Welcome back.
In the last video, we have seen how we can work with existing objects.
And this gives us so much ability and now we can finally put some hands on exercises in this section
over here.
So now we will get back to our space ping application and later on we will write an whole trainer for
this one.
So we will have a program that can switch or toggle on certain features.
For example, be invisible, be invincible, have multiple shots and things like this.
And now let's see how many features we can already activate or manipulate with freedom with these things
we have learned so far.
All right.
And let's have a look.
And this over here is our space paying application.
And now let's talk only about these features over here and let's see which one we can already activate
or manipulate with readout with the things we have learned so far.
Let's see, manipulating the high score.
We can already do this.
Nice.
Manipulating the lives also possible rapidfire.
And this one is also possible.
Invisible coin rain.
Invisible.
All right.
Amazing.
These are now all the things we can already do.
The only thing that's missing right now is creating a new player and working with multiplayer shot.
So not just having a double shot, having an yeah and let's say cuatro penta octa, whatever you like
in there.
So these are the only two features regarding to our trainer we cannot do right now, but all of the
rest over here, this is possible so we can already patch this application to have infinitive lives,
to be invisible, to have coin reign and stuff like this.
Amazing, right?
Absolutely.
In this video over here we are taking now together and look into high score our lives.
One of them, I am not sure which one of them, but we will have look into this one.
We will do some exercise, some practicing together.
And afterwards you can reverse engineer this application regarding to all the other features in case
if you stack at a certain point, I will provide you an external file so that you can have a look into
this one.
And yeah, there will be all those class names, but not which class is regarding to which feature over
here.
All right.
Okay, let's do this.
Let's switch back to the Ubuntu VM and then we have look into high our lives.
I'm still not sure which one we are going to look at.
Let's go.
All right.
So here we are back at our Ubuntu VM and now let's have a look into our space planning application.
I guess within this whole Freedom chapter, we didn't have a look into this one right now.
Therefore let's do this now together in case if you directly jumped into the Freedom chapter.
So within apps we are having our space ping application and space ping.
And this one over here.
I guess that's the original version.
Yes.
So we installed this one.
And I also attach this in the section over here that you can download it.
I have downloaded it from the App Store, so you can also have look into this one.
But to make sure that we are all on the same version, I would recommend using this one over here.
All right.
Okay.
So now let's get back our smartphone and let's see.
Yeah, we have the space ping application and let's open this one.
There we have it start.
And then in case if you do not know the scale.
Make yourself please familiar with this one.
So have some fun.
Play around with this one I guess up to level five and then you should have seen most of the game already.
There is much insight here.
We've got our player, we've got some aliens and if we get hit, then we lose a life.
In case if you're having a shield, we are good and here we can see those coins.
Gives us some features of, for example, this double shot.
Okay.
There are even more coins in this one over here.
I guess this is life up there.
We have it.
And then there's another coin which is green, which gives us some shield.
This is the.
The whole space application.
There we have it.
We've got some good range over here.
Now we have to see.
All right.
Beside this post, you have seen everything right now.
Okay, let's finish this one.
This application is working.
Seems to be the original one.
Now, let's have a look into this one.
Let's try the screen and see the app's space pane.
And let's have a look into this one in case if you're working on this more, for example, if you want
to also write your trade now on your own or identify all these other features, I recommend you to decompile
this and yeah, opening it in another tool, for example, eclipse or what else we have next to chart.
Yes, next to chart.
Because working with greater projects, I guess it's easier on them.
But for now we stick to this one.
So here we have it.
We've got a bunch of stuff in here and yes, within the manifest.
Let's see.
And we can see we've got this by bright permission and only one activity.
Yes.
This is all.
Okay.
Now, let's say we want to manipulate something and let's open this up once again.
If we click on start, then we can see we've got in high school and we've got some lives and let's focus
on the lives.
Yeah, let's play around with these lives.
And then you can perform all the rest on your own.
The high score, invincible, invisible.
Things like this.
All right.
Okay.
So we close this once again.
Okay.
So now we're looking for the player lives and therefore we are using this search and we only activate
this code field over here.
We might have to wait a little bit until this whole application has been compiled.
Okay.
So I guess now it has been finished loading and therefore we are now searching for lives and here we
have it.
We've gotten player class and this one has some lives.
All right.
And let's have a look into this one.
So here we have it and we can see the first one.
This is the default life's value and this one is a static field.
Amazing.
And this will be our first attempt because working or accessing static fields is absolutely easy.
Therefore, we will try if this one works out in case.
If this one doesn't work, we can see we've got this one over here.
Public in lifes equal five.
This one is now an instance field.
So this field is bound to an existing object if we go back into our space application.
Here we have it.
If you now click start, then we can see this one over here.
This is now our player instance.
And this player instance has been lives set to five.
So in case if the static approach with the static field doesn't work, we have to scan the whole application
memory.
And we have to identify our player instance and then we can use this instance to access this live field
over here.
All right.
So let's close this one.
This is our instance field.
Let's have a look further.
Okay.
Overwriting or hooking methods seems to be no approach right now because there is no method which is
modifying this slice field over here.
But this application must have such an method because if we getting hit, we can see our lives are being
decreased.
So in case if this attempt fails and this attempt fails.
And let me close this application real quick.
If both of them fail, then we can search for this method, which is playing around with this lives.
All right.
Okay.
Nice.
Let's do this approach first.
We are hooking this or we are modifying this static field.
Let's get into our Visual Studio code, and then we are creating a new file and we put this output on
the right.
Okay.
We are also selecting JavaScript and now first approach is regarding to the static field.
We do not know if this one works out.
We would have to reverse this application further and further to identify what happens with these default
lives over here.
But hooking it with Rita, it doesn't take that much time.
So we can simply do the try an error approach.
All right.
Let me close this one.
Now, let's see what we need to do.
The first thing is, we need to tell Frieda.
Please attach to the shader.
And this is what this JavaScript form is.
And then we are having here our anonymous function in this one over here.
And this is now where our first attempt will happen to work or modify and static value.
We have to get the last reference of this static value.
So the class reference in this case is the player class.
So player class reference equals use.
Here we are getting the class reference.
So that's the package name.
Dot player.
Now we're having the class reference and then we can simply access the aesthetic field.
For example, we can print it out.
I guess that's the best approach.
First, let's print it out and then we will modify it.
Okay.
So we are using send and then let's see.
Default lives this equal.
Then we're having this class reference.
Not our field.
Default.
Life's not value.
Okay.
And then we are modifying this one.
So we set this now to.
999.
All right.
Let's try out if this script over here works.
So, ADB Shell, we need to start our freedom server, root privileges and then data local temp and
then we starting our Freedom server.
And this one is now running in the background of the smartphone.
Now let's connect to this process and.
Yeah.
Let's start this application with Frida and already attach our script to this one, because I'm not
sure when this one here gets executed and we definitely do not want to miss this one.
If the application has been started and we are attaching later to this one, then we might miss this
point over here.
All right.
Okay.
So we are copying this and I'm also getting back the screen copy and there we have it.
And now let's see.
Free you.
We need the package name.
The first of this application.
So within the Android manifest.
Here we have it.
And now we also want to start this application.
I seem to have legs regarding to all these Java applications.
Okay.
So here we can see.
Yes, green copy has been terminated once again.
So I guess this is a good idea to take this space planning application to decompile it and load it in
eclipse.
This is not that resource intensive like excuse over here.
But for now, let's try this first hook at least.
So we are closing this one.
Okay.
And then we are opening our screen copy once again.
All right.
Do I have it still in my clipboard?
Yes.
Okay.
So now we tell Frieda sorry for all this trouble right now.
We are telling Frieda to attach via ADB to the smartphone with the EFF.
We are telling Frieda to start this application with this package identifier.
And now, yeah, we need to start it in this way.
Now we can see Frida starting this application and holding it afterwards.
We can now apply our script.
And this one.
And we can now resume this one.
All right.
If this code is being executed or triggered, we should see our debug output over here.
Let's see.
There we have it.
Default lives has been set to five nights, and this means right now our default lives value is being
set to 99.
Let's simply copy paste this once again over here.
That's exit readout and started once again.
We are printing out the new default lives value afterwards.
That's a better approach.
Okay, now we can resume.
Here we have it.
Now our new default list value is being set to 999.
Let's see if we're having these many lives right now and start, okay, in the UI, this might not be
updated right now, so we cannot be sure until we get it and we are only having four lives.
Therefore, unfortunately, this approach doesn't work.
Okay.
No big deal.
We can close this one and we can go for the second approach.
We can now scan the application memory for player objects and then we can access this player dot lives
value.
All right.
Okay.
So first, let's open this application once again.
We are searching once again for lives and we find it over here.
We put this on the right and this one on the left.
Okay.
First approach is regarding to static field does not work.
Nevertheless, let's keep this code over here.
All right, let's do the scanning approach.
So once again, we are working with Java code, so we need our Java perform and then our anonymous function.
This time we are not using Java use.
We are using Java shoes because we do not want to have in class reference.
We want to scan this memory.
So Java thought shoes we are having now two parameters in there.
The first one is regarding to the class name.
And the second one is regarding to the callbacks.
And this one over here is the class reference where the memory gets searched for.
So we are searching the whole memory of this application for this given class.
In our case, it's this one over here.
Dot player, the player class.
And in case if we are finding one, we are now having our two callbacks over here.
I double click into this one and then I applied these curly brackets and now I hit enter.
That's the easiest way to not mess up all these all these brackets over here.
All right.
The first callback is our match callback and TV defining now our anonymous function.
In case if you are finding an instance.
So this is an parameter that's been provided to this callback.
Let's comment this code directly searching the memory for instances of the player class.
Here's our on match callback in case if we find one, found one, find one.
And now let's see.
And first, we want to have an debug output and found player instance.
I mean, there should be only one available right now.
So instance.
And then let's also print out the lives.
Player dot lives is.
And then we can access these player lives over here simply by using instance, dot lives, dot value.
I mean, we can also name this, for example, player.
I guess this might be a little bit easier to read then.
And then we are changing this one player dot livestock value is now equals to 999,999.
And this is our first call back.
The next one will be separated with one comma and now we're having our on complete.
So on complete doesn't have a parameter or it's an anonymous function.
Sorry, no brackets over here.
Okay.
And now we can.
Yeah, we can print out some statement that we are done finishing scanning because then we know, okay,
this script has been run through the whole memory.
So I am done scanning the app memory for player instances.
Okay.
This is our second script.
Let's try this approach right now.
So we are taking this one.
Once again, we are starting screen copy.
And with our freedom there, we have our freedom.
Let me organise this real quick.
Och, och.
Now we are using freedom once again and we are applying our script and then you will see some difference
in there.
So we are now applying this one and then we're using resume and here we can see.
We do not have any player object right now because this player object has not been created.
So if we are searching for instances, the best idea is to start this application first and go into
this application and now are searching for this instance, because now we can be sure that this one
over here exists.
All right.
Let me clean this up on the left that we've got some.
This mechanic's insane.
That we've got some space over here.
Now we are using this script once again.
So I paste it in once again.
And here we have it.
Nice and found player instance and this one over here.
And this has been has.
Whoops.
Sorry I got too excited about this one.
And this one has player lives being said to five amazing no to 9999.
I even didn't realize this that the UI has already been changed.
Okay, this is freaking awesome.
This is how we can simply access those player lives and manipulating them.
Let's see if these are really our player lives.
Yes, we can see they are decreasing.
I even didn't realize that the UI has been already updated regarding to this one.
Okay.
Awesome.
Let's recap this a little bit.
We have scanned or we have reversed our code regarding to the player lives.
We have seen this in default list value over here regarding to static field.
But this one over here.
But yeah, manipulating this one doesn't have an effect on this application, so it seems to be not
used in our app.
Absolutely no problem.
We did modify it.
It didn't work.
We have to go for a different approach.
The second approach was scanning the whole application memory regarding to this player object over here,
and this one has been found in this instance.
There we have it.
Then we have simply print it out the actual player lives, which is being set to five and then we have
manipulated them afterwards and that's all.
This is how we could manipulate the lives of this player instance over here and doing this approach
in this one.
Regarding to instances, it helps you a lot.
So all these functionalities we have seen earlier on the slides are just regarding to working with instances
over here.
It's a little bit more complicated at the beginning, but if you if you keep setting it up over and
over again by yourself, the script over here, you will learn how everything works.
And it's not a big deal anymore if you do this three or four times afterwards.
So you get used to this syntax over here.
All right.
In the next video, we will go through all the other features.
Therefore, please feel free to reverse engineer this application and play around with this one.
Have a look into this on your own.
Try to identify where are those coins?
How can we spawn them?
Invisible, invisible things like this.
In case if you are having the same problems like me that yeah, change excuse and screen copy and things
like this do not work together that well then simply just go for the eclipse approach.
They combine this application with shady x and have a look all loaded into an eclipse project.
This will work a lot better.
All right.
Okay, so now please have some fun.
Play around with this.
And then I'm looking forward to see you in the next section.