Okay.
So here we are back.
And yeah, I hope you could solve this otherwise.
Also, don't worry too much about this.
We will do this now.
Together, the task was overriding this method to always use four dices with the numbers between one
and three.
Yes, this was the task.
So let's see how we can apply this over here.
The solution for this.
Okay.
To get to the solution, we need to figure out what we have done so far.
So we have overwritten the road dice method and here we are having these two parameters that's been
passed to this method and we are printing them out here and here.
And then we are calling the original method this roll dice with these two parameters and this one is
returning the battery which is then being printed out.
And so the point where we need to make our adjustment is in this line over here because here we are
just printing out these values.
But here we are calling the original method and this is the point where we can influence the output.
So the first parameter and let's figure out what this one was.
If we go back, the first parameter is the pooled size.
This means the amount of thisis.
All right.
Okay.
If you want to manipulate this value, all we need to do is we, we could simply create an variable
here just before this variable dice, for example, what dice number and we can apply this value for.
But regarding to basic types like integer or strings, we can also directly apply these values statically
over here so we can simply write four in there.
And then this function, this original function will be always called with the parameter value for.
All right, so we can close or delete this one over here.
Next, the task was to provide numbers between one and three.
And let's have a look.
Here we have the phase number and this one.
This number is being calculated in this next end.
We need to figure out how this next end function works to apply this patch over here.
I mean, in this case, we could also guess the value.
For example, if you provide two, three and four, we can figure out what's the correct one.
But that's not the approach we like to do.
We like to understand everything what's going on over here, and then to precisely apply our patches.
All right.
And then let's see what this random next end is doing.
And therefore I simply just searching for java random dot next int.
And are having documentation from Oracle.
Let's see.
We do not want to apply all these cookies.
So here we are having the documentation from Oracle.
Let's see.
Next end.
And then we have it.
We have to next end functions.
So this is an overloaded function.
We can have next end without parameter and we can have next end within parameter.
Let's see.
And this one over here returns the next sort of random uniformly distributed int value from this random
number generator sequence.
Okay.
Let's see if we are having a next end without parameter.
Nope.
We're having next end with this integer parameter.
Therefore we can completely ignore what we have just read.
Okay.
Next we've got this one with an integer parameter.
Returns of the random uniformly distributed int value between zero inclusive.
That's important and a specific value exclusive.
This is even more important, the run from this random number generator sequence.
All right.
This means if we go back into our original code over here, this one, if you would overwrite this phase
number with no static value.
Let's let's do this on the paper to figure out what happens over here.
All right.
I mean, you do not have any choice regarding to this one because I'm doing it anyway.
So.
Yeah, sorry for this one.
Let's say we are overriding now this value with the static value three, and this means our phase number
will be also three.
And this means we are having now the values from zero up to two because this next int provides this
random number generator sequence between zero inclusive and this number exclusive OC.
And this would mean our dice would return values between zero and two.
And this is a little bit of a problem, I guess, because I guess in my whole life I have never rolled
and zero on the dice OC in my case I have because I have already played around with runtime manipulation
regarding to random number generators, but not in the real world.
So this is not possible and that's also what the author mentioned.
Therefore they providing this plus one at the end.
If you are now providing the number three into this one, we can see we are having this this random
number generator, which is returning a value between zero and two.
But now we are adding plus one to the result of this one.
This means in case we are returning back in zero.
So in case if this one is zero, the result would be one.
In case if you're returning back in two, the result would be three.
Maybe.
Let's do it this way.
I guess that's mathematically more correct.
All right.
And this is the value that's being put into this dice array over here.
And this means if we want to have values between one and three, we need to really apply the number
three to this whole function.
I mean, we could have also guessed this, but then we would have never figured out this edge case over
here.
And this can also back us later on if we if we are not completely familiar with this function is doing.
Okay, fine.
Therefore, we have now our two values.
Let's apply these patches.
Okay, so let's clear the screen and there we go.
And then we go into this one.
This is certainly correct in this way.
So this should work right now.
Therefore, let's opening this application.
It has been already gone once again.
So let's open our screen copy.
And let's also see if this application is still running.
No.
Okay, then you're opening it.
Okay.
Roll dice.
Yes, it's working regularly.
I can also increase this.
Yes, it's still working.
Okay, now let's look into this process and apply our patch.
So I'm opening a new terminal.
So we are using.
Frida.
There you.
All righty, then.
We copy, paste our script over here into this one, and then we hit the enter button, and then we
should have applied our patch and let's see.
So no matter what we are selecting right now, it should be overwritten with four and three.
But we are also printing out the original parameters which has been inserted before, which is also
I mean, this is freaking amazing, right?
We we can observe this whole method and overwrite and manipulate it in this way.
I find this absolutely amazing.
But first, maybe let's see if it's really working.
So roll dice.
There we go.
The original parameter was one was six, two was five.
But we are only returning these values over here and it seems to work no matter what we select.
Yes, we are always returning this function.
Sorry, these values, these four dices and values are one and three.
Nice, but it even gets better because the most amazing part about freedom is that we can dynamically
change this code.
So let's say we are bored of these values over here.
Then we can take this one over here and then let's say we want to have five and six.
We can copy paste this code directly into this console over here.
But we have placed our first script and now Frida is hooked into this method once again and has overwritten
it with these values right now.
So this can be dynamically being adjusted if we now click Roll Dice and then we can see, yes, we are
now having five values, five dices with the values one and six.
This is the most amazing part about Frida, because if you are debugging some stuff you need to attach
and if you want to change some things, you need to detach from the debugger, attach it once again
and stuff like this.
And Frida, we can do this hot plug.
We can directly patch this application in our terminal over here.
And if you want to use this whole script, then all we need to do is the following.
Let's say we do not want to copy paste this all the time in there.
We can also start this this reader interaction with this script we have saved in here.
So this script is located in apps and then privacy friendly design and now we are using the same freedom
and command regarding to dash you make a connection via ADB into this application process maybe.
Let's see.
Okay.
Now we are having back the original method after detaching Frida and now if you do not want to copy
paste this, we can simply use Dash L and then provide the script name.
Now Frida is loading this whole stuff and overriding it with the script defined in here.
If you click Roll the Dice, we can see, yes, our script is active once again and we have overridden
it once again.
And now we can, for example, keep this here and we can apply our patches over here.
I also keep this in foreground and there we go, for example, to then I simply save the script and
it's being automatically being applied to this process.
So if we click Roll the dice, we can see we are having to dices.
Nice, Frida.
Absolutely amazing.
And this is how we can manipulate those values.
I mean, we can also write in whole JavaScript, which takes our parameters in some kind of form and
applied to this function over here.
And we will do this later on because this is the way on how to write and trainer with Frida.
We will do this in the space application and we will simply write our freedom scripts that we can toggle
on and off certain features, be invisible, invincible, have multiple shots, half and shield stuff
like this already.
And the next section, we will learn more about this overload function and afterwards we will also learn
how to manipulate this return value over here by providing and by the way, therefore, I'm really looking
forward to see you in the next section.