Welcome back, guys.
I hope you had a lot of fun.
Now we are taking a look into this one together.
So in case if you do not want to get any spoiler.
Yeah, just skip this video and move on with the next one.
This is just the solution regarding to hooking all these methods.
For example, make the player invisible, invincible, raining coins, stuff like this.
All right.
Okay, guys.
So I have finished recording this video right now.
And, yeah, this was a lot of fun, but this video has become pretty long.
So let me introduce you what's happening over here so that you can fast forward or directly jump to
an interesting point.
So the first part is about the high score manipulation.
And this one was a little bit tricky.
I mean, we have some easy approaches which are absolutely no problem.
But I also want to refresh existing knowledge and this was a little bit tricky.
We have met some certain conditions where those values have been overridden once again and this part
has become a little bit longer, but I guess it will learn a lot of things in there.
So therefore I would recommend watching it afterwards.
We will rush through all the other things, so we will manipulate all these other classes and for example,
we will make the player invincible, invisible.
We will get rid of this blocking state and much more.
I will also provide you some comments underneath this video that you can directly jump to the section
which you are interested in.
I will keep all of them in this video over here because I do not want to split them up to create six
or seven additional videos.
Okay.
And in case if you are familiar with freedom, then you might want to skip this whole video because
this video over here might not provide some additional information for people who are already familiar
with freedom.
Therefore, you can easily move on with the next section.
You do not miss anything right now.
All right.
Okay.
So for now, let's have some fun.
And yet you can lean back and simply watch this video maybe by doing some other stuff.
Okay, so therefore, let's go.
All right.
So here we are back in the Ubuntu VM and we have already seen shady x cool screen copy and maybe a bunch
of other Java applications might interfere with the existing memory.
So we might run out of memory and then we will have some problems.
Therefore, we are now doing a different approach.
We will take this application, we will decompile it and then we will load this project into Eclipse.
This is way more resource efficient, even if it doesn't sound like it would be, but it definitely
is.
And by doing this, we can keep all the rest opened.
All right.
So therefore, let's have a look into this one.
Within apps we've got here our space planning application and this one over here.
Now we are copying this and we are creating a new directory.
So, oh, here we can see we have already done this in the past with you.
Nevertheless, let's do this once again.
So we delete this one over here and we are creating a new one and space ping underscore shade.
All right.
Now we are opening here a new terminal and we are using the command line of trade X and this one over
here with the help parameter maybe.
Okay.
So what do we need to do?
We need to provide some options.
I guess that's the only one output directory and then the input file OC.
So it's options input file.
And this means we are using the DX our input file and I guess we have to provide the output file afterwards.
So this should work right now.
Let's see.
At least the program is doing something.
And let's check this up, if it's correct.
Yes.
So here you can see we are creating now a new output directory and this contains now all the decompile
code.
Here are the resources and here are the sources.
We are now only interested in the sources because we do not care about these resource files over here.
And for example, these images and things like this.
We can also see finish with errors.
Count two, we have observed this whole DE compilation process with X in an earlier video.
So there we have seen how we can apply certain features to play around with the obfuscation or for example.
Yeah, to print out some, some code.
This one over here.
If X is not being able to decompile a certain method, then this one would be printed out.
In case if you have missed this and this one sounds interesting to you, and then please have a look
into the shady video, which is, I guess under tools.
Yes, there should be this video right now.
Okay.
Back to this one over here.
We are now creating a new Eclipse project and then we are loading the sources and this one into our
project.
Okay, so let's do this.
Oh, no.
Terminal.
I guess Eclipse can be started over here and there we have it.
There we have it and we can see the last time we have played around with Eclipse was regarding to the
certificate pinup.
So this one over here, this can be simply deleted.
Yes.
I guess that's not required anymore.
Okay.
Now we are creating a new Java project.
The project name is our space ping application.
The rest will be set to default.
That's the model name.
And here we have now our sources.
We can delete this one right now.
This is not longer required and we are now taking our sources and we are simply dragging them into this
newly created project.
Copy files and folders.
And this might take a while.
Let's see.
This is pretty fast.
It doesn't take that long.
Now, all these sources will be created, and we can then use research and work on this project over
here to reverse engineer this application and find everything we are interested in.
All right.
It has been already loaded.
Nice.
So let's get back to our list and then let's see what we have to do.
So this one is our list.
Lives has been already done.
Now let's have a look into the high school.
Therefore, we simply search for this one search.
We are searching over here and we are searching not for certificate pinning.
We are searching for high school.
Let's see about these parameters.
Yes, workspace.
Okay.
Please make sure that case sensitive is not being checked because otherwise, if high school is written
differently, for example, this one or in this way, then it won't be found.
All right, so we hit the search button, and here we have a bunch of results.
We can also practice this resort window out here.
Then it's a little bit easier to see, and I like to keep it on the boat in this way.
And now we can simply double click on this one.
So with a profile, we've got this in high school.
Let's see.
This sounds absolutely promising.
So we've got an inch high score equals none.
Then we've got last played level.
We've got functions.
Get high score set.
High score.
Sorry, I keep the mouse on the right set if new high score.
So if we have beaten the high score, get last level played and set last played.
So I mean, it feels like it's hard to find an option where we cannot modify this high score over here.
In our case, we have seen in the last video how to manipulate this field.
Now let's do the instance approach.
So we are using this method and set high score this one over here and then we are providing a new value
as parameter.
And here to change this, this high score of this instance field over here, then we have the different
approach.
And by keep doing this over and over again, you will have, in summary of all possibilities or maybe
barely all possibilities to hook certain methods or Android instances over here.
All right, so now let's do this.
Therefore, we are opening this old studio code.
And we are creating a new fight.
Then we switch to JavaScript.
And this time we directly saved is file.
So within our space pictured x, we are now creating a new directory.
So we simply hit this icon over here and we name this freedom and rename this Now Hook High School.
Yes.
OC put this on the left and our eclipse on the right.
Okay, so now we have all our windows being organized.
Nice.
By taking a look at this profile class, it's hard to find a way that does not work.
So here we have all those opportunities available for us.
For example, we've got this instance Field High School, so we could scan the application memory,
identifying an existing instance and then changing this high score field over here.
We could also use this instance to call method.
For example, this one over here said High score.
And last but not least, there's an approach where we where we haven't looked in for a while hooking
a method and providing a new implementation.
And this is where we did start with three over here, and this one should also work.
So if we look, for example, this set high score function, then we can provide a new high score in
there.
So all of these three approaches should work and we go through all of them.
Right now we are not doing this for all, but over here, I guess it's nice to see some recap of what
we have learned and which possibilities we have.
All right.
Okay.
So therefore, we start with the instance if you take a look at our application.
So first, maybe, maybe let's reinstall this application to make sure that we are working with the
original one.
Okay.
ADB install dash.
Ah, this will overwrite the existing version.
And now let's have this on the screen.
Can we put this on the left?
And now let's start this application.
Okay.
So here we are having our space ping application.
If we click start, then we can see we've gotten a high score from 750.
If we if you're shooting like this, then you can see our score increases until we are reaching an score
which is higher than this one over here, then we're having a new high score.
All right.
Our approach right now is the following maybe not getting hit.
So let's create some space over here.
There we go.
Okay.
Now the approach is the following.
We are scanning the application memory and then we are trying to find this profile instance.
I guess there should be only one available unless we have multiple players with multiple high scores.
But this should not be the case over here.
Here we are having one player and one high score.
Therefore, we should have one profile instance.
All right.
If you have found this profile instance, we could simply go for the approach changing this instance
field this one over here, high score.
But this is something we have done in the last video.
Therefore, this time we do it a little bit different that you see more options.
Right now we are going for the instance method, so we are taking our instance and then we are calling
actively the set high score method on this instance and as in parameter, we are providing now our new
high score value.
This should work right now and therefore let's have look, let's start coding this in freedom.
Okay?
So the first thing we need to do is we need to tell Frieda to attach to the CBM because this one over
here is still Java code.
Therefore we need our connection to the Java virtual machine.
We can do this by using Java plot perform as in parameter.
We are providing our anonymous function and this is now our code section.
If you want to scan an application memory regarding to an instance, we have to use Java dot choose.
So I'm scanning the memory for an existing profile instance and Java Dot loops in Java dot choose the
first parameter.
This is our class name or the class reference and the second one is our callback or these callbacks.
In this case OC the class reference.
And this is our profile class over here because we want to find all profile instances.
This is our reference.
So we take this package name,
this isn't string.
So package name dot and then the class name.
Okay, regarding to the callbacks, let's add this s over here.
Okay, so what I do is I double click into this and then I'm providing those curly brackets.
Now I hit enter and then I do not mess up all these brackets over here.
Okay, so here we are having now two callbacks.
We've got the unmatched callback.
If an instance has been found and we've got another callback, the complete callback, if the memory
scanning has been finished.
Okay, the unmatched callback.
We need to provide a new anonymous function and this one has now the instance as the parameter.
Afterwards we are setting and comma because this is how these two callbacks are being connected together.
And here we are not providing our own complete callback, also with an anonymous function, but this
time no parameter.
Och in the UN complete.
We can simply write it in that the memory scanning has been finished.
So we are printing out this debug statement.
And scanning of the memory regarding to the profile instances has been finished.
Then we are done with the complete part, and now let's have a look into the unmatched function.
So here we are, getting back our instance.
What do we want to do?
We want to take this instance and we want to actively call this method.
Okay.
And we can simply do this by using our instance.
We can also rename this, I guess then it's a little bit easier.
So let's rename this to to profile, for example.
Okay.
Now we can use profile, dot set, high score and we can set a new high score.
And this one, for example.
All right.
We have to stay into the integer value because otherwise we we will create an integer overflow.
Okay.
So this is the script in a nutshell.
But to be honest, I do not like it as much.
For example, we've got this typo over here, but this was not the point I was talking about.
I like to observe what's happening, so let's also add some additional debug outputs.
For example, over here, let's print out that an instance has been found.
Instance or let's call it correct.
A profile instance has been found.
Then we are providing our profile over here.
That's the instance.
Maybe.
Let's also write it here.
So our parameter is the instance that has been found and also print out the actual value or the current
value.
So, so at the moment, the high score is.
And now let's see.
In profile.
Dot.
Let's call this method.
Simply get high score.
Get high score.
Yes.
Okay.
And this one?
Yeah.
It's returning an integer.
And regarding to the type, this should work.
And now we are setting this high score to this value.
Now we have a little bit more of a debug output so we can see if this one gets triggered or not.
And we can also see some values over here.
All right, perfect.
Now, let's get our start our freedom server on our smartphone and then connect to this process.
So first, we are connecting to our smartphone.
Then we get root privileges and then we are starting our free server.
Therefore, we have to switch to data local temp and started over here.
All right.
Free.
The server is running in the background.
Now let's get back the smartphone.
Here we have it.
And now let's also start this application with freedom.
So we can use a free data issue and then the package name the garbage space.
I guess this was the package name.
If you want to start this application with reader, we have to add F to force this launch.
And we also do not want to directly apply our patch because if we are applying our patch directly,
maybe let's do this.
So it is in this way.
Then you can see what's happening.
So now the application is being started by Frieda, but it has been paused.
So we have a black screen.
Let's keep this in foreground.
And now let's do this.
And here we can see nothing happened.
And the reason for this is no instance has been found right now because the application has not been
started.
But this is absolutely no problem.
They can simply resume this application and then we can apply our script once again at this stage right
now, maybe let me organize these windows real quick.
So I guess now it's a little bit better.
So also at this stage right now, we can see, okay, message scanning of the memory regarding to profile
instances has been finished if we are now executing our script once again.
We can see argument does not match any of overload.
INT oh.
And let's see, we've gotten profile incidents already at this state.
Oh, that's pretty amazing.
So the application even doesn't have started right now.
But we've got this, we've got this instance and we can see we've got an overload method.
So set high score.
Let's see.
Can, said high school.
We only have one set high school in there and we are calling it over here.
Okay.
So let's see this arrow.
It means we are not having an overload end in there.
And this might be the case if this value has been chosen to latch.
So let's see here.
We've got three.
Three.
Yes, we might be out of this integer value range and therefore it might not be recognised as an integer
value and therefore we are getting this over this overload error.
So let's decrease this value a little bit.
I got a little bit too far on this one.
Okay, let's try it once again.
And here we can see now the application crashes.
And this is exactly what I was talking about at the end of the last video.
If we are getting this error over here in this one, we can see this is not right now, two in two in
broken free the script.
And this one is regarding to freedom, which is not compatible to this device right now.
So as already mentioned, Frida is absolutely amazing and it's ridiculous how much platform support
is being provided for Frida.
But unfortunately it can happen that we are using a device which has some custom or proprietary libraries
that are not being supported by the FRIDA framework right now.
Therefore, if we're getting errors like this, if we are getting those registers being printed out,
the best and easiest way to figure out if it's a problem regarding to our Frida script or in Frida compatibility
regarding to our smartphone is very long sentence to try this Frida script out on virtual machine.
If it also fails there, we cannot be 100% sure if it's an error within our script or regarding to incompatibility,
often in certain library in our application.
But if the script works on our virtual machine, then we can be sure that it's not an issue within our
script.
So therefore let's try this out over here and let's disconnect the smartphone.
And now let's start up the virtual machine and we're using the same application and the same Frida script
on the virtual machine.
All right.
Okay.
And now let's start this application once again with Frida.
So we are using Frida, the issue space application.
We once again apply our script, which will not have any effect of this application.
All right.
We make this a little bit larger, and now we can resume this threat.
We can see scanning of the memory regarding to the profile instances has been finished, but no data
has been found.
We have seen before that the profile instance is already available right now in this loading screen.
So we could start this application or we could try it over here and therefore I go into my Frida terminal
over here and I'm using the upper arrow key once again.
Now I switch back to the script and now I'm executing it once again in 3 to 1.
Let's go.
And here we can see profile instance has been found.
This is our profile instance address.
At the moment the high score is zero because we have in fresh install over here scanning of the memory
regarding to this profile instance has been finished.
All right.
So after this one here, we didn't print out an additional debug statement.
Therefore, it's pretty likely the case that we have now changed the high score to this value.
Let's see if we click on start.
There we have it.
Nice.
So the high score has been changed.
All right.
So now we know our free to script over here works perfectly.
So there is no error in there.
The error we got on our device in this one over here was unfortunately regarding to Frida interacting
with this device.
So maybe regarding to a library or something else, architecture.
I mean, these Android smartphones have so many different manufacturers and these many proprietary libraries
that it would be absolutely ridiculous to provide in support of all.
So sometimes it could crash.
That's pretty unfortunate.
But if you write this author, I will do this afterwards.
Then he will take a look into this and I'm pretty sure that he will apply and patch for this.
Alrighty.
Okay.
Amazing.
Now let's have a look into this class method hooking approach because we haven't done this quite a while.
Therefore, let's close this one over here.
And this one.
And yeah, let's save this on this one over here on the first attempt.
Attempt one, we'll work it.
Okay, maybe let's comment this out over here.
Otherwise, it's a little bit disturbing.
There we have it.
So what we're doing right now is the following.
The JVM and this one over here is holding all these classes and methods.
And one of them is this one, for example, the get high score method.
And this one has no parameter, but it's returning the current high score over here with an integer.
This method is being stored in each EVM and every time the application is accessing this method.
It's using this one over here.
By overriding it, we will now define a new implementation.
So instead of this one return something we can say, for example, return 9000 and more.
All right.
And this is our approach regarding to hooking a method.
So we have done this at the beginning of our free journey, but we haven't used it quite a while.
Therefore, let's refresh this.
All right.
So the things we need to do first, once again, we need to tell Frieda to connect to the JVM.
We can do this with our JavaScript form, and then you're providing an anonymous function in there.
Och, he has no our code.
And this one, this is our attempt to hooking the get high score function.
The only downside of this approach is we have to wait until this application is triggering this method
so we cannot actively trigger it.
I mean, we could have created a new instance, but we have already seen that this one does not work
out in our memory.
There's only one profile instance, and if we are creating a new one, then we are having a second one
with a new high score.
But this doesn't affect this application at all.
So within our game and this one over here, we are having only one high score, one profile instance.
If we create a new one find, we are having a second high score, but this one is not being affected
or bound to this game over here.
It's useless in the memory.
All right.
Okay.
So creating a new instance doesn't make much sense.
We have to wait until this method gets triggered.
And, yeah, that's the downside of working or hooking and method over here.
But maybe this method gets triggered when we change the level or things like this, and this would be
even good enough for us as an attacker.
Alrighty.
Okay then let's go into this.
So within our code, the first thing we need to do is we need to get the reference in to the profile
class.
So here we are having our reference.
Let's put this on the right profile reference.
And this one is within in this package.
Dot and then the class name.
All right.
Now we want to take this class reference.
Whoops.
Once is enough, and we want to get this method, get high score.
And now we want to define a new implementation for this method.
We are now providing our function here.
This is not a function that's being here.
It's being used to override this method.
And in here, let's see.
I mean, the only thing we need to do is we're having zero parameters and we've gotten a return value
of an integer.
So the only thing we can do over here is returning another integer value.
And this is exactly what we want to have overwrite the return value.
So here we are returning.
Now the value let's see, let's make this a little bit more neat and this value right now.
So what I like to have over here is having some kind of debug output that we know when this method is
being triggered and therefore let's do this.
So within the feedback output, we can also print out the current high score.
But I guess then we have done everything in this method.
So let's see and get high score has been called with the return value.
And here we are now calling the original method this get high school.
And this is our method.
This one is returning an integer and it's being directly converted to a string.
This is what's possible in JavaScript over here.
All right.
And this is all.
And let's finish the comments over here that we know what's going on.
Reference to the profile class and over here
overwriting the get high score method and printing out the current high score.
And here we are overwriting the return value.
Okay, so now let's take this script and let's start our reader here once again.
Yes.
With the with the dash F operator so that the application gets launched.
We do not see it.
So we also need our screen copy back.
Here we have it.
We've got the black screen because the application has been paused.
We are now providing our script to this free terminal and now we are using resume to move on with the
application.
And this will change this blank to the to the app.
And then let's see, here's our script.
Make this a little bit smaller.
Okay.
I'm hitting resume in three, two, one.
Okay.
Application resumes.
And let's see.
The method has not been called so far.
Otherwise we would have seen this over here.
Let's click start.
And now.
Oh, nice.
We can see this method is being called quite a lot.
Yes, it's funny.
Every time we get a new score, we are increasing the the current high score and yeah, that's unfortunate.
We can see.
We are overriding it with the current high score.
So let me think about what's happening over here.
Okay.
So I've got an idea of what's happening, but I'm not 100% sure about this one.
We will verify it afterwards.
So we are overriding the get high score method.
This one over here at the beginning.
If we are starting this game, we are having this huge number in there, absolutely amazing.
But then after a certain amount of time, we are updating this view with the actual high score and I
guess this actual high score is being stored or saved anywhere.
So this one might not affect the high score at all, maybe just the display.
Okay.
So how can we fix this?
We could hook this one or maybe this one.
This one would be even better overriding set if new high score will make sure that our high score will
be set on top all the time.
So this is where the high score gets updated.
And if you're hooking this method and taking control of this, then yeah, the actual high score cannot
affect our game anymore.
We have full control over the new high score or how it's being set, and therefore this is the best
approach to hook it over here.
I guess right now let's figure this out.
So this one was a nice attempt, but unfortunately it's not working.
Then let's see.
Attempt three hooking set if new high score.
Speedrun.
Okay.
So now let's see.
Hmm.
And this one is returning a boolean, and it takes this parameter.
And sets it if this one is larger than the last one.
Okay.
So what we need to do is the following.
We need to call this method once again and then we are overwriting the parameter.
Yes, exactly.
So.
We are doing the following.
So we are doing the following.
Right now we hook into this method and then we have here our newly set high score.
We cannot manipulate this one right now, and therefore we have to call this method once again in their
method, and then we can take control over this parameter.
All right.
Maybe not.
But let me show you what I mean.
And then I guess it's a little bit more clear.
Okay.
So we need to call this method once again.
This said, if new high school OC and TPN are providing our parameter so this value over here, for
example, let's change this to different number.
Let's do it this way.
Then we can be sure that this one is being called.
All right.
So now we are calling this method once again, but this time we have control over this parameter that's
been used to set a new score in there, and this one is returning back in Boolean.
So we need to take care about this one.
Let's see if new high score is being set.
We are returning true.
Otherwise false.
Yes.
So we are returning.
True.
I'm not sure if this even doesn't matter right now, but we are setting a new high so therefore we are
returning.
True.
Okay.
This should work right now.
I did forget something.
We want to see what's happening.
So therefore, let's print it out.
Okay.
So set.
If new high school has been called, shall you print out some parameters?
Let's see.
We can print out the.
The high score parameter.
Okay.
And that's all.
Yeah.
Let's do this.
Plus.
Yes.
So now we can observe this.
All right, let's open free to inserting the script, resuming with the application.
Put them in foreground.
Okay.
So I guess the screen copy has lost the connection or something else.
And let's do it once again.
And there we have it.
It was in the background.
But yeah, I mean, black screen is the same, like hooking this application.
Let's do it once again.
Clear.
So let's restart this application.
Now we are applying our script and now we proceed with this app.
Okay, now we're having this black screen, but this time it's intended for assume.
Let's put out our script.
Okay.
Set of new high school has not been called yet.
Let's see.
There we go.
All right.
We can see it has been set over here and we can see the the current high school has been set to zero.
Let's see.
Okay.
Yes.
The application is overriding or tries to override the current high score.
This one over here.
But afterwards, we keep overwriting it once again with this value.
So therefore, the application has no chance to influence this high score anymore.
This means if we now close this application.
The Frida script gets disconnected, so we are not attached anymore.
Let's open this application and see if the high school gets saved.
Level four.
There we have it.
But we are not sure right now.
Okay, now we can be sure.
Yes.
So we are also not having an Frida script attached anymore.
All right.
To be honest, I didn't expect this much amount of effort over here to simply overwriting this with
some bunch of different methods.
But, I mean, it's nice that we have seen it over here.
So so now we know at least two approaches to influence this method.
I guess the approach regarding to the instance field, this should also work.
You can try this out, but I'm pretty sure this is the easiest one and the most reliable one.
Nevertheless, you have now three possibilities.
Okay.
All right.
I guess this video is already a little bit long, so therefore I'm doing some kind of speedrun regarding
to all the other functionalities.
Let's have a look back on the slides.
What's left over here?
Yeah.
So now.
Wow, well done.
We've got lives and high school.
There's only rapid fire, invisible rain, invincible and new player.
New player is not something we cannot do right now, but the rest.
So we've got four methods left.
Nevertheless, let's do this over here.
So if this is not boring for you, absolutely no problem.
Feel free to pause or end this video right now and move on with the next one.
In case if you want to see some practicing regarding to this one, then yeah, you are welcome to stay
and then we will do some speedrun.
So I try to make this in less than 20 or 30 minutes regarding to all the other things over here.
Alrighty, let's try this.
Okay.
So get back on the ubuntu vm.
I would say modifying the high score has escalated really quickly.
I mean, there are easy approaches, for example, modifying the instance field and this one over here
or simply calling an instance method this or this.
However, for me right now it was important to also refresh our old knowledge.
For example, hooking in method like we have done it over here.
All right.
Okay.
For the rest right now, we do some kind of speedrun and therefore let's start directly over here.
So let's see.
Okay.
So the next one is about our rapid fire mode and we have already seen this in our smiley approach.
So there there wasn't value time to shoot.
And if this value is being set to low, for example, to zero, then we have the ability to always shoot.
Let's find this once again.
So we are using the search function in this one and then let's see in time to shoot.
I guess it was this way.
Yes.
Player input system.
Here we have it.
We are now in the class player input system and here we have this instance field time to shoot.
Let's see whether this one is being used.
So I'm hitting control f and then time to shoot.
Let's see.
Find.
And here we have it.
And this is our let's see fire state.
Yes.
So we get into the allowed state if this shoot and this time to shoot, this one here is less than equal
zero.
Okay.
And this route needs to be set to a boolean value.
True.
Okay.
So for me right now, it looks like if we are keeping this one set to zero, then we do not get blocked.
I mean, here it's being increased.
This should make sure that it's being blocked after having or performed and shot.
So, yes, this should work out right now.
What we are doing is the following.
We will overwrite this value all the time to be zero.
So we are holding this value down to zero.
Therefore, we are scanning the memory of this application, finding this player input instance, finding
this field over here.
And then we we write it in a loop that it's being set down to zero.
All right.
Okay.
Therefore, let's have a look.
So we are opening a new file.
And this one, let's save this.
And this is now Rapid Fire Chase.
Okay, let's do this once again.
Java code, Java Dot, perform plus instance, and now let's simply access this field.
Where do we have it here?
This is a floating field.
So now accessing the instance field.
Time to shoot.
So instance dot time to shoot dot value equals zero.
Now we need to make sure that this value is being set to zero all the time.
Therefore, we're putting this now in an y loop and then y true loop.
So this will permanently hold this value down to zero.
And this might be not the cleanest approach.
But if it works and if you do not have some major downsides regarding to lags or things like this,
it would be okay for me, also for you.
Okay, then we can do it.
Okay.
So the thing we have to do is and simply putting our while, I guess it's I hope it's in JavaScript
this way, wild fruit and then we're putting this in.
Let's see if this works.
So we need to make our connection to our VM.
Yes.
This one is not available anymore.
I need to restart it.
Okay.
I guess it's now available.
Let's see.
Yes.
Now we also need to restart our free server.
So within data logger ten.
Let's restart this really quick.
Here we have it.
And now let's get our free running.
So free to dash u f this one.
Yes.
Okay.
I mean, in this case, we can resume with this application because this instance won't be available
right now.
Okay.
So here we have our space application that's prepared.
It's real quick because if I'm too bad, I might die too quick.
So level four.
Let's see.
Yes.
So we might not get an output anymore because we are we are in the Y loop.
Okay.
That's unfortunately.
But let's see if our patch has been applied.
I didn't have the time to shoot right now.
So let's see.
There we go.
All right.
This is working.
Amazing.
I mean, we are blocking huge things in this application right now.
It's definitely not the best approach, but it's working.
Therefore, for me, it's absolutely fine.
So if we.
Let's close this one over here.
Let's see.
Okay.
We have now our output and we can see nice.
This value seems to be still being patched.
Amazing because we have disconnected our freedom.
So even better.
Okay.
So rapid fire mode also achieved.
Let's comment this over here real quick.
Okay.
Safe.
Done.
Next one.
Okay.
So the next one is invisible.
Sounds absolutely amazing.
How can we achieve this?
Well, if you take a close look into the application once again.
So here we have it.
Now, if you are getting hit, there are some 13 events that are course.
Let's see here.
We can see we are now having no player anymore and now it's being respond.
So this is exactly what we need to have to make our player invisible.
Let's find this event and therefore let's close this application first, because my fan is spinning
a little crazy right now.
Okay, so now let's find this event and let's get this in foreground.
And the things we have to look for is the player object got hit, so maybe collision or if you are losing
a life or if the player object dies.
So these are now the terms we are looking for.
I guess the best option is if you identifying when the player is losing a life because before or afterwards
this event will be triggered.
And therefore, let's have a look.
So.
No.
We do not want to save this one or two, not this one.
So we are searching for lives.
Minus.
Let's do it this way.
And we have one in the director system.
Let's see if this one is correct and player cleared.
Nice.
This one is exactly what we want to have.
I mean, not in the game, but over here.
This was really a lucky punch if I mean, the compiler is most of the time reducing and lives equals
life's minus one to this one.
So therefore that's really a good term to search.
Okay, amazing.
So let's see here we are having several player states.
This one here is that.
Okay.
Amazing.
I have found this method over here.
It's also named Z Player.
Invisible.
Okay, this one is an instance method.
So we simply have to get the instance in our memory and then call this method.
This should make the player invisible.
I yeah.
Okay.
This is.
This is amazing.
I've thought we have to go on to into another function, but having it in this way.
Absolutely amazing.
So let's do this.
We'll find you.
Find safe s and then invisible dark has.
Let's put this on the right.
And let's keep track set player in this set player invisible.
Let's make a note over here.
So this one is the package name.
Okay.
So now once again, Chava thought perform.
What's also nice is taking a look around in these classes.
I mean, I have now prepared some methods which I found pretty interesting, but this doesn't mean that
these are the only ones.
So maybe there are some additional stuff.
And if you play around with this one and if you write some amazing free scripts, I would love to have
some screenshots of your application that you have modified or maybe some short videos, let's say 10
seconds or things like this.
So if you would like to send me them, I would be very happy about this one, the progress we are making
together.
Alrighty.
Okay.
So back to this one class reference that.
Okay.
Free that dash you f.
Yes.
We are working again with an instance.
Therefore, let's apply this.
This won't work.
But nevertheless, let's do this.
Okay.
Yes.
Nothing in here.
And also, if we're resuming, we can see no no player instance has been found.
We are now already in level eight.
Amazing.
So let's see.
Okay.
I have to clean this on the left really quick, because otherwise I might be dead until we can try this
out.
So now let's see.
I am copy pasting it in once again.
And now in 3 to 1 stat cap activated.
There we go.
Okay, nice.
Let's see if we can still shoot.
Yes.
Amazing.
So we are now invisible.
Let's see if you are also invisible.
No.
We are losing a life and we can see this player explosion and this ready state.
Yes, we are not invincible, but invisible also not that bad.
Okay, so let's comment this real quick.
I will fast forward and then we will have a look into the next one.
Okay.
So here we have it.
Now let's have a look in.
Be invincible.
And I have seen something in here.
Cassette player Collider.
So this will make our player Collider.
Therefore, let's see if we have some counterpart regarding to this one.
All right.
This is exactly what we want to have.
So if one player got hit, we have some we have some immunity for a short amount of time.
This happens in many games.
So this is nice that we want to hook into.
And yeah, maybe we can keep the state active if we can keep it active, and then the player will be
invincible.
All right, let's do this.
So let's get back to this one.
We can save this one.
Now, let's close them.
We save this one, this one and this one.
And now we creating a new script.
Let's rename this file save as this is now invincible.
In short, perform an anonymous function.
Then let's see.
What do we have here?
In this one.
Once again, this is within the director system class.
Yes.
And here we can see this is the setup setup layout after the setup has loops, after the play has been
set up here for an short amount of time and collided.
Bill.
So let's get back.
Yes.
Once again, we need to fetch this director system instance.
We need to get this instance and then we need to apply the state permanently.
Okay.
So this is our plan right now.
Okay, so let's see.
This one here is method, an instance method.
Therefore, we once again need to find this directory system.
Instance, there's only one available.
We have seen this in the in the last approach and then we simply call this method on our instance.
I'm not sure if this one gets caught, so maybe we have to hold it down, like regarding to the time
to shoot instance field so within a wide loop or we simply have to call it once because then the original
state might not get restored.
We have to find this out.
Okay.
So therefore, let's see.
Yes.
Return value.
White And also here we are not providing any parameter.
Okay.
This is all nice.
Okay.
Let's see if this one works out.
Once again, we are starting Frida.
Once again, we are starting screen copy.
Och Frida has passed the application.
So we click resume.
Here we have this app.
No, let's get into level eight.
And I'm applying this one in two one.
Let's count from three.
I'm not sure what.
What was the reason right now?
Three, two, one.
Let's go.
All right.
We have seen or we have found.
So here we can see we have found and director system instance and yet we are done scanning this memory
and we can see we cannot get hit.
Yes.
And so the player has been said to uncollectable.
I guess that's the state.
Amazing.
Can we also fetch coins?
No.
Okay, we can now.
Oh, we can collide with aliens.
But we do not die.
No, we cannot collect.
Sorry, this was regarding to my pleasure.
All alright, now we cannot collide with anything.
This means we cannot pick up items.
But we can also not die.
I guess that's.
That's unfair.
Fair trade.
Regarding to a game like this.
Yes.
And we can also see we need to trigger it only once.
So we do not need to keep it in a wide loop because this player state has been now set out of here,
let's say, out of range.
So regarding to the single states, they will override each other afterwards.
But now we are out of this of this chain, and now this player state over here cannot be overridden
once again.
This is absolutely amazing and saves us a lot of resources in our free script.
All right.
This one has been also done.
Let's comment this over here in some speedrun and then let's see what's left.
Okay.
So here we have our script.
And now let's see what's next.
Okay.
Last but not least, I have skipped this suddenly.
But nevertheless, we are doing this right now.
This is our coin range.
So within our application regarding to a certain amount of times, there will be spawning some coins
and shield double shot and level up.
Now let's find this in the application code and let's see how we can trigger this by ourself.
So here we have this this app code.
We are searching now for let's call coin.
He'll be having a coin class.
I mean, this sounds absolutely promising.
Yes.
So here we have this glass.
But I cannot see a method that's that's creating a new coin.
So, I mean, we could hook the construct of this one and calling this one.
But it sounds a little bit complicated right now.
And let's have look into the other glasses over here.
In this one.
That's also not interesting.
No such window has been gone.
That's open this once again.
And I drag and drop this now at the bottom.
And then we were we were in this one over here.
Then we've got a screen, credit screen.
Here.
We can provide some credits to the authors thanks to this amazing application over here in the game
screen there we have two matches.
But this sounds promising corresponding system.
So let's double click on this one.
Oh, it's not working in this way in Eclipse.
So let's also search for this one.
Okay.
And then we've got this one.
Here we have the coin spawn website coin spotting system, the Java class.
Okay.
And let's see if we can use something in here.
There we go.
Here we are, having a method in dispense random coin.
So this one is using the math utils.
Random, and it's creating a new random number over here.
And based on this one, if this is less than 0.1 and float, we are getting this extra life shield and
double shot.
So now it might be interesting regarding to this one, if the number generator or the if case over here
is preferring in certain coin or if it's really equal, because here we are having this range and this
range with equal and so on.
Okay.
So it might be the case that the coin over here is being preferred, that this one occurs more often
than others.
However, we do not care about this one.
We can now see this one can be used to create a new coin.
So here we are having this entity factory creating coin.
We are having two parameters this world, which I guess is this application word, and then we've got
the coin type, extra life shield and double shot.
Yes.
And this one cannot be influenced by us right now.
I mean, it could be, but not within this method.
Over here, we're having no parameters and no return value.
So if you want to influence this one, we have to get or hook this over here.
Let's see.
Create coin.
Maybe this is.
This looks like an aesthetic method, but this one has to.
Okay.
We do not know this right now.
Here we are having to certain objects.
We are having a world object and an extra life.
This is something we will learn in the next section.
So here we can see what we are learning in the next section, providing existing instances to our call
over here so that we will learn how we can provide existing instances into our method.
Looking over here, for example.
Okay, this one sounds absolutely nice, but unfortunately we have to focus on this one first.
I mean, we cannot define the coin type, but we can make it rain.
This is enough for us right now.
Okay, let's do this.
So we save this one here and then we are creating a new one.
And this is now coin rain coin.
Right.
Duchess and Chava Dot perform then?
Yes.
So once again, we need to fetch the instance.
Hooking this method doesn't give us an advantage.
And first of all, we cannot actively call it and this is absolutely required right now and we are not
having a parameter or return value.
So therefore hooking this method makes no sense.
We have to do the job to choose approach.
All right.
Okay.
So once again, we are providing our anonymous function.
This one does not have the return type or the return type is void.
So sorry, this one does not have the return value and it doesn't have in parameter.
So this is how we can call this method.
A new terminal or freedom.
Chris, you.
Bit Level eight.
Let's create some space first.
That we are not in a hurry in yet triggering this method.
Okay.
So now let's see, I paste it in right now and I hit enter in three and two.
One, and there we have it.
Might be luck.
Let's do it once again.
Yes.
So here we can see it's working.
Nice.
This looks absolutely amazing.
And they work.
Yes.
Okay.
So this is working right now.
Fantastic.
But it's a little bit.
Yeah, it's not that convenient to do it in this way.
Therefore, let's wrap this in function and spawn coin.
Okay.
So now if we are applying this one, this is not our code right now.
So we are just having you wrap this into a function and now if you're calling this function the function
name, so let's see spawn coin.
Then we can see, yes, this is working and now we can also do this a little bit more often.
So for example, over here we can say four bar equals or bar I equals zero.
I is less than 100 I plus plus.
So now we are creating 100 coins.
Yes, this should work.
Once again, apply this to the command line interface over here.
This will not actively trigger this method because we have wrapped it in function.
Now, if we call this method once again spawn caller, I hope this B doesn't crash.
Let's see.
Okay.
Seems to work.
How far can we go?
All right.
So this is definitely an end point rain.
And we can see all these lives are going up, but we are stuck, too, in the aperture.
This is something we will fix in in some sections later on.
Okay, nice.
So here we can see.
We can make it rain coins.
Amazing.
All righty.
So this is all for this video right now.
It was pretty long.
Sorry for this one, but I do not want to rush through this over here.
So I would like to give you some approaches on how to identify certain events and things like this.
Okay.
So here we have refreshed and learned a lot of stuff.
Also for me, I have learned a lot in this video over here regarding to our first attempt to the high
score and the next one, we will learn more about objects as a parameter.
So if you are still watching this video, then thanks a lot.
It's really amazing that you that you have done this together with me right now and yet feel free to
play around with this one over here.
I mean, there might be also some additional interesting functions in there, which I might have not
been discovered right now.
So therefore play around with this one and otherwise, I'm looking forward to see you in the next video.