
Sorry for this one, but I mean, this is it's pretty amazing task.
And we we we are recapping everything right now.
We've got labels, we've got if conditions, we've got register types, values, new instructions and
yeah.
And all these amazing things.
Okay.
We are now getting back to the to the main activity and I will see you on a graphic tablet for the last
task over here.
Let's go.
Okay.
So here we have the on create method and we can see we have added this code over here and this is our
code which means screen one is the original application code and this one is also the original application
code.
And we do now the same approach.
So we will figure out which registers are being used in this part in the first part, and if we are
overwriting them in our second part.
So if this is the case, we need to restore them in the third part or we need to we need to circumvent
this by increasing those local registers or other stuff.
Okay, let's draw also our line in this line, the separation line, and then let's go backwards.
So like we have done it in the previous example, here we've got V zero and P zero already.
So let's see what is the zero we zero this is now invoke virtual.
This is in parameter and this is an integer value.
All right, we zero is an integer value and this integer values this one over here.
So we zero is being assigned to 0x7f, null B and so on.
Okay.
And then we've got P zero, p zero.
Let's see.
P zero, we're using P zero.
I mean, we are using it directly here.
So this one has to be the reference.
Yes.
This one over here is comm app hacking as main activity.
So this is our main activity reference.
So this is our this object, main activity.
This object.
Then what else do we have?
We have p one also over here.
And P1 is our parameter and this parameter is from type bundle OS bundle.
So I'm pretty sure we are not messing around with this one.
Okay.
So now we have to figure out if everything has been aligned correctly and if if we are overriding,
we zero if we can do this or if it's still being used.
So therefore, let's get into this one.
Now our code p zero in our code is also main activity, but this one is not correct.
So here we've got smiley support, hard way and this needs to be replaced with A's.
So this is our to do over here
and p zero would be afterwards a reference to main activity.
And this is the this object and we can see.
Yes, this is working perfectly fine.
Main activity, this perfect p zero.
Everything is fine with this one.
Oh, but then it's getting interesting.
We are moving the result into V zero.
So at this point we are overriding V zero and what's getting moved into v zero.
We are calling get application context and we are moving the context.
And this pot over here into the zero.
So we are overwriting the zero.
So we need to make sure that we zero over here is being used the last time in this in this method code
because otherwise if we zero is being used in the in the next part anywhere and we are overwriting it
with context, this will cause trouble.
All right.
Okay.
So let's move on for now and then we will verify this.
Let's see if we have to do something else.
And then we've got as put object.
So we are putting this object into the context.
And this makes also no sense because this is once again not this context, it's the context.
So as put object, the context right now gets put into main activity.
Context, context.
Okay.
So this will be put into the main activity context.
Let's do it this way.
And this is perfectly fine.
So we are referencing this context to the main activity, this object.
Okay, this is working properly.
Now, let's see.
Perfect.
In the original code, we can see the zero is now being used with another value, another integer value.
So therefore we do not have to restore the zero over here because we zero is being overwritten at this
part.
Let's also make this transition line.
This way so we zero is now being assigned to a new value in 0x7f08 null and so on.
Which means this is perfectly fine that we are overriding it at this point.
This is OC because it has been recycled anyway.
One instruction after in the original code.
All right.
This is something I'm also not sure what happens right now.
So let me point the problem out right now.
Okay.
So here we have our context and the zero has been set to the get application context.
But we have it here.
And then we are putting this context into into this one into main activity context.
No, this is working perfectly fine.
Sorry.
I was a little bit too fast on this one.
This is the aesthetic field.
So, yes, this is working perfectly fine.
Maybe let's clear this up a little bit and focus only on this part right now, because the transition
over here, everything else is working.
Correct.
Okay.
Let's let's focus only on this part.
So over here we've got main activity, get application context.
So this line.
This line looks like this main activity.
Dot.
Get application context.
I will shorten this right now.
And we're having no parameters, but we're having a return type from context.
Let's make this parable.
Okay.
So this is the return type or the return object in this case.
And we were storing this into v zero.
So V zero becomes this part right now.
Okay, so far so good.
I guess this part is clear, maybe not clear written, but I guess it's clear.
So next we've got a put object and we are putting now we zero in to main activity context.
So this context over here, which means we could rewrite this in the following way.
Main activity.
Thought context because it's an static field ID, we can reference it in this way.
It's now we zero.
So at this point we zero has been assigned and it can be reused like one line afterwards.
This one over here.
This is totally fine because we already have saved our context in in this most important context field,
which is our reference right now.
All right.
So therefore, everything has been working out correctly over here.
Besides the fact that we've got a smiley support, hard way, these are the only two adjustments.
This one.
And we have the other one.
This one we need to do right now.
Let's do this.
Let's put back the application and let's see if this one works.
If it does, I mean, this was tough.
But you see, we have absolutely no limits.
We could write and complete the application over here and we could do we could implement and hold back
server in this application which prints out those secret keys and do a lot of funny stuff.
Okay, so therefore let's go back.
Let's build this application and see if it's working.
Okay?
We have already inserted the code.
Here's our context and what we need to adjust is this one.
So we need to copy this and we need to place it in here and also in here.
Yes, we save this and everything should be working, correct?
Right now.
So let's see.
I'm super excited to see if this works.
Of course not, because we've got this lash in there.
Where does this lash come from?
Oh, yes.
I have made a copy paste error.
I'm pretty sure.
Yes.
We are missing our semi-colon.
All right.
Yes.
Nice.
So we go into a year this.
Yes.
And then we sit on this application, we sign this application, we uninstall the the original one.
We have to plug it in.
Okay, let's see.
This is our ADB screen copy.
This is support.
Hard way.
Yeah, we do not care about this.
We have now patch.
This is application.
All right.
And now let's see.
Let's install it.
Yes, we can do this over and.
Sorry, it's out.
It's test only package.
So test.
And let's get screen copy back again.
Okay, let's keep this in foreground and let's open also the ADB logcat output to see if everything
is working properly.
So therefore let's close these and we are grabbing for crypto.
Okay.
Maybe crypto key.
Otherwise, we might get some other crypto stuff.
All right, let's see.
Three, two, or maybe.
What do we expect right now?
We expect our toast message and this amazing, fancy crypto key string as an ASCII value over here.
All right, so let's do this.
3 to 1.
Amazing hacking into your application and done.
Check the ADB locked output.
This is freaking awesome.
It doesn't look this amazing how it feels like right now.
I mean, we have made in transition from this activity into our patch code and back again.
So we have applied our patch that we get this amazing key over here and can also interact with the UI
components.
So we could also print out something else we could insert and whole activity in here.
So our own defacement or things like this, but I'm not a fan of those and those defacement and stuff.
Maybe regarding to in customer presentation, we could do some even more fancy right now.
But this is already this is pretty tough because we have set up everything correctly that we can do
whatever we want right now.
We could also interact with services, content provider, broadcast receivers.
We could insert whatever we want.
This can come super handy if you work with multiple colleagues on a project and your colleagues do,
for example, the web application pen testing part.
Let's say the network traffic has been encrypted once again with an is not just SSL, it has been encrypted
with some keys and those keys might change all the time.
So you could now write this and send those keys to to your colleagues on a web server automatically
every time you start this application.
So you have absolutely no limits anymore, you can write an whole debug server in this application and
start debugging it.
Everything is possible and now we know why.
So Smiley is absolutely.
This is an absolutely ninja skill.
All right.
So far so good.
I would say this video is now pretty long and therefore we cut it over here.
In the next video, we will do the solution for the other parts regarding to parameters, return type
and also the the initialization vector.
And we will figure out how we can use this key to decrypt this message over here.
All right.
So this will be the last part before we go back into our black belt challenge.
But in case if you want to skip this, feel free to do so, because the most important stuff has been
shown in this part already.
All right.
So I'm really looking forward to see you in the next section.