Alrighty.
Welcome back.
I'm pretty sure you have figured out everything we need to know right now, but nevertheless, let's
do it really quick together.
So if you go into the downloads directory, I take this application and then we put it into our apps
directory over here.
Privacy friendly.
Nice.
Okay.
I'm using trade exclusive for this one right now.
There we go.
But as always, I'd like to have a look into the Android manifest first.
So within resources.
All right.
So here we can see we have two permissions vibrate and Internet.
I guess the vibrate permission is used to shake this device so you can shake this device to simulate
that your role in those devices.
But I'm not 100% sure about this one.
Nevertheless, we've got a bunch of activities over here, and this one is our entry point, the splash
activity.
So we want to have a look into this one first and then let's see, we've got this one.
What's the name?
That's the main activity.
Okay.
I have to scroll down a little bit to the right.
Okay.
So here we can see we've got a main activity.
We've got an about activity, we've got an activity, we've gotten settings activity, tutorial activity.
And this this one also.
No, that's in content provider.
Okay.
So I guess the first entry point is the splash activity.
So therefore, let's have a look into this one.
It's within work set user privacy.
So.
Mark sick user but we have it privacy friendly and then we've got you I.
In this one.
Here's this pleasure activity here.
Here, there's some decision made between and tutorial and main activity.
Let's have look into the main activity class.
So here we are in the main activity.
Let's have a look into this one.
I like to have a look into the imports over here.
So we are importing some resources, some activity, main bindings, content, main bindings and shake
listener.
All right.
And then let's see what we have here.
We've gotten this review model.
All right.
The sounds not that promising right now.
Here we have the on create method.
Get a life data or right.
This seems to be not our related stuff in it.
Resources we can skip this one.
I mean, here we have another unit resources.
Here we have ruggedized.
This sounds not that bad.
So this is in this device model.
Roll dice and let's have a look into this one.
Oh, that's also nice.
So, dice.
And this is something that's also very important regarding to an Android application.
Most of the time you can manipulate both stuff, you can manipulate the value itself or you can manipulate
the output that's being shown.
I guess that's also the case here right now.
So we could only manipulate the data that's being shown to the user.
But in the background we have our original data.
So this is something unfortunately you can see out there regarding to banking malware.
So the banking malware is providing some output to the user that everything is probably fine so that
the account and the money has been transferred to the correct one.
But in the background the real data are different.
So therefore the money has not been transferred to the original person.
It might have been transferred to the attacker.
So this is some example to an application we do not want to deal with.
But I want to mention this over here, because this also affects our applications.
For example, in our space applications, we can also have two life values, one that's being displayed
and one that's being used to calculate if the game goes on or if the player has lost all his lives over
there and the game is over right now.
So if we do not take a close look into this one, we might only manipulate the value that's being displayed.
For example, the player lives, then we've got over 9000 player lives.
But the real value which is being used to do the calculation if the game is over and therefore we could
still lose the game by having 9000 lives, but only on the display, not on the value which is being
used to make the calculation already perfect.
In this case, we do not want to manipulate the show dice function because this is only the output of
this one over here.
Therefore, let's have a look into this one.
Roll dice.
This is defined in the device view model, roll dice.
And here we have a bunch of other stuff.
Let's see.
Modeling labels, numbers, face numbers.
Okay.
And here we have this dice of life data post value.
And then we've got this roll dice.
This dice are roll dice, maybe have look into this one.
So we click on this one and there we go.
This looks exactly like our function.
We want to analyze.
Okay, so this one here, okay, this looks promising because we have to secure random number generator
over here and here we can see we are generating a random number and storing it in this way.
Maybe let's get out our graphic tablet and discuss this real quick.
Don't worry, we do not dive too deep into this because it's about freedom.
But yeah, I want to show you how this function over here works.
I mean, it's a very basic function, but nevertheless, let's figure out what's going on over here.
Alrighty.
So here we are back on the graphic tablet.
Let's have a very quick look into this one.
Here we have our secure random number generator.
All right, then we've got a method.
Roll dice.
So let's write this down.
Roll dice.
And this one is returning back in integer array, an integer array, and it has two parameters pool
size and phase number.
So pool size.
And face number
and pool size.
Let's see here we are generating a new integer array and we are storing this in dice in an integer array
of dice.
And here we can see we have dice dot length.
This means the first parameter pool size and this is the amount of dices we have.
So our integer array over here, let's see integer rate dice and this is now the amount of dialysis
we have.
So this is one for one and three for example OC and then we've got the phase number.
So we are iterating over this one over here.
So that's clear.
Okay.
And then we've got this phase number and this one is now being used in random next int.
So we are filling this array right now with numbers and these numbers are being calculated based on
random next end over here in this one.
So these numbers that's being generated, for example, this number one, maybe let's do it this way
and this number one is being stored in this array over here.
So this one is holding the number one.
And by generating those random numbers, for example, one, four, one and three, we are generating
our dices over here.
So these are being stored in this dice array and this one is finally returned over here.
So this dice array is then being returned.
This means all function works in the following way.
We are generating some random numbers over here with the next int random next in function and then we
simply store them in an array in this one over here.
Afterwards we are simply returning an integer array containing those numbers and afterwards the application
is putting out those dices, the amount of dices, which is based on the amount of numbers over here
and also the state.
These dices with the correct numbers, these one.
So this is how this function works.
Perfect.
So now we have a lot of options to patch this function and we will use bunch of them.
So I want to show you or provide you many options to deal with this application to manipulate this,
that the result, for example, over here always shows what no matter what's being calculated in this
function over here before.
All righty.
This is something we do in the next sections, but we do this step by step, so we do not start by patching
this whole function.
Right now, we start with a different task, this one over here.
So before we patch the return value, let's first try to observe the parameters of this function over
here.
We hook in this method over here and then we observe these parameters.
So we print out these debug statements we have seen in the on resume method.
But this time, regarding through those parameters, we haven't talked about this right now.
Therefore, we do this together.
In case if you're already familiar with Rita, of course, feel free to try this on your own right now.
You can also try to already patch this whole function that it returns a certain values.
For example, five times six or five times one or one, two, three, four, five, however you like
this.
All righty.
So this is all for this video right now.
And don't worry about this free part.
We will start with this together in the next video and we will figure out how we can print out those
function parameters.
And then we will apply even more patches step by step until we have everything we need to know about
hooking and class method.
All righty.
Okay.
So I'm really looking forward to see you in the next video.