Welcome back.
Frida is absolute amazing.
We know this all right now.
But the thing we do not know right now is how to actively call a method.
And this is something we want to find out.
In this section.
We have seen how we can override existing methods, but till now, we have to wait until this method
gets triggered.
So until the user hits a button or the certain event or clause, and this is something we do not want
to have.
We are hackers and we want to have full control.
We want to have the ability to actively call a method.
If this one doesn't get called soon enough for us, for example, to reach the next level or other stuff,
let's find out how we can do this in this video over here.
Therefore, I have prepared an own application.
I mean, this one looks absolutely amazing, but not that amazing on the smartphone anymore.
So the resolution isn't that nice.
And this application is serving just one purpose, learning how we can actively call a method.
So if you take a look at this application, it's, it's regarding to our space pane app in bed, I guess.
All right.
So here we can see we are having different objects, for example, an alien object and also player object.
The player object has bound some lives to it.
So this is an instance field and we also gotten static value over here the level.
So these are most of the things you encounter in an application, I guess up to 90% and more.
And if we know how to deal with this one over here, we learn the last percent at the end of this course
all so therefore let's have look in this application and let's see how we can actively trigger a method.
Okay, so here we are back at Ubuntu VM and I have attached this amazing application into this action
over here.
Of course I have already downloaded it and it's named free dev func this one over here.
Let's get back our smartphone screen and there we go.
And now let's install this application.
All right.
But the icon, I mean, that's maybe not that nice, but the layout over here, it's okay.
I would say so.
Here we can see we are having lives.
Five, we've got a loved one and we've got these two objects which are not being realized as objects.
If you now click on the player icon, there is no fancy shot, but it assumes that the player got hit.
So we lose a life every time we hit the player.
Let's see.
There we go.
If we having zero lives, then the game is over.
And in this level over here, we cannot reach the next level.
So this isn't really hacking application where we need to get advantage out of our hacking skills.
Okay.
Therefore, let's have a look into this application and reverse engineer this real quick and let's open
this.
There we have it.
And then within downloads and free to func, we put this into a new directory.
So this one here is free to --.
I mean, if I look at this, we have already played a lot with these applications, which is super amazing.
So here we have this one and let's open this with Click Me.
Here we have a day compiled and let's have a quick look into the Android manifest.
Let's see.
So no positions and we only have one activity.
So far, nothing fancy in there.
Let's look into the code.
Com app hacking free the func here we are having the main activity which is also our launch activity
and let's see what's inside here.
So we are having an inner static end level.
This one is in static variable.
All right.
And then we've got a bunch of layout stuff also here.
This is all layout stuff.
Until this line here we are creating a new player object.
Here we're creating a new alien object.
And here we are reaching the next level.
So if you take a look into this application, it sticks to level one.
And the reason for this is I do not update the UI regarding to the level right now.
Hacking the UI with Frieda is something I would like to put in a separate video because I do not want
to make this over here more complex than it is.
And it's also yeah, it's a topic alone on itself and therefore the UI does not get updated.
But we will see in the function over here we get printed out the actual level state in the debug output
of the console.
So here we can observe if this method has been called OC and this one over here is also a static method
next level.
Here we are having something play a collision.
And this one, let's see.
This one is decreasing our player life and it makes a decision if the game is over or not.
Now, this one over here, this is a class method.
So within the player class, let's see.
Within the player class, we have two methods increase life and decrease life.
Increased life.
By the way, I guess it's never called in this whole application.
Therefore we have this text and this is impossible.
This method does not get called anywhere in this code.
So the difference between a class and aesthetic method is the following A class method needs an object,
so we can only call this method.
Increase life on an existing object.
If you go back here, we can see we are creating a new player object and this one over here.
And then we can call this method.
A static method does not require an object.
We can simply call and static method by appending the class name.
And then the method name and static method is not bound to an object.
So therefore the static method doesn't need an object.
If you take a look into our next level, this one here is public static void next level and we can see
we are not creating any object in here.
We are just calling this function.
All right, class methods like this one over here player increase in decreased life amount to an object
also for the alien.
By the way, here we are having the alien class and this one even doesn't has a method.
This one is only the constructor of this alien and this one is setting up the layout of this alien.
So this one gets printed on the on the screen.
So in case if you would have hidden method, then this would be also in class method and need to be
bound to an object.
And then we've got the static methods which can be simply called by appending a class name, dot method
name.
All right, therefore we start with the easy one and let's try to call the next level method over here.
If you take a look into the ADP output, ADP Logcat and let's see.
So this one he has been called so there should be an output like current level equal let's grep for
this so ADP locket grep dash I current level is and then we can see system out current level is equal
to.
So the next level this function has been called within the on create method and this one has increased
this value over here, this public static into level one.
We can see this over here.
So on create codes next level and next level increases this value by one.
All right.
And it also prints it out over here.
And this method is not being called anymore.
So that's the only place.
Therefore, we cannot go higher than level two on this point unless we are hack us.
So let's find out how we can call a method.
Okay, so we get back our results studio code editor and then let's clean this up a little bit.
So then we are also starting to free the server right now because otherwise I would forget this later
on and later.
Local temp.
Let's see if is already running.
Och, no, it's not.
Therefore, let's start it.
All right.
Three days running in the background of this one, we are creating here a new file.
And we save this directly into the application directory.
Not this one over here.
It's within free.
The func so static method call that s calling a static method is super easy.
The things we need to do is simply getting a class reference and then calling the method we want to
call.
That's all.
Let's see.
First, we need to tell Frieda to attach to this Java between machine and Java Dot perform.
Then we're providing our anonymous function.
Okay?
And now we need to get the class reference.
And let's put this up on the right and this one on the left.
OC The class reference is let's see, I mean we are here within the main activity class and this one
is holding this method.
So if you would call this method in Java, in this Java code over here, it would look like this main
activity dot next level and this is how we can call a static method.
We do not have to create a new player object or a main activity object.
We can simply use the class name and then the method name.
Therefore I named this class reference simply just main act.
So main act and this is our class reference in Java dot use and now we're getting this reference to
the activity class and this one is within com picking free defining and then dot main activity.
All right.
Now, let's simply call this method.
So we are having a reference and it's exactly the same.
Like you would do this in Java.
So Main Edge, this is now our class reference and then we are having this method next level and that's
it.
And this is how we can call a method in freedom to esthetic method regarding to class methods like we
have it here.
It's a little bit more complicated, but we will do this in a few moments.
Let's first figure out if this one really works.
So we are connecting to this process of free data issue and the package name is also come up hacking
free to func.
It's not in this one over here.
We can find this in the Android manifest xml but I have named it the same, I guess.
Yes.
So that's the package name.
Okay.
And then let's also provide or not provide our script.
Let's do it differently.
We use the command line over here to invoke it.
So now we are connected to this process.
There we go.
And now let's see if this cold one over here works.
Hmm.
We do not know right now because the UI is not updating.
Now, let's take the ADV locket and figure out if this one worked.
ADB logcat and correct that i.
Let's see.
What was the system output?
The system output was current level is all right so we are searching for current level is and I'm providing
the I because this is ignore case sensitive.
If this one is lowercase or uppercase it will be ignored.
And here we can see current level is now three.
So we have increased this level.
So we have actively called this method.
Let's figure out if this is really the case.
Let's call it once again.
All right, nice.
It's working.
So we are actively calling this method and we are increasing the level over and over again.
By the way, one nice trick I would like to show you here is we do not have to use this whole body.
We can also apply a function name to this one.
And then also sorry, only calling this function.
Let me show you this very quick so we can apply a new function, for example, increase level, and
then we can put this whole body in there in this one.
All right.
And now if you take this whole function into this one, we can now use this function in de to call this.
So instead of putting all the stuff inside here, we are now having a function, increased level.
That's also the centrality.
All right.
Already here and now if you're using this, we can see this one is now calling this body.
This is a little bit more easy to use here.
Okay.
Freaking nice.
Maybe let's make some comments that it's easier to follow what happened here.
This one over here, and this is a function name for freedom.
And this one over here is getting the class preference of this static method class.
And this one over here is calling this static method.
All right.
And this is how we can actively call in static method.
Awesome.
So let's repeat this real quick on the slides that we know which steps we need to take to call a static
method.
I mean, in this case, it's not that much.
But nevertheless, let's do this real quick.
All right.
So here we are back on the slides.
If we are having a static method like this one over here, and then we can see the steps we need to
take at the following, we need to get a reference to the class.
And then all we need to do is we need to call the static method in the following way.
Class Dot method name.
So here we can see we are just getting the reference to the main activity class over here and then we
can call this this next level method over here if it is a static method.
Alrighty.
Now let's have a look into class methods.
Why is it not that easy there?
Let's figure this out.
Okay, so let's close this one over here and this one.
So now let's see how we can call an class method and let's open this one once again.
Much class method.
Do we want to call within the player?
Let's see this one increased life and this one sounds and perfect method to call right now because this
one increases our player lives and we also get this debug output if this one has been really called.
All right, let's see if you take the same approach.
Maybe let's put this on the right.
By making a new file for this one in JavaScript.
We right now start from the beginning.
So therefore to perform our anonymous function and let's see now we want to call this method.
So now let's simply do the same approach like we have seen this on the static method so we can take
our player reference and play reference dot use.
Com picking free da funk dot player.
And now let's simply try to call this method increased life on our player reference.
Let's see if this one works.
I mean, it might not be the case because I have announced that already in this way.
But let's see, what's the error of this?
So free that the issue we are attaching to this process.
And then we go.
Increased life cannot call instance method without an instance.
This was exactly the case I have talked about in the last video, so we cannot call an instance method
without having an instance.
If you go back into this one, these class methods are bound to an instance.
If you want to call this, we have to create a new instance, this one over here.
Here we are creating a new player instance and then we can call this player classes.
So here we are calling decreased life.
Let's see if we hit the let's do it here.
If we hit the player, then we can see, okay, decrease life gets called.
So now the question, how can we now actively call in class method?
The solution for this one is we have to create a new instance of this.
We could also use this existing object and this one over here, but this is something we will learn
in a separate chapter, because working with existing objects which are already in the memory, is a
little bit different from the approach we are doing here, and therefore we will create a new instance
over here and then call this method and afterwards we will learn how to do it on an existing ones.
All right.
Okay.
So let's see how we can create a new instance.
And this one, I mean, it's not really hard this time.
Free days, unfortunately, not providing us with the syntax.
But I mean, Frieda also does know what's the case for us right now.
Therefore, let's see how we can create a new object.
Okay, so here we have it now side by side.
And let's also open this one over here.
All right.
So the first thing I like to do is renaming this one because this one is a player class reference.
We need to be a little bit more precise on this one right now.
Okay.
Now, we need to create a new variable.
And this time this one is a player instance.
So this will be our object.
So within the Java code we would write following, we would write player, player equals new player
and this would be the Java code.
So what we're doing right now is we're getting this player reference and now we are having this player
instance in this one and now we also need to apply this equal sign.
And then we are having this new operator here and this is creating a new object and it's exactly the
same in freedom.
So what we are doing here is we are getting the class reference dot and then we tell dot new.
So this is now creating a new instance out of this class, this part over here.
This is exactly what this one here is in freedom.
Then we are having this player reference over here.
So sorry for this highlighting.
Let's let's keep the mouse on the right.
So here we are having this player reference right now and this is our player instance.
On this player instance, we can now call this method.
So if we get rid of this one over here, then we can now call this method in the following way player
instance dot and simply use the the method increase life.
Also take care about the uppercase L and this needs to match this function name over here.
And this is how we can call in class method.
And this time we are creating a new object and this object will be used to call this method.
So this one over here is exactly the same in the Java code.
If we go into this one and here we can see this one, here we're creating a new player object.
And then after creating this player object, we can call these methods decreased life or increased life.
All right, so let's see if this one works.
We save this file into class method player, increase life.
That's I guess this name summarizes all of this.
All right, let's try if this one works.
And then we also add some comments inside here.
So we are taking this into this Frieda terminal and then let's see I hit enter is not a function increase
life.
Yes.
Because I have made a table there.
I already mentioned it needs to be exactly the same name.
There we go.
Okay.
We do not get any error.
And let's take a look at the smartphone over here.
So it seems like nothing has changed so far.
And let's repeat this and maybe let's also put this on the left.
There we go.
Hmm.
It doesn't seem to change anything.
And let's have a look at the ATP lockout output, ADP Logcat and then we are grabbing for let's see.
Within the player class we are grabbing for this is impossible because we have called this method now
multiple times and this should also increase our player lives.
So let's see if this one is inside the ADB blockhead crap that I am possible.
Oh, that's interesting.
Here we have it.
This is impossible.
This method does not get called anywhere in this code.
So let's see if we are actively calling this method.
Yes.
So here you can see we are now calling this this player method.
So we are increasing the lives, which is super amazing, right.
Well, there's a little bit of a problem to this one.
But before we dive into this one, let's have a look back into the Java code.
So within the Java code we can see we are also having some some statements in the constructor of this
player and this means if we are creating a new instance, then also this one over here should appear
in our ADB Logcat output because here we are creating a new object.
Let's see if this is the case.
So let's get the ITB look at.
I'm opening this new over here.
Okay.
Now, let's let's call this once again.
That's not me right now.
This isn't smartphone event in 3 to 1.
Let's see.
A new player object has been created.
Nice.
This is impossible.
Player lives increased to six.
All right.
This means if you are now hitting this function multiple times, the player lives over here should increase
until we have infinitive lives.
Right.
Let's see.
Huh?
Still six.
Six.
Why is this one now?
Not increasing anymore?
So this is something we will figure out on the graphic tablet.
And let's switch over to this one.
All right.
Before we get back to our graphic tablet, let's fix our comments first.
This is something I have promised to you.
So let's see what we have done so far here.
We are getting a reference of this player class and reference of the player class in the next line.
And this one over here, we are generating a new object or a new instance out of this player class.
So creating a new instance, which means this one is exactly this one over here.
Player, player equals new player.
And then we are simply calling the instance method, calling the instance method increase life.
All right, so now we have fixed our code regarding to the comments and now let's see why the lives
of this player over here or the newly generated player are not being increased.
If you use the script, we can see increasing player lives to six.
That's good.
But if we hit it once again, we do not have seven, we still have six.
And if you repeat this over and over again, we stuck at six live.
So why is this the reason?
Let's find this now out on the graphic tablet.
Okay, back graphic tablet.
Let's see here we are creating or we are getting a reference of this player class and this one over
here.
This is our player class reference.
Then we are creating a new object at this point.
So in this line we are creating a new object.
And this is then our instance over here.
And then we are calling the the instance method over here increase life and we can see this over here.
Now the question, why is this not increasing?
And the reason for this is in this line in this line over here, what this one here does is the following.
And this one over here, this is a player object.
Player object.
And this player object has five lives and this one over here.
So these are the lives of this player object.
Now, if you are using this new operator over here, we are creating a new object, a new instance.
And this means the following.
Every time we call this line over here, we are creating a newly player object over here.
So this one is our new player object.
And this one again has lives equal set to five.
Now we are calling this method increase life and this will increase our lives by one.
And this is the output we have seen in the locket over here.
Let's do this once again.
Here we have our newly generated six lives.
All right.
Now let's do this once again.
Now we have this play object over here.
And we are running the script once again.
So here I'm executing it and here we can see player lives still six because the following is now happening
once again.
At this point over here we are creating a new object.
And this one over here.
And this player object once again has lives set to five.
And then we are increasing this lives by plus one.
And we are having six lives.
This means we are now having three player objects in memory.
So this looks like the following right now.
Let me clean this real quick and then let's have a look how this looks in memory.
Okay, so here we are back again.
And this one over here.
This is now the application memory.
The memory already has one player object.
This has been created in the main activity.
And this is this one over here.
And now every time we call this new operator here, sorry, wrong color is the wrong color.
There we go.
Every time we call this new operator, we are creating a new player object.
And this is the reason why these lives over here are not being increased, because these lives are bound
to this player object and this existing player object, which is this one in memory.
We will learn in the next section how to deal with existing objects so that we will learn how to scan
this memory, identifying this player object, and then increasing this lives to over 9000 9005, for
example.
All righty.
Okay.
Freaking awesome.
Let's do a quick recap on the slides that we know what happened right now.
Okay, so here we are back on the slides.
So we have seen we've kept this class method increase life and this one over here.
And if you want to call a class method, we have to do the following steps.
We have to get a reference to the class.
Then we have to create a new instance of this class and then we can call the method.
On that instance.
It looks like as follows We are getting a new player class reference and then we are creating a new
player instance variable over here.
In this instance, variable will be now created out of this class reference and the new operator.
So by calling the class reference dot new, we are now creating a new instance.
By having this new instance, we can then simply call this method by having the instance name, dot
the method name.
And on the right we can see the ADB locate output over here.
So system out player lives increasing lives now equals six.
All right.
And this is also a good point to finish this video right now.
So in the next section, we have our second big topic.
This one over here was about hooking and manipulating classes.
And the next one, we will learn how to deal with instances and existing objects.
And the third part is regarding to hooking or manipulating native development kit functions.
So in the case, therefore, I'm looking forward to see you in the next big section.
See you there.