Welcome back, friends.
One thing we haven't talked about so far is timing.
And timing is very important in freedom.
Why?
Let's simply find out.
So here we have an application, and the thing we have done so far is simply connecting to an already
running process.
The application has been started and wasn't the status running.
And afterwards we did connect to this process and we patched the methods and interfered with this,
which was a lot of fun.
But now let's assume we've got the following case and we already got this case in our root check application.
So when we start this app, a lot of things happens, but let's only focus on the following paths.
And so we press this icon in the homescreen of our smartphone, and then the application starts and
it will look like this on a very high level.
I mean, there's a lot of stuff going on, but as already mentioned, let's focus on these things.
The on create method is being caught.
This one over here and now let's assume this on create method is also calling another method.
For example, do check root method over here.
This means the device gets flagged as routed and now the application is running.
If you are now taking our laptop and connecting with reader to this already running application, then
we cannot change this event anymore because the device has been already flagged as rooted in this method.
And to be honest, we cannot be that fast, so we cannot connect while the app is still booting up and
try to hook and overwrite this method.
Yeah.
While it's putting up.
And therefore we need to have a different way.
And the author already thought about this problem and the solution for this one is pretty amazing.
So instead of hooking into and running process, we can simply take the control over the whole startup
of this process.
We can also tell free that to start an application for us.
And the nice thing about this one is before the application starts, we have the control in freedom.
So we can start at this point and we can say, please launch this application and provide our script
as soon as possible.
And this means we can start an application and we can already provide our our script to this application
process before it even has been booted up completely.
We can also take the control and pause at additional staff and then rewrite this application.
So this is freaking amazing and it's absolutely required because if we are having an application like
our root check application, then we need to apply our patch before this application has been already
launched already.
So we have a look at our Tieza application once again regarding to this whole process.
It's not really complex.
I mean, it's it's really easy.
And in the next section, we take a look at the routing application.
So this might be some kind of challenge where we have to figure out or patch this application regarding
to freedom.
And therefore this timing is absolutely required and therefore let's go, let's switch to the Ubuntu
VM and play around with this one.
There we go.
Now let's have a look how we can start an application with three and already providing our script to
this one.
So even before this application has been loaded up, our script will be already applied.
This sounds absolutely amazing.
Let's have a look at first.
Let's get back our smartphone over here.
This time I'm using a real device.
I mean, it absolutely doesn't matter.
We can do exactly the same on our virtual machine.
So here we are having our dice application.
Let's see if this one works.
Yes, it works.
We can also hear on the real smartphone the vibrate.
There we go.
Okay.
But now let's say we want to apply our patch before this application has been started.
Let's go into the apps directory where we have our freedom scripts.
In this one.
For example, let's open this with Visual Studio code.
All right, so here we have our code.
And this one was regarding to filling this array with one, two, three, four, five and so on.
It depends on the amount of dices we are providing with parameter one.
Yes, exactly.
All right, so let's apply the script.
How can we do this?
And first of all, we need to start the Freedom Server.
So within data, local temp, I need root privileges.
Now we can start this free to server and on my pixel three I'm using the 64 bit version of this free
the server because this is a 64 bit device if Rita is running in the background of the smartphone now
let's see apps and privacy friendly.
Then we have our script.
It's called Dice.
One, two, three, four, five, six.
All right.
To launch and process and freedom, maybe.
Let's have a quick look into the help function.
So free the dash, dash, help.
Let's see what we do have here.
A lot of stuff.
There we go.
Spawn and then this file with file.
I mean, we have to provide the package name and this is the file, the application that's being spawned
afterwards.
All right.
So with that, we can run our application.
And there's also this no pulse.
These are our two parameters, dash F and no pause.
All right.
So we are using Frieda with the ADB connection and then we say dash F and now we need to provide the
package name of this application or executable privacy friendly design.
And now we need to apply our script.
So, dice one, two, three, four, five, six.
All right, let's put this on the side.
And if you start this right now, we can observe this on the smartphone.
So I hit enter and we can now see use the resume to let the main threat start executing so the application
starts, but it stops over here.
We are now launching this process with freedom and we have attached our script to this process already.
This means if you are now typing in resume, we can see the application is loading perfectly.
If you now click roll the dice.
All right, we can see our script has been already applied.
I mean, this could be luck.
Let's see.
Yes, it seems to work.
Maybe.
Let's increase.
This one looks good.
Yes.
So here we can see our script has been already applied.
So here we can see this one is working perfectly.
But what was this?
No post option at this point.
Let's figure this out.
So if we close this one over here exit, and if you run this once again, then we can see we have to
manually resume this threat.
So Freida is holding the process at this point and this is freaking amazing because we can now interact
with 3D.
We can also use apply our script to this command line interface over here or play around with the internal
functions.
For example, there are things like Java DOT enumerate loaded classes and things like this.
All right.
Regarding to this one, right now, it's a little bit annoying to always manually proceed this process
and therefore there's just no post option.
So right now we have to manually resume this process.
But if you do not want to do this, we can use this.
Dash, dash, no pause.
Let me make this a little bit larger.
There we go.
Then this process doesn't stop.
And the amazing thing is Alfreda is also restarting this process.
And so on the right, we can see this process has been already loaded, but now we can use freedom to
restart this process, apply our script, and this time, by appending no pause, we can see the main
threat has been already resumed.
And this means if we hit roll dies, yes, we get our script already applied.
In this case, we've got this not found exception because I, I yeah, i overdue on this right now.
So therefore let's do this once again.
But the nice thing is we do not have to set it up all the time.
We can simply hit the upper arrow button on our keyboard and then execute the last command once again.
And here we have this application.
So testing with three, that is amazing.
Let's see if we increase this one.
All right.
Here we can see.
Yes, our script has been successfully applied.
All right.
So that's all for this video right now.
We have seen how we can interact with 3D and how freedom makes our life so much easier.
We can simply use this to start and provide our script so we can modify our script over here and simply
restarting this application without any menu and effort, which is freaking awesome, right?
Absolutely.
And the next section, we have a challenge because now we are equipped with all the skill and knowledge
to patch our shooting detection with freedom.
Therefore, I'm looking forward to see you in the next video.