Welcome back.
In case if you could solve this challenge, this is freaking amazing, and I hope you had a lot of fun.
In case if you didn't, I hope you have at least tried to solve this challenge if you do.
Absolutely no problem.
If you couldn't solve it right now.
So here we have back at the Ubuntu VM and this is our, this is our challenge.
We can see if we start this application.
Okay.
The device is being flagged as routed.
Let's reverse this and figure out how this is being performed.
So we are having our IS device routed.
Then we've got three methods check root method one, check, root method tool and also check root method
three.
The return value of these are boolean.
So this means true if the device has been rooted false.
If this is not the case, we could now apply our patches to everything and method over here so we can
override each method to always return.
False.
But all of them are being summarized in this one over here is device rooted, so therefore it's way
easier to simply apply our patch over here.
I mean, if you have solved it by overriding these methods, this is absolutely perfect, fine.
And just a little bit more lazy.
And therefore I go for this approach.
But I will also show the other ones, of course.
So let's have look into this one over here.
So this one is also returning in Boolean value and we can see this device rooted and this one called
three methods.
And based on this one, it's returning true or false?
So what we need to do over here is simply hooking this method is device rooted and overriding the return
value within.
Yeah.
With an fixed value.
A fixed value of false.
All right.
Okay, so let's do this.
We are opening this code editor and then we use JavaScript and we put this on the right.
Okay.
The first thing we need to do is we need to tell the reader to attach to the Java virtual machine in
Java to perform.
And here we are providing an anonymous function.
Okay, now we need to get the reference to this class root util.
This reference can be fetched from the package name and the class name.
So let's keep this in foreground.
Okay.
So I also named this root util and then we are getting the reference via java use.
Then we are having this package name over here.
And then dot and we need a class name.
Wrote your tip.
All right.
And this is our reference.
Okay, now we need to tell Frieda to overwrite this method.
Which method?
From this class root util the is device rooted method.
Here we want to define a new implementation.
Implementation?
You're providing a new function for this one.
We can also see we are not having any parameters in there.
This means we also do not need to provide anything over here.
All right.
And all we need to do is the following.
If this function gets called, simply return false.
That's all.
I mean, if this one works, this would be freaking awesome, right?
Let's see.
So we save this file, and it saved us in our root check challenge.
Bypass route.
Dot trace.
All right, now we only need to restart this application process, but this time with freed up being
attached to it.
So if you close this one over here, then we can see if you're now attaching to this one, it doesn't
work because this device has been already flagged as being rooted and therefore let's restart this application.
The only thing we need for this is the package name.
Therefore, we are using the ADB shell RPM list packages and we are grabbing for root and there we have
it.
And let's figure out if the free dev server has been already booted up free to PSU.
Yes, these are the processes of the smartphone software that's working and running right now.
All right, now let's put all these pieces together.
Let's complete our parser.
So what we want to do is we want to get our script first apps root check in this one over here.
Bypass route.
Oops.
--.
All right, so the only thing we need to do right now is simply cut.
All right, so the only thing we need to do right now is restarting this application by having Frieda
already attached to it.
If we close this one over here, we can see if we are now using our script and attaching to this process.
And this doesn't work.
I mean, this I mean, this application has been already flagged, the smartphone, as being routed.
Therefore, we cannot change this result at this point anymore.
Therefore, we need to apply our patch before this method will be called.
And this can be done with our timing approach.
So by starting this application with Frieda.
And the only thing we need for this one is the package name.
And we can get this simply from the package manager.
So if you're opening a new ADB shell, then we can do p m list packages and then we can grab for root.
Oh, yes.
Dash I.
Sorry.
Route is not an option.
And grep and there we go.
But now let's complete our puzzle.
Let's put all the things together.
So first I go into this directory where the script is being located.
It's within absolute check.
Okay, so now we want to restart this application.
So free that dash you to use the ADB connection.
Then we want to restart it.
Therefore the dash f parameter and then the package.
Name this one over here.
And now we also want to apply our script by a Dash L bypass route.
Let's see if this one works out.
It seems like I need to restart the free server real quick so I go on to the device and let's see if
this free dev server is running.
Well, it's just as.
No.
Maybe it has been crashed or I didn't check it correctly.
So let's restart this free server.
Okay.
Put it into the background.
This one is running over here.
And now let's do it once again.
Let's see.
There we go.
So now the application is being started up, but it's being hosted directly afterwards.
We can now resume this one and our patch should be automatically being applied.
This means if the application is now calling the check root method, it should be directly overwritten
at this point.
Let's see.
Resume and three, two, one.
There we go.
Perfectly nice.
So we have patched this application with this one liner over here.
It's it's a little bit more than a one liner.
But this is the only thing we need to apply to be 100% sure.
We can also check what's going on over here.
For example, we can print the original result value and then we can modify or apply our patch.
Then we have a little bit more of an control.
What's happening in the background?
If we want to do this, we simply go into our script and then we say send the original return value
is and to storing the original return value
and we can fetch this by simply calling this method originally.
So this is device rooted.
This will now call the method, get the return value and store it in original return value.
All right.
Now we are printing this out and here nevertheless, what's the original return value?
We are overwriting it with the false value over here.
We save this one and then we simply go back into our freedom.
We hit exit, and then I simply hit the upper arrow key to get the last command and rerun it.
This time.
I also once again have to apply this one resume manually.
This is something we will fix in the next one.
Let's see.
There we go.
Now we have also our debug statement, and this one says The original return value is true.
So this means the device has been flagged as rooted.
So the return value is true.
Nevertheless, we are overwriting it with false.
All right.
We also have one liner in our command over here.
We simply apply this no pause, and then this application puts up perfectly fine.
So now we got rid of this routine detection and this one, to be honest, most of the time it's nothing
more than just overwriting one method to get rid of routine detection.
This is all I have patched so many routine detection with only applying this this patch to in function
over here.
Okay, so that's the solution for this one.
But nevertheless, let's also do the the hardcore mode.
So let's also overwrite all these other methods in this check root method one, two and three.
This is also invalid solution, but it requires a little bit more of work.
Nevertheless, it's good for practicing.
Okay, so how can we do this?
We do not need to have another Java perform.
So this one is attaching to our Java virtual machine.
Therefore, we can re-use this one over here.
Maybe.
Maybe we write this in a new script.
We'll find new OC.
So we switch to JavaScript.
And now let's do this also for all the other methods.
And first, we need to use Java.
Use and sorry, Java don't perform.
Got confused for a second.
And then we are providing our anonymous function.
Okay.
Now we are attached to the Java virtual machine and we apply all our pictures into this into this function.
So the first patch is regarding to check method one.
So let's create a new reference root util java to use this one over here, plus the class name.
So now we're having a reference to this class and we can use this reference for all three methods.
So this one over here is getting a reference to the root util class.
Okay.
And now let's overwrite them.
So, you two.
The first one is check method one.
Check method one.
We want to provide a new implementation with this function.
And here we want to return.
False.
Okay.
So I'm patching.
Check root method one.
And now we can simply copy paste this.
Uh, it's a little bit messy, but we can fix this.
Okay.
And now we have to apply Czech Route Method two and also this one over here, three.
And this should also work.
But nevertheless, let's print some debug statements that we have or that we know what's going on.
We are in check route method one.
So this one here we are in Sacramento, too.
And yet copy pasting is really dangerous and freedom.
I have made so many mistakes regarding to this, so please be careful if you if you copy paste that
much.
Oh, okay.
So I fix quickly the comments and then this was the safe dialogue.
I was a little bit confused and check root methods.
All right, this one over here should also perfectly work.
So if this was your solution, it's absolutely fine.
Regarding to this one, it's just a little bit more work, but I guess you just want to have more practice,
right?
All righty.
Let's see.
So we close this one.
We get the smartphone back in front, and now we need to provide our other script, not bypass route.
Check in this one and let's see.
All right.
We can see once again, it seems to work and we can also see we are in check route, method one, check
route method two and check route method three.
We can also print out the original statements, what they have been returned.
And let's do this really quick.
I mean, this is it's freaking amazing.
We can observe what the app is calling, which parameters, what are the return values.
We will have a lot of fun in this course regarding to this one.
Also regarding to cryptographic functionality, certificate pinning and other stuff.
I mean, this one, it's really mind blowing on return value of method one is I guess we can already
insert it in this way here so we can do this in this.
Check with method one.
Yeah, I guess this one should work.
I mean, it's.
It's.
It's super sloppy and a little bit dirty, but I mean, in JavaScript, so that's fine.
Also take care about copy paste errors.
And I still got this one over here.
This is my third tour.
This one is method three.
Let's run it once again.
There we go.
Okay.
This was a little bit interesting.
I didn't do anything.
And, yeah, it it moved on.
I'm not sure what caused this delay right now, but yeah, it seems to work.
And we can see this over here.
We are in check route method.
One method would return false.
That's also amazing.
I mean, if you take a look back into this one and this method over here, it seems like our device
does not have any test keys.
So this one wouldn't have like our device as being rooted.
It's false over here.
And then let's see, this one is true and this one is false once again.
So it seems like that this one, the system expense which as you is not returning back an invalid path
over here.
So the only thing that has been flagged this device as true is this one over here.
Therefore, if the only patch check method to the device seems to be not rooted anymore, we can try
this at this point.
I mean, we are we are over engineering this right now, but I have a lot of fun doing this and I hope
you do.
And yeah, I guess we learn also stuff in there.
So let's comment out this one and also common out this one.
And yeah, that's not that's the way.
So now we are only patching root method to check root method tool because this is the only method that
has been flagged.
This device is being routed and let's see, maybe we should start this application without our free
the script being attached and to check if it's really detecting this root anymore.
So let's do this.
Okay.
We can see it's it's the working.
All right, now let's apply our patch check root methods.
I'm going to save it once again to make sure.
Only root method to.
Root your till is not defined.
Yes, that's correct.
I have comment at looks.
I have commented it out.
We need to comment out at this point.
Okay.
Now let's do it once again.
Then we go we only hook check root method two we can see it's again this delay.
And let's see what this application is responding.
I mean, we have time to wait for this one, right?
We take us.
We have time for this one and there we go.
Device is not rooted.
This was the only method that has been flagged.
This device is being routed.
Amazing, isn't it?
Absolutely.
So this is all for this video right now.
Feel free to play around with this and experiment around with this a little bit.
And then I'm looking forward to see you in the next video.