When they come back in this section, we want to talk about function overloading because this is a very
important topic.
If you want to hook a function with freedom in case if you're doing it wrong, Frida is amazingly helpful
and providing us all the information we need to fix our issue.
So therefore it's not a big deal.
But nevertheless, let's try to understand what's going on.
If Frida is printing out these overloading function errors.
Alrighty.
Okay, let's go.
So here we are packaged our ubuntu vm and we have this roll dice method over here.
We have seen if you do not provide the correct amount of arguments to disfunction, then Frida's printing
out this overloading error.
But what is this overloading?
Error?
Overloading a function simply means we are having the same function once again with the same name,
but this time with different amount of arguments because the program needs to know which function it
needs to call.
At this point.
In this case over here we are only having this roll dice with two parameters over here.
So there is no other road dice method in here.
But if you take a look into this random next int, then we have seen in the official documentation that
there are two definitions out there for this function.
We can call this function without having an parameter and we can call this function within parameter.
And this one is very important because the function itself is behaving a little bit differently and
therefore free to us printing out this error and telling us, I do not know right now which function
you want to hook and definitely something will go wrong at this point.
Therefore I rather abort before you get some some strange output over here.
And then Frida also tells us, well, I've got this function definition for this and this type.
So which one do you want to hook?
Please append this dot overload and the correct amount of arguments.
But before this is getting too complicated right now on the theory part, let's simply do an practical
approach.
Let's say we want to hook this next in function.
Let's try this out and see what errors we encounter over here, and then we will also know how to fix
them.
Alrighty.
Okay.
So I'm opening a new terminal and I'm making my ADB connection.
So ADB connect already connected.
All right, then we're using ADB Shell and we need root privileges.
Then we go into data, local temp, and here we want to start our Frida server.
This one over here.
All right.
Frida is running the first step.
Done.
And then we need to open this application.
Where do we have it?
Here.
All right.
We also put this on the right.
So in the background as the three server and here we have our app, we can see it's working just fine.
Yeah, there's no hook right now.
All right.
Now, let's open our results to your code editor and then, yeah, let's try to hook this random next
in function.
So we created a new project because then we also have some some practice regarding to this one and we
safeties and let's see next it s.
All right.
The first thing we need to do is we need to tie freed up.
Please attach to the shader.
We can do this with java dot perform.
Yes, we have JavaScript syntax here enabled.
Okay, that's good.
All right.
That's in function call.
And then within this function call, we are providing an anonymous function and this one over here and
this is now our body that we need to provide our our hook.
I'm going to close this one real quick.
Okay.
Now we need to get this reference to the secure random class.
So if we go back into our code over here, maybe let's put this on the right.
And we keep this in foreground.
All right.
So let's see.
We want to hook this function next inch.
And this one is within the secure random class and this one is within the Java security.
Secure, random.
Okay.
So here we want to hook the next end function.
This one over here.
This is the method and this one here is the object.
And the object random is from the class.
Secure random.
And this class reference is over here.
Java security secure random if you are dealing with an import and the front.
So we are importing here in whole class name.
Therefore, if we want to get this reference to this class, we can simply use this whole this whole
string over here.
This is the reference to insecure random class.
If we are having this package name over here.
In this one, we need to append this class name at the end.
So if you go back to the other script in this one over here, here, we can see by having this package
name and at the end we need to append this class name.
But if we are having an import statement and this is already the complete class reference, so we can
simply use this one over here.
All right.
Forget what you have seen so far.
Let's write this new here.
All right.
So the first thing we need to do is we need to get in reference to this one.
And therefore, we are creating a new variable.
I mean, in this case, it's an object, but in JavaScript, it's in variable.
Let's see, we can also name this exactly like we have seen this here.
So we can name this variable random and then we can yeah, we can assign this now to this reference
and how can we get this reference.
Absolutely correct.
With Java, don't use Java tot use.
And then we need to provide this whole class name over here.
All right.
Now we are having a reference from secure random class in our random object over here.
All right, now we can call random next int and please take care about this capital I and this is very
important, otherwise the function will not be found.
Okay next int and now we want to define a new implementation and so now we want to assign a new function
to this one.
We want to overwrite this function and yeah, what do we want to do?
And let's say we simply want to return zero.
And this means right now every secure, random next int function, this one over here would be now overwritten
with the value zero.
If we are doing this correct in this case, we are not doing it correct.
But let's see what yeah.
What error we get.
So we take this one here and then we need to connect to our application.
So that's opening this one.
All right.
We can see it's working.
Now we need to attach with reader to this application process.
Therefore we need to use free data, ask you to use the ADB connection and then we need to have this
package name, not this one, this package name in the Android manifest.
And this one over here.
Okay.
Now we are attached to this one and let's see if this script works.
Okay.
We're immediately getting an error.
And if you take a look at this application, this one is still running.
So freedom hasn't executed anything right now.
Let's see what this arrow is about.
Next end has more than one overload.
And now that's the amazing part about freedom free does exactly telling us what we need to do.
We use overload signature to choose from.
And now Free Guy has also identified that there are two overloaded methods regarding to this one.
Next int has two overloads, no parameter and one parameter with an integer value.
So this is the reason why we need to be more precise on this one.
We are now having two methods and those two methods are behaving differently.
So we have seen this one over here is returning a number and this one here isn't returning a number
between zero and this number exclusive.
So the functionality is different.
Therefore, freedom needs to know which method we want to hope and therefore we need to tell Frieda
exactly this or this method.
Let's see what's the case for us right now?
Do we have no or one parameter in the method we want to hook and let's see.
Dicer here we can see we are having one parameter t face non parameter inside here OC and this one is
an integer value.
All right, so now we know we need to hook this one over here.
The question might be, why can we not simply use it in this way?
So if you are providing here one parameter in this one, for example, param one, then Freida should
know which function it needs to hook.
Right.
Because we are only having one function with one parameter.
Yes and no.
Regarding to this example, it would be clear.
Absolutely.
But it could be also the case that this method has been overloaded once again with only one single parameter,
but this time from a different type.
For example, we can have an overloaded method with one integer parameter and an overloaded method with
long double string and float parameter one of these types.
Then this approach over here still doesn't work so free at this point, or at least I also at this point
doesn't know which function is now being hooked or which function needs to be hooked.
And therefore we need to make this exact definition regarding to this one over here.
We want to hook the method that has only one parameter, this integer parameter as an overload.
All right.
Okay.
Now is the question, how can we do this and the solution for this one?
It's freaking amazing.
I mean, I have never, ever seen a tool with this amazing help of output over here.
So what we need to do is simply we need to provide this one over here and copy paste this one after
our next end function, and that's it.
So now if we put this a little bit on the side, also this one.
Now we tell Frida, okay?
Please go into the secure random class hope the next in function that has only one parameter from type
integer.
And for this one, please now define a new function.
And this one over here.
No matter what's inside here or no matter what's calculated at this function, always return the number
zero regarding to this random number generator.
And if you take a look back into our code, the output will now be following this function over here.
Random next int this one will return zero after what we add plus one.
And this means all dices or yes, all dices have now the phase name.
I'm not sure about the correct word.
What's the number of nice in English?
But here it's called face num.
So I stick to this one over here.
All right.
So all dices have now defaced num one afterwards because.
Yeah, zero plus one is one quick math.
Right, let's try this out.
So let's put this on the right.
Okay.
I'll also keep this in foreground and this.
Now.
Let's see.
We copy, paste this, scroll up a little bit.
I hit enter and now let's see.
There we go.
It seems to work.
I mean, it could be very lucky that that's the case right now.
But, yes.
And if you change the number of dices over here, let's see.
Yes.
I mean, of course, it also affects this one here because these number or these dices will be filled
by this random number generator.
But it's getting even more exciting because we are not only hooking this next in function, we are now
hooking every next in function in this whole application.
So every time this application is using insecure random number generator next int with an overloaded
function of one parameter integer, we are hooking this function and returning zero.
Okay.
To be honest, this could also cause a lot of trouble, but we will learn later on how we can deal with
this one over here.
So, for example, I give you a quick preview.
Okay.
So let's say we only want to hook this next in function, then we can make a little bit of a decision
over here.
And for example, we are providing an in parameter number of phases.
This is the parameter that's being provided to our function and we can now make and simply if statement
inside here and for example, if param one is equals to six, then it should return zero otherwise return.
And now do you know how we can get back to the original function regarding to the next end?
And please think about this for a moment because yeah, we have now a little bit of an exercise over
here.
You are absolutely correct on this one.
So we can return to the original statement by simply using this next end and then providing our parent
board.
All right.
And this means right now we are only returning the number zero for the next infection that has the parameter
integer from the value six.
I mean, this could be also a few times the case for this whole application, but now we have we have
limited a little bit and let's see if this one works.
So let's try this out over here.
Okay.
No error.
That's good.
And now let's see.
Number of phases six.
So now we should return the number zero.
Plus one.
So we should have ones inside here that's working perfect.
It still working perfect.
And now if you change this number, let's see.
Now, the original method should be called.
There we go.
So now we have a little bit of a backdoor.
Every time we set the number of phases to six.
We are overriding this method and yeah, otherwise the original method is being caught.
All right.
Nice.
I mean, this one is freaking amazing, right?
Absolutely.
But I would like to show you one problem.
If we go back to a number of sizes, a number of phases to six, and then if we are overriding this
one over here, so let's say we want to return another number, the static number, seven or six.
In this case, let's say the we want to return the number six, but this one gets added plus one at
the end.
So we are now returning the number seven for all these devices.
And there's a little bit of a problem.
We can see this over here if you change the number from 6 to 7.
The layout changes.
So now we are having numbers inside here.
All right.
Let's see what the problem is.
If we are returning the number seven for this for this type of dice.
Let's copy paste this inserted over here and roll the dice.
Well, the application crashes.
Let's see.
What's the problem?
We can see the process has been crashed because we have an error not found.
Resource ID this one over here.
So the smartphone is loading those resources regarding to the diocese and form of thoughts.
But now we are returning the number seven, which cannot represented in those dots because there's no
resource file for this one.
And this might be the reason why we get this not found exception over here.
So free.
That gives us unlimited power in patching an application.
But if we if we go too far on this one, we might crash the application on a certain point.
And so therefore we simply have to test it out if it works or not.
And if it doesn't work, we can maybe patch the other examples of this function.
For example, we could have also patched this one once again.
Let me bring this a little bit up.
There we go.
We could have patched this roll dice function regarding to this face number that we are providing the
faith number seven, for example.
Then the application still might work.
But I do not want to go into this right now because it's making this whole process unnecessarily complex.
I just want to show you that patching with three that is absolutely amazing.
But if you go too far, you might crash your application.
All right.
So let's do a little bit of a recap.
If you go back to the script, so what we have learned in the section over here is the following.
And so we have seen that we need to be precise on the method we want to hook.
We need to identify the exact method we want to hook.
And we have also seen that Frieda is amazingly helpful in providing us all the necessary information
to perform our task over here.
We have also seen if we go to far like returning in number seven, but it's not available in this resource
regarding to this disease.
Then the crash, this application free gives us unlimited power, but we need to use it wisely.
All right.
In the next section, we take a look at this dice application once again.
And this will be the last challenge I have prepared for you right now to this app.
And the task would be the following.
If we click on this one, we want to return the numbers and one, two, three, four, five, six.
And for example, no matter how many dices or number of faces we have inserted over here, we have already
seen a little bit of an approach like this one.
We have hooked the next infection and then we can override all dices at once.
I mean, we can also wrap this in more complex JavaScript to perform this task.
But of course there is an easier way.
Think about what we have learned in the last videos, how these numbers are being filled in and maybe
think about and solution for this one.
We will have a look into this one in the next section, but feel free to already go on this on yourself
if you feel prepared for this one.
If not, then that's absolutely no problem.
But maybe make yourself a little bit familiar with JavaScript and arrays.
So feel free to play around with this one over here and then I'll see you in the next video.