Welcome back to our second big topic in our fleet attorney.
This one over here is working with existing objects and instances.
But in the last few sections we have seen how we can manipulate class methods and we have also seen
how we can create a new instance.
But what we haven't seen right now is how we can work with existing objects and instances.
And therefore let's have look into the following slide.
So here we are having our space ping application in, let's say low quality.
So this one over here, this is now our space ping application and we've got a lot of objects in there.
For example, we've got this word object, this one over here.
This is now the object where all the graphic views are being placed on these aliens, these alien shots,
this player, player shot and more.
If you're talking about special object, for example, this one over here, this bird, then we are
talking about an instance.
So this is the world instance.
There's only one world object available, which is this instance right now.
And this one has, for example, a bird, a player, coins and more.
Over here we've got some player instance and this one has some live score and more.
And we also got this one over here, an alien instance.
Within the last couple of sections, we have seen how we can create new objects over here on this application,
but we cannot modify existing ones.
And this is something we will learn right now because if you want to manipulate or play around with
games, just if you have the permission to do so, then you need to work on existing objects because
it makes no sense or it's way harder to create a whole new player object rather than just simply increasing
the values of the existing ones.
All right, now let's switch to the Ubuntu VM and have look how we can do this.
The pattern for this is a little bit different, but we will learn this in just a few moments.
Therefore, let's go.
Let's switch back to the Ubuntu VM.
Okay, so here we are back in the Ubuntu VM.
And now let's have a look into our application code.
And so within apps we've got this application free to func and this one over here and we are opening
this application with Chegg School.
By the way, you can also find this application as an attachment of this section over here in case if
you haven't watched the last videos, if you haven't, it's absolutely no problem because we are starting
here a new chapter.
But still I highly recommend doing this because otherwise you only learn a single part of freedom.
And yeah, to to work with Rita or to get the most ability out of freedom, we need to know all three
paths already.
Okay, so here we are back at this application and within com app heading free to func we've got now
this player object this one sorry this player class this one over here.
All right this is the player class.
Now let's get back the smartphone.
Here we have it and let's open this app.
So this is this amazing icon over here.
Okay.
So here we have it right now to getting a better view on this one.
Let's copy this and we create a new file over here, a new Visual Studio code file.
We paste it in here and we select the Java syntax.
All right.
Let's put the smartphone on the right and I'll pull out the graphic tablet and have a look into this
one.
Okay.
So on the top left, we've got our player class and this one over here.
And this is our class player.
This is our blueprint often player and this one has lives, power and some methods.
If you are now talking about an object, we are talking about creating a new player object over here.
So this would look like the following new player.
So here we are now creating a new player object.
And if we're talking about an instance, we are talking about in concrete player object, for example,
this one over here.
Player.
In P.L. one.
So PL1 is now our player object one and this one over here.
This is our instance and this is the PL one instance.
If you would have created a new one, for example, let's do it in green, then we are having now two
instances and this one is instance one and this one is instance two, this one over here.
So PL two wouldn't be connected to this game over here.
This player object would be there, but it would be only in memory.
This is not being available in this whole application over here.
So for example, it would look like this.
So here we are having PL two.
But this one is not being connected to the game.
So therefore this player object is absolutely useless for us right now.
All right.
These are the things we already know.
Now, let's have a look how we can work with an existing object so we are not creating a new one like
this one over here.
We are now working with this existing instance over here.
We want to increase the lives of this instance, which has been said to five and to, for example,
100.
So now let's figure out how we can do this in freedom, okay?
The things we need to do in freedom are the following.
We need to scan the application memory to identify this instance in there.
So if we are having this application memory and for example, this one over here memory, this is now
the memory of this whole application.
Then within this memory we would have this player instance.
Therefore, we need to scan this memory over here until we find this in this instance, and then we
need to access it.
So by accessing it, we can now choose, for example, to have a new LTS value in this one over here.
The lives of this object or this instance has been set to five, and now we can simply rewrite it in
the following way.
We could say from this instance, we want to change the lives, the value, and to be 100.
And by doing this, the lives of this object over here, of this player object will be updated to 100.
This sounds now absolutely complex scanning and memory to identify an existing instance and then accessing
it.
Absolutely crazy, but not in freedom.
Frida is absolutely amazing in doing this task and all we need to do is we need to get into a new pattern.
But this one is also not that complicated.
Therefore, let's directly start with this one over here.
Okay?
So let's close this one, this travel code, and now let's open a new file and we save this now as existing
instance dot trace.
All right, once again, we are still working with Java code.
If you take a look into the screen, this one over here is Java code.
Therefore, we need to tell Frida to attach to the JVM.
This hasn't been changed right now.
So Java Dot perform.
All right here we now providing our anonymous function function and this is our function body.
Our code now is the question how can we scan an application memory regarding to an existing instance?
So how is this being done?
And if you do not have an answer for this one, then a good starting point is the documentation.
So if you take a look into this one.
Here we have it within dogs.
We've got now this JavaScript up here in this one over here.
If we click on this one, then we can scroll down a little bit and here we find now all the stuff.
What's interesting for us is within, let's see, instrumentation.
Here we are talking about the instrumentation with Java.
So this is all the free the code regarding to working with Java code.
If we click on this one here, we have now all this stuff, there's a bunch of other stuff.
For example, we can check if the Java between machine is available, if you've got an Android version
or what's the Android version?
Sorry.
This way.
Of course we've got an Android version and enumerated loaded classes and things like this.
But now we are only interested in the following.
And let's see.
This one over here to choose.
And the explanation is exactly what we want to do.
This one is enumerating life instance of the class name.
So this is our first parameter class.
By scanning the Java heap where callbacks is an instance specifying we've got now two callbacks on match
and on complete.
And these are our two callbacks we need to apply over here.
Don't worry, we will do this together.
It's not that complicated, even if it sounds like.
But Freida is doing all of this job.
Frieda is scanning the Java heap, looking for this class reference or existing instances of this class
reference.
And then we get back to callbacks on match, which has the instance which is being found by Frieda or
not.
It depends.
If there's an instance available and we've got this on complete which simply tells us called when all
instances have been enumerated.
So this is just okay, I'm done right now in this one over here, this callback and this one is where
the magic happens.
And this will find our existing instance, our player object.
And this one over here.
And then we can work with this one.
Absolutely amazing.
Right?
Let's see how we can apply this to real code.
So let's copy paste this out.
We are copying this.
And then we paste it in here.
All right.
The first thing we need to do is we need to apply an class name.
And this one right now, it's not the class reference.
This is simply just the name and form of the string.
So if we go back into our trade x code, maybe let's put this on the right.
So here we have it.
All we need to do is simply just getting the class name in form of a string, and we can get the class
name by using this package name over here.
So here we have to provide this class name not and then the player class.
And this is the object we want to identify or the instance we want to identify.
All right.
The first part has been done.
Amazing.
Now, let's see the callbacks.
This is a little bit more complicated, but not as much.
If you get a little bit of practice, this will become easier and easier.
All right.
Okay.
So to apply the callbacks, we first have to wrap them in brackets, in curly brackets.
Then I'm hitting enter right now.
Okay.
And now we have to define these two callbacks.
The first one is on match.
Let's have a look.
Was it on match?
Yes.
On match.
And we are providing or we are obtaining an instance out of this.
So we've got on match and now we need to define a new anonymous function.
So this is the function that gets called if we found this instance over here.
So this is now our function and this one has an instance as parameter.
This is the instance that has been found.
Okay.
And this is our unmatched function.
After what we have to apply the second callback, which is.
Yeah.
So here we have an on complete and this one is being called when all instances have been enumerated.
All right.
So we use this one over here and we are separating both callbacks with this comma over here.
So after providing the first callback, we are now having our second one on match.
And this one once again, it's an anonymous function and here we have it.
This is now our new structure.
If you want to identify an instance in memory so free that's doing the hard work for us, all we need
to tell Frieda is if you find an instance over here, we are now applying a callback.
So this is the code.
If an instance has been found, and here we are having the code to know when Frieda has been finished
scanning.
And this is the part that is being done by us right now.
All right.
Okay.
So let's get back to code out here and let's see.
So within the unmatched match callback, we're getting this instance.
Now let's print this simply out.
So let's.
Let's print it out.
That an instance has been found.
Send an instance of the player class has been found.
And then we are providing, for example, this instance.
Let me make this a little bit wider.
There we have it.
Okay.
So now every time an instance has been found via printing this one out in our game over here.
In this one?
No, this one.
We should have only one instance.
This one.
We are just creating one player object and therefore we are having one player instance.
If you click on this and this one is losing some lives.
There we have it.
I forgot a little bit of leg, but nevertheless we are still alive.
You're having one life.
This was pretty close right now.
So here we are done finishing with this scanning task and this is just some okay, I'm done.
And therefore we just print out some debug statement.
And the Friedmans has finished scanning the application memory for player instances and this is now
our code.
So let's recap this really quick.
And first we have to use Java.
Choose this time.
This is different regarding to our Java dot use.
We are now scanning the application memory and this one over here for a certain class.
So we we are scanning for com app hacking free to find the player to identify all these instances in
the memory.
I mean it's absolutely amazing that free tech can do this with just these lines, right?
Absolutely.
Then we have to define two callbacks on match.
If an instance has been found, then we are applying our code to this instance and the on complete if
this yet this task has been finished and this is all this is how we can scan the application memory
for an existing instance and work with this one.
Therefore, let's start the free the server and see if this one really works.
So we are connecting into the smartphone over here.
We are gaining root privileges and then we go into data local ten and we start to free the server.
All right.
And this is now running in the background.
Now let's open.
Our new terminal and connect to this process free to dash you come f hacking free to.
Now we have attached to this process and let's pull also out a new terminal for the ADB logcat.
All right, now let's take this code and let's put it inside.
Here we are executing it, and then the magic happens in the background.
There we have it.
Absolutely amazing.
Let's see.
Let's make this let's open this one.
An instance of the player class has been found and here we are having now the reference to this object.
Amazing and then free to has finished scanning this application memory for player instances.
Okay, so this is fantastic.
Now let's see how we can change the values of this instance over here.
If we close this one and if you go back.
So here we can see this player has now unfilled lives.
So this is our instance.
We have found we've only got one player with life set to five.
Now we are only having one life.
And this one over here.
All right.
To access this field right now, all we need to do is the following we are having here now our player
instance.
And we can simply access and modify and overwrite this field in the following way.
Instance, dot and then let's see, this one over here is lives, instance dot lives and then dot value
equals.
And now we can apply a new value in, for example, 9004.
We are now scanning the application memory, identifying our instance, accessing the instance which
lives which is now set to one.
And this one over here.
And we are changing this field to 9004.
Amazing.
Right?
Let's see if this one works.
So we copy this code and we inserted over here.
All right.
The output looks amazing.
I mean, we can see over here and let's open this one.
An instance of the player class has been found and so on.
So this should have worked, right?
The question is now, why do we have still one life?
The reason for this is the UI hasn't been updated yet.
So if we are printing out this value over here, we can also do this and send the player lives on now
and then.
Let's also print this out.
So here we are, printing out the lives of this player instance, and let's copy this code.
We're inserting it over here.
And now let's see.
The player lives are now 9004.
So these lives should have been changed to 9004 and they have been changed and just the UI has not been
updated.
We can simply figure this out by clicking on the player icon.
Let's see, 3 to 1.
There we have it.
9003, 9002 and so on.
Amazing.
We have now changed the lives of this player instance over here.
Freaking awesome, right?
Absolutely.
So this is how we can work with existing instances.
Absolutely.
Fantastic.
Let's do a quick recap on the slides to get even more familiar with the whole process.
All right.
So here we are back on the slides and we can see we've gotten player instance over here.
This player instance has some lives and also some methods.
The thing we need to do is we need to scan the memory for all occurrence of this instance over here
and we can do this with Java dot choose.
The first parameter is simply just the string of the class name.
We want to have those instances.
So this is our class where we want to find all existing instances and then we have to apply to callbacks
within the second parameter on match.
If this instance has been found and on complete, if we are done finishing our scanning job within the
auto match, we are having this instance as in parameter and we need to define a new anonymous function
and apply our code in there.
This is all we need to do to work with existing objects and this will help you a lot if you want to
play around with games also within the space planning application.
Alrighty.
Okay.
One last thing.
Let's figure out how we can call a method.
I mean, this would be clear right now, but nevertheless, let's do this.
And then we are using our old script to create new instances and then we scan the memory once again
to see if they are really there.
All right.
Let's have a look into this one.
Okay.
So here we are back at our Ubuntu VM and now let's have a look how we can actively trigger a method
on an existing instance, for example on this one over here.
And to do this, everything has been already set up.
So within our own match function we get this instance reference and to call method.
On this one we can simply use instance dot d method name.
So exactly the same like we would have called this in Java for example.
If you write it in the following way, here we are having this instance.
And then if you're calling a method in travel, in this instance, we would write it in the following
way and player dot and then the method name.
And over here it's exactly the same.
So here we are having our instance and then we can now use this to call the method name.
In this case, let's see in Shadi excuse me.
For example, let's, let's call this method increase life and let's copy this.
And now we're calling this method on this instance over here.
So not increase life and that's all.
So this is how we can play around with instances.
I mean, it's a little bit more complicated regarding to the approach, but at the end, if you're familiar
with this one, it's not that hard anymore.
Okay.
Before we execute this one over here, maybe let's remove this one and then let's comment this code
a little bit.
And so here we are scanning.
Put the mouse on the right.
We are scanning the application memory for existing instances of the player class.
All right.
This is what the Java doc shows is doing here.
We are having now an on match callback.
And this one is being called if an instance has been found otherwise, this one here would not be caught.
Therefore, we have this on complete because here we know, let's see on complete callback and here
we know when the application memory has been finished.
Scanning and finished scanning the memory.
Yes.
And then we can get this one out and.
Yeah, okay.
And now let's use this one over here.
Maybe now we use it over here.
So we take this one and we put this into our free determiner.
We also observe the AdBlock ad output because if you take a look into the exclusion once again and this
one is printing out some statements, this is impossible, player life's increasing and this one also
increases our player lives and therefore we should have.
Yeah.
And increase player life afterwards.
So therefore let's set the player lives and just before too uncertain value.
So I guess I have deleted this line, but it's absolutely no problem.
Then we have a little bit more practice.
So instance dot lives, dot value is now 9005.
And then we are calling this method and this one is increasing these lives to 9006.
Okay, let's copy this code and let's paste it in here.
There we have it.
All right.
Three, two, one.
There we have it.
Player lives, increasing lives has been now set to 9006.
And this means we have increased it over here.
Let me get this back.
And the arrows also pointing directly to this.
So this is impossible.
This method does not get caught anywhere.
We have increased the lives of this object of this 1 to 9006.
Fancy animation.
I know.
And then we have.
Yeah, we have increased it over here by one.
And this is the debug output over here.
So we have actively called this method on this instance.
Nice.
Let's verify this.
If we click on this one, we should have 9005 because we are losing one.
Let's see.
There we have it.
9005.
Who?
I'm glad that this one over here did work out.
Okay.
Amazing.
So this is how we can play around with existing objects.
Now, let's create our fake objects in this application.
So now let's take our script from the last example.
I will show you what I mean.
Open file instance method.
Was it?
Yes.
So now let's take this one over here and let's remove this function.
Otherwise, we have to call it.
There we go.
Okay, so now let's execute this one over here, and then we should have some some fake player objects
in there.
For example, if we are executing it once and this one should appear.
So this is our fake player object.
I mean, this is an real player object, but it's not attached to this application over here, but it
exists in memory.
And here, for example, we are having another one.
Okay.
Let's do this.
So I copied this and I inserted right now.
So now we're having our fake object over here.
I call it once again.
We have another fake object over here and we call it a bunch of times.
Now, this application is full of player objects, even if we cannot see them.
So I mean, they can also not be used.
So they are completely useless, but they exist in memory.
We can find this out with the script over here.
So here we cannot see them anymore.
But here we can.
So let's use the script, make this a little bit larger.
Okay.
And now pasting in the script regarding to the output of these instances and let's see, there we have
it.
Our player objects really exist.
We've got a bunch of ghost objects, let's see.
So we've got a lot of player objects and addresses and we can see.
Can we see there's no output regarding to the lives.
Did I miss this one.
Oh yes.
Maybe.
Let's add this one over here and send the instance.
Lives is equal plus sorry instance, not life.
Stop value.
All right.
I must have accidentally deleted it before.
So sorry for this one, but.
Yeah, I mean, it doesn't matter.
Okay.
And let's also remove or comment out these too, because otherwise we would have overwritten or we are
overwriting all instances with these with this value and calling this method on all instances that has
been found.
And we want to figure out if there's a little bit of difference.
So regarding to our existing ones, which has these amount of lives.
This one and regarding to all our ghost objects, it should have the the default life set to five.
All right.
Okay.
So now we can copy paste this one in our free the command line.
Okay, so I copy this and then let's open the smartphone and also the free terminal over here.
All right, now I insert it over here and let's see.
Yes, we are now not overwriting any value, we are just printing them out.
This is exactly what we want to have.
And 3 to 1 go.
All right.
Nice.
Now we can see.
Yes, exactly.
We can see.
We've got a bunch of objects.
These are our ghost objects, all having six lives.
So I guess we have used some increased level method in there.
Never mind.
These are now being set to six lives and we've got our instance over here.
This is now our real player object.
All right.
So this is all for this video right now.
And the next one, we will have some fun regarding to our space ping application.
We will use our newly gained knowledge over here to play around with this one.
For example, we are increasing the player lives, the high score and things like this.
All righty.
So I'm looking forward to see you there.