All right, guys, how is it going?
Do you have to play icons or even more on your screen right now?
Amazing if this is the case otherwise.
And don't worry too much about this.
We will have a look into this one together right now.
Therefore, let's go.
All right.
So here we are back on the smartphone.
And now let's set up everything.
First, let's get out our smartphone and have a look into the application.
Not this one, even if it looks absolutely amazing.
And this one over here.
This is our space packing application.
And here, let's see here we're having a word.
And this one is in player.
And now we want to have multiple players on our word.
All righty.
Okay, so let's see.
We can close this one for now with an EPS.
I got it.
So let's close this application.
So with an EPS, we've got the space pane, shade x, this one.
Yes.
So we'll be working on this within an eclipse project.
Therefore, let's open the eclipse.
Okay.
So this is the decompile code in an eclipse project over here.
And now let's search for this one.
So we're looking for create player.
Let's see.
And let's put this on the bottom.
Okay.
So game screen.
I mean, this sounds exactly what we want to have within our game screen.
We've got this entity factory create player and this one is creating a new player and we have to provide
this word instance.
Okay, let's have a look into this create player function.
Oh yeah.
We are in eclipse, therefore we cannot double click.
I guess if you're hitting control and click.
Yes, then we can see by keeping the control button pressed, we can see.
Open declaration implementation.
Open return type.
In our case right now, we want to open the implementation and therefore we have to release this control
key and then we can simply click on this one.
Yes.
So here we have it.
This one is the implementation of this create player function.
This one is in static function and it's returning back in entity.
We are providing a word instance over here and here we can see we are also creating in this function
over here and position and let's see, based on our world here we are creating this world entity and
we can now see we are adding all these sprites and all these values over here.
Okay, so what we need to do is we need to scan the memory for an existing world object.
There should be only one available.
And then we have to use this within the on choose method to call this static function with our word
object.
Yes, this is how we can create a player in our world.
Let's do this.
So therefore, let's open the results to the code file.
And we are putting this on the right.
So we can close this one, we save this file.
Okay.
So once again in Java, don't perform and I have to enable JavaScript.
Okay.
Then our anonymous function and here we are now using actuals to find this word instance.
Okay, let's see this word.
We can once again, we can hit the control button and click on this one.
There we have it not clicking, maybe just hovering it not clicking, just hovering over this one.
And then we can also open the declaration or implementation on this one.
Let's call the declaration.
So we have to release this control button right now and then we can click.
It's not that intuitive right now, but yeah, it's it's super handy.
So this is our world object.
Okay, we're looking for this one.
But right back to this one over here.
Now, let's see here.
We have to provide our call backs.
So we've kept this on match.
Anonymous function.
You'll be having our word instance.
There we have it.
Okay.
Now, let's see.
And this one is static method.
And this static method is within this class entity factory.
So to call static method in Java we have to use it in the following way the class and then simply dot
method name.
This is how we can call and static method in Java and it's exactly the same in freedom.
So what we need to get is the class reference and then we can simply use this class reference to call
the method name.
Let's do this.
So let's fetch the so let's fetch the entity factory.
Class reference.
Hard work.
All right, let's do this.
And this is within services, DOT.
And then we have it over here.
Maybe.
Let's put this more on the right.
Can we do this?
No.
Then let's keep this in foreground.
Okay.
So then we are not jumping all the time around.
Okay, here we have it right now.
Nice.
Now we're having this class reference to call the static method.
We simply can use this exactly like we have seen this in the comment over here.
So class reference dot and then the method name.
Create player.
And here we now need to provide our instance this word instead.
Yes.
And this would create a new player.
I mean, here we're having a return value over here, an entity, but we are not doing anything with
this one right now.
All we want to do is we want to call this static method.
All right.
Okay.
Let's see if this one over here works out.
So let's remove all these spaces.
Okay.
And now also, let's comment this real quick, searching the memory for word instances.
If we find one.
Getting the reference of the entity factory class.
I'm not sure if I have written this correctly.
Let's do it this way.
And here we are now calling the aesthetic method of the entity factory class.
In our instance as parameter word instance.
Okay.
Looks good.
Let's try this out.
New terminal.
Let's keep this in foreground.
And now we need to start the free the server first.
So let's let's see if it's already running.
I guess P is the I guess P is A shows everything.
Yes.
So here we can now look for free to not.
No process of free does not running.
Therefore within data local temp, we can start this one.
This one has been started.
Then a new terminal.
And this one anticipate getting back our smartphone screen.
Three days running behind the smartphone.
There we have it.
All right.
And now let's also see.
I mean, this time we do not need an AdBlock at output to observe or something like this, because we
can definitely see if we are creating a new player object.
Maybe.
Let's go back to this one over here.
So, yes, I got a little bit lazy on this one.
Sorry for this.
Let's also finish this with the incomplete on complete function.
Let's print it out and we are done scanning and maybe let's also print it over here how many instances
we have of this word, because we could also have multiple instances and then we have to figure out
how we could deal with this one.
We are now assuming that's only one available right now and this might back us later on.
Okay.
I see in type over here.
So not sure what's going on right now.
Okay, so over here, let's print out some debug statement.
Found world instance.
Alrighty.
Now we save this and.
That player.
All right.
And now we can use this.
So let's start the application.
Not this one.
This one over here.
Okay.
We resume because adding this player without having a game makes absolutely no sense.
Let's put this in foreground.
We can click start.
And now I'm applying this code into our freedom terminal over here.
So let's see.
I'm doing this in 3 to 1.
It crashes and once again, that's unfortunate.
So this is regarding to our travel with our with our application over here.
Therefore, let's try if our script works on our virtual machine, if this is the case, then we know
our fee.
The script works perfectly, and if not, then we have to investigate it.
Okay, let's do this.
So the Java virtual machine should be up and running.
Let's see, we open a new terminal and now we're making an ADB connection to this one.
Yes.
Nice.
Let's get the screen.
And let's organize this windows real quick.
This time it was a little bit easier.
Here we're having our free terminal.
Here, be having our our game later on.
And this is our script.
Let's keep the free terminal in the foreground.
Okay.
Now we have them organized.
Let's see.
We start this application once again by our freedom.
And this time we can see the free the servers not being running.
So one last terminal.
ADB shell data local time starting this free to server.
All right.
Now we can start it.
It should appear in a few seconds.
There we have it.
We resume this game.
Okay.
We click on level eight.
I copied the script I pasted in here and now in 3 to 1.
Maybe.
Maybe I have to.
Let's create some room over here.
I mean, we are level eight, so this game has become ridiculous hype right now.
So there we go.
Okay.
We are creating hopefully a new player object in 3 to 1.
There we go.
Now we're having two players over here.
Amazing.
Let's do it once again.
Okay.
Do we have an additional one?
I mean, we could search the memory for this one, but I can tell you, yes, we're having one.
We can observe this on the player shot.
So it has become a little bit faster.
And if we're adding a new one, we can see this player shot will become even more faster.
The more objects we are creating.
So now we are having a rapid fire over here.
Now there are a lot of questions.
The first thing is, if we are getting hit, what happens?
Let's see.
All right.
We can see the game is over because we have lost all player objects over here at once.
This means we are creating some player objects and those lives over here now they count.
If all five player objects get hit, then we are losing at all five lives and the game will be over.
This absolutely depends on the game itself.
So how it's being programmed or how we are hooking and interacting with this game.
Okay.
But so far it's absolutely amazing.
We can also see there's only one world instance available here.
So we are adding all this player now on this world instance.
Okay, so now let's switch back to the slides and let's do a quick recap on this one.
Okay.
So here we are back on the slides.
Let's recap what we have done.
We have identified this static method create player.
But this method requires an existing object, an instance, this word instance.
So therefore, we cannot simply create a new one.
We have to find the existing one and provide this as a parameter to create our new player.
Also on our screen, the things we need to do is we need to scan the application memory to find the
existing world instance.
And then we have to apply this existing instance as a parameter to our static method.
Create player over here.
This will create a real player in our mobile game over here.
The nice thing about this one is having this static method because this one doesn't require an object.
We can simply use the class name and then the method name and providing the existing instance.
This raises the question What do we do if we're having multiple instances?
Let's say we've got this world instance, this existing world instance, and we need to provide this
as an parameter to an existing instance, to another existing instance.
Therefore, we would have to use Java to choose two times or we can do a different approach.
Okay, let's also talk about this case right now.
But I mean, it's not really related to Frida.
Okay, a little bit, but it's more related to programming itself.
Nevertheless, let's do this real quick.
So let's say we've got the boss instance and this post instance has method drop item in this method
is now requiring another object, this item object.
So how can we do this?
Well, first we have to search for those item instances and we can do this in the following way.
On the left we can see we are using once again in Java perform and this time we are creating a new array.
This array will be used later.
So first once again, we are using Java tools and we are searching for item instances in our application.
If we find one, then we store them right now in this array.
So we we store this address of this item in our array and by having them in this array we can then re-use
them in our free to code later on.
So let's say we've got our boss over here.
So we are searching for those both instances over here.
And now if we find one, we can now iterate over our array so our object array and then we can re-use
those items in our boss method, for example, this drop item.
Okay.
So once again, let's recap this over here on the left.
We are searching for those item instances and we are creating a new array.
Every time we find an item instance, we push this into our array like here.
Okay, so now we've got three item instances in our array.
Now if you want to call the instance POS drop item method, we have to provide those existing instances,
but we have already saved them into our array so we can simply reuse them over here and then we can
simply provide an existing instance into another instance method.
Alrighty.
Okay.
If we die, we have to deal with global variables.
But you will find all this information in the cheat sheet.
So please have a look into this one.
And of course, in case of any questions, feel free to drop me a message underneath this video.
I'm super happy to receive some feedback.
All righty.
Okay.
Otherwise, this is all for this video right now, and I'm really looking forward to see you in the
next one.