Welcome back.
Last but not least, we need to talk about the UI threat.
This is our last puzzle in our masterpiece over here.
Afterwards, we are pretty well prepared to hook everything in our Java code UI thread.
That's the thread where all the action happens.
And this is something we do not know to control right now.
And this is a problem which we will find out in just a moment.
For now, let's have a look into the following slide.
So here we have our amazing game.
This is the first version of this game.
And within the first version, I have designed this the sports class over here to have fun visual output.
So if you're creating a new boss, then we can apply some action.
And then this post will appear on our screen over here.
All right.
How this looks like is the following.
And so we've got a lot of threads in our application over here.
For example, this one but one is really important within the free documentation.
It's referenced as main thread, but regarding to our development, we might know this as an UI thread
and this one over here.
So the UI thread is responsible for placing all these objects onto our screen.
We have made our first experience with the UI thread in our service topic.
We did recognize okay, we are not allowed to perform huge activities on this thread, on this UI thread,
because if this thread over here is being blocked, then the application becomes unresponsive and will
be terminated from the system.
So regarding to our network traffic, we have to outsource this from the UI thread.
All right.
Therefore, we know this UI thread.
That's a very important part in our Android ecosystem over here.
So this one, this thread is being responsible for displaying all these objects over here.
All right.
Now, if you want to create a new boss object in our first application, for example, this one over
here, we need to place this on the UI thread.
Otherwise it will fail because the views that are necessary to place this element on our screen, these
are only available in our UI thread.
And therefore Frieda has also this amazing capability to find which of these threads is the main threat.
And then we can use this part so we can we can choose the thread and place our code into this one.
And this is absolutely amazing because this means we can now also create or interact with objects that
are that are some kind of visual output.
On our smartphone over here, for example, we could set the the text field lives and this one over
here to have different text.
Also, this value, this one, this one.
Or we can interact with things like this, creating a new object that is also being displayed on the
screen.
Amazing.
Right.
Let's find out how we can do this.
All right.
So now let's find out how we can perform this action in Frida, because this one, it's it's absolutely
mind blowing.
All right, let's do this.
But first, let's have a look into this app.
So we get back our smartphone screen.
And that's not yet I'm talking about I mean, that's also an absolute fantastic app, but we are now
talking about the first version of this one and Free Da Funk.
All right, here we have it.
And I guess the only yes, we can only interact with this player and lose some life.
Okay.
So here we are having now our boss instance and therefore let's have look into the source code first.
So within apps free to func.
Yes, here we have this application.
So on the comm app hacking free to find we've got this O in this in this example it's named alien I'm
sorry for this one here.
We're just having an alien.
Not in, boss.
All right, here we can see this alien.
This constructor over here is printing out this this icon or this graphic on the screen.
This means if we are creating an alien, we are interacting with the visual output over here.
So we are interacting with the UI thread and within the main activity we can see this happens over here.
So within the on create method over here we are having a reference to this, to this thread.
Everything we are placing over here has a reference to this UI thread and therefore we can simply create
a new alien object over here.
Okay, so now let's try to create an instance of this object.
So we are creating a new one and let's see what's happening.
I mean, regarding to the constructor over here, we know all we need to provide is an integer value.
That's absolutely no big deal.
Therefore, let's find out how good this goes.
All right?
Okay.
To do this, we simply open up our results to the code editor, and we are creating a new file.
We are selecting JavaScript.
And now let's see, we are putting this on the left and here we are having the code on the right.
All right.
Creating a new instance.
So what we need to do is the following.
We need to do something like this.
Okay.
This means we need to get the class reference and then we need to have this new operator on this class
reference to create new instance.
We need to provide an integer value over here.
Let me close this one.
So here we you providing the integer venue and this should work, right?
We have done this dozens of time right now.
So let's see.
Okay.
First, we need to attach to the Java virtual machine.
Our anonymous function.
Okay and TV now need our last reference and to the alien class.
So this is our alien class reference and we can get those with with Java modules and then package name
dot.
That's not not.
That's not.
Dot and then the class name and yen.
All right.
Now we're having our class reference.
So this part is done.
Now we create a new instance and an instance equals.
So that's the left part over here.
And now we need to call this one.
So class reference, dot, dot or new and then our value, the margin.
Let's take a match from 300.
So regarding to the margin, let's see.
Let me enlarge this.
Okay.
I'm not sure.
What's the ID parameter over here?
I mean, I guess that's left.
That's right.
And this might be the top.
So regarding to left and right.
Yes, it has to be this way.
So this is our main layout.
Maybe let's show it over here on the EP.
Okay.
So here we have it.
Let's put this on the side.
All right.
We are having here our object and this one.
And this one has now some layout and we can see the margin, I guess the value three and this one is
the margin top.
This means we're having a matching top from whatever we provide over here.
Sorry.
This way.
So if you are providing a matching from 300, then this object moves the 300 points down into the screen.
And these two.
And this one.
And this needs to be or should be left and right.
The margin.
If you do not certain certain value, the object over here will be automatically being centered.
Yes.
So this should be the code over here.
Okay.
So if you're creating a new one right now, the only thing we can change is this one over here.
So how far, upwards or downwards this object will move this newly created object?
So afterwards, there should be this one over here.
That's a perfect circle.
Yes.
This is our new alien object, and that's the margin.
All right.
Let's clear the screen real quick that you cannot see my shameful drawing.
All right.
This means we are providing a margin from 300.
So we are moving this object from top 300 points downwards.
Yes, that's how it is.
Now, let's see.
Let's start our Freedom Server.
And later, local time.
All righty.
This one is in the background over here.
And now let's open a new one.
And let's connect to this one.
So the package name and this one over here, that's also the package identifier.
So we are having a pecking Frieda funk.
Okay, let's connect to this one.
I'm afraid that as you come packing.
Frieda Funke.
Yes.
Doesn't type com epic OC.
Now we're connected.
And let's see if we can create our new alien boss in this way.
All righty, let's do this.
We keep this in the foreground, and we are creating one in 3 to 1.
Oh, we're getting an arrow.
Surprise.
Let's see.
Android view.
View implementation.
Only the on loop.
Sorry, only the original threat that created a view.
Here he can touch its views.
All right.
We need to go into the main thread of this application and then we can interact with views on this one.
All right.
This is something we have already figured out in the theory part on the slides.
But now how can we do this in freedom?
Therefore, let's have a look into the documentation.
So on freedom, Ari, within docs we've got this JavaScript API.
And to be honest, this is now definitely not easy to find.
So therefore I highly recommend you if you go into the let's see, instrumentation within Java that
you read through all of this at least once because there's a lot of stuff in here.
And yeah, I mean most of the things we have already encountered, but things like this, there can
be also super handy.
For example, we can enumerate loaded classes and things like this.
Normally I do not like to do it in freedom.
I like to reverse engineer an application statically over here, but it might be handy in some way.
Okay, if we scroll down, let's see if we can find this one.
Here we have it.
It's.
It's directly under this one.
But yeah, you might not even recognize this run and function on the main thread of this.
VM All right.
So we are having Java session on main thread and then we're having our anonymous function over here.
With this function, we can then perform an action which is running on the main thread.
All right, absolutely amazing.
Let's copy paste this into our script.
Okay.
So an in class reference, there's no UI interaction in there.
We're just getting the reference.
Therefore, we are absolutely safe having this outside of this function right now.
Underneath this one, we copy all we paste now this function in and here.
Let's see.
I forgot about.
Yes.
It's a function.
Okay.
So this is a function and give, you know, providing our anonymous function.
And so that's comment this over here, you get on the main threat and execute what's inside this function.
All right.
Now we need to interact with the main threat.
And therefore, in this one over here, which is creating a new view, needs to be in this main threat.
So we take this one into here and now let's see if this works.
We copied this and then we are opening our free the terminal and let's see we paste it in and 3 to 1.
There we have it.
Amazing.
The offset is not that large so we can see it.
I guess it's the one behind this object over here.
So we can now see two objects in case if this is not happening for you right now, then you can simply
refresh this view by putting it once in the background and then reopening it, and then the view should
appear over here.
So sometimes the view does not get refreshed automatically, but I'm not 100% sure when it's the case
and when not, because we can see this one over here is being displayed directly on the screen.
All right, nice.
So maybe let's change this value just a little bit.
To 500.
Here we have another one.
Now, let's pack this into an for loop.
So this is this is freaking awesome having some visual output of all of our instances right now.
So here we do it.
We are creating a new follow for bar equals zero.
Sorry, I equals zero is less then let's say 1000 and we increase AI by 100 because we need to apply
a different margin over here.
Otherwise we wouldn't see this visual output like we have it here.
So let's paste this in.
And we chose here this eye.
Yes.
So now we are creating.
Let's do the math.
Ten new objects.
Let's copy this.
And there we have it.
All right, nice.
So this is absolutely freaking amazing.
You can now also interact with all these other elements.
And for example, this lives text field over here, this value, this one.
Or we can also make some text output over here.
So this toast message, maybe let's do this.
Let's create a new toast message that appears over here.
Okay?
Therefore, let's have a look into the official documentation because we need to get the class reference
of this toast class and then we need to identify if the message that's being created, what type of
what type this method is.
If it is an instance method, then we need to create a new instance and display it over here.
And in case of static method, we can simply use the class named method name.
So let's find this out.
Right now we are going into the official documentation, so we are searching for Android Developer Toast
and Toast Overview or maybe this one.
I have chosen the second one.
Okay.
To create message, we have to call the method, make text, and let's see if we can find them.
I mean, here we have it seems to be overloaded.
Yes.
So here we can see this is a static method.
Amazing.
We do not have to create a new instance so we can simply call our main text a method on our class reference
until we having a resource ID.
And this one here, this has some char sequence.
Okay.
So now we know we need to overload this, make text with this from this type.
So the second parameter needs to be in char sequence.
This is the text that's being displayed.
Okay.
So I mean, this one over here is now really deep into Android programming, but I just want to show
you how we can interact with this UI thread.
It's not really free to related anymore.
This is now more Android development.
Nevertheless, I would like to show this to you.
So let's go back.
Okay.
Let's take note.
And this is the method we want to call.
All right, make text.
So now we need to do this in the UI thread.
So over here and let's also comment this a little bit in class, reference to the toast class.
You want to display some text on the screen?
Okay.
And this is the method we want to call.
I thought we want to call.
And here we're having this class reference.
So what we need to do is we need to get our class reference and then dot the method name.
This one.
And let's see the parameters.
All right.
Context.
So this one over here is a little bit unfortunate, but we will also deal with this one in context.
It's a little bit more complicated.
You can think of this like really having in context this toast message make text function needs to know
on which context it needs to be printed.
In our case right now, this means in our application over here, it needs to be printed onto the screen
on this main activity screen.
And this is the context we need to provide over here.
And we can get this also with 3D.
I guess that's an one liner, but I really want to give you the context of this one over here.
So you will encounter this a lot regarding to the use, because these views are having some context
where they are being displayed.
And this one is the main activity right now.
All right.
Okay.
Next, we've got to chart sequence.
So that's not the string we need to get to the to the class reference to this one because this one needs
to be also provided in our method and then we have an integration.
Okay, this one we can deal with this one, but the rest.
Yeah, to be honest, it's it's tough.
Nevertheless, let's see how we can do this.
Okay, so let's see first, let's let's deal with this one over here.
We're creating a new variable context and we can get this with Java use.
And here we have now to provide the class name of the activity thread.
So let's see if we can find the somewhere.
I mean, at the end we only need to have the first part regarding to the activity because instead of
an activity we can use activity thread.
And so maybe let's see if you take a look and say no, sorry, not here, maybe here the here we have
in this one.
Let's have a look into the official documentation.
So within activity.
Here we have it.
It's with an Android app.
And then we've got activity and we've also got activity thread.
So we copy this one.
Well, right now we're having this one and we can now call these methods on this one.
And this is now also Java code right now.
So this is how you would get the context in Java code, you say get application context from the activity
and we are doing exactly this over here right now.
And so we say we want to have the current application and then we want to get the application context.
So this is right now playing Java code.
You could open up Android studio and you can write this in your Java code to fetch the application context.
You could write your own application to fetch the application context.
And then yeah, we are simply getting this activity for it and then we are executing those two methods
on this.
All right.
Okay.
So now we're having the context.
Let's see.
And this one is required as in parameter over here.
This one was rough, but I guess it works in this way.
Okay.
Next one, we've kept this char sequence and this one, I mean, it's an it's just an output text.
We could look this up in the documentation to get the exact type, but to be honest, I just try it
over here.
So we simply try some text.
Frida is amazing.
Also with the UI team app hacking was also amazing.
Not just on the UI.
Okay.
And then we've got an inspiration.
So we've got in our toast message something like this here, there would be something like the duration.
Length, a long or length short.
Yes.
So let's look this up.
What's the value?
I guess it's just zero or one, but nevertheless, let's have a look.
So we are looking for well, I guess we have it here, but then the toast.
We've still got it open.
There we have it.
And let's play it long.
Yes, long as the value one and shot is zero.
Exactly.
All right.
This means we have to insert.
And this one.
And now there's one thing I always keep forgetting about this, and this is just creating this message.
But to display it, we also have to call this method show.
So he hasn't shown method somewhere.
There we go.
Construct an empty tossed object.
You must call CTU before you can call Joe.
Let's see.
Then we can simply call this show.
All right, let's get back to this one.
So thought show.
Let's see if this one works out.
So I'm also pretty excited because I was only playing around with yeah.
With text fields and things like this.
I guess I didn't create it in toast message with 310.
Now let's see.
Okay.
Three, two, one.
So here we can see we are getting an error.
Make text argument type does not match any of this means we are having three methods.
So three overloaded methods.
Different types.
Different numbers of arguments maybe.
Yes.
And none of them matches ours.
Okay, so let's have a look back.
We are having this one.
So this means the first one is the parameter context.
This would be correct.
This is how we can get the context over here.
All right.
Then we're having this one travelling char sequence.
So this is some kind of string and we are providing here string, but it doesn't seem to be recognized
as a string.
The last one is an integer, so I guess this one is also correct.
Yes, it has to be the problem regarding to this one.
Therefore, let's do it a little bit differently before we dive into this one and char sequence.
Let's first try to create a new string object and really Java string object and then provide it over
here because this one might be recognized as this type over here and then it will be executed.
All right.
Let's see how we can create a new string new string instance in Java.
So therefore, let's have a look into the documentation.
So let's search for string.
Okay, that's a long string.
And let's see it.
We have in constructor things like this.
There we have it.
Yes.
Okay.
We just have to provide some charts as in value.
So this should work out if you go back to the top.
And there we have it.
Let's create a new real string option.
That's the problem regarding to JavaScript and JavaScript has not such types.
So this one is in string in JavaScript, but this might not be recognized as a string in Java.
Sometimes it works and sometimes it's it doesn't work.
And here we're having now the other sometimes.
All right.
So let's do this.
This string also no UI interaction.
Therefore, we can we can use this out of this schedule on main thread method.
So text to display.
We now need to get.
Sorry.
I was a little bit too far right now.
First we need to get the class reference.
String class reference in Java but use.
OC.
The string instance.
This is not this one in Dutch dollar new.
And here you're having the construct that this is taking a shower sequence and I hope this works.
Otherwise we would have to create a short sequence and then provide it over here.
But let's see if this works.
I mean, if not, it should crash at this point.
So then we know it's not working.
All right.
And now let's apply this string as in parameter in here, because if I write this in in Java code,
I'm also giving a string and not an SHA sequence or whatever.
Ridiculous.
Because if I write this in in Java, I'm also providing a string as a parameter in there.
I'm not using this char sequence at all.
All right, so now let's see if this works.
Let's copy this.
Keep the smartphone in foreground.
Get this back.
We paste it in and let's see.
Three, two, one.
I mistyped.
Yes.
No arrows.
This is an amazing good sign.
Once again, I did forget about something.
Did I?
Yes.
I'm not sure why, but this happens quite often.
This one is just creating an object.
And if you do want to display this object, we need to call this a show method.
So if you go back.
Not into the string, into the toast class.
Not this one.
Okay.
So here by having this show method.
And this one will will make this text appear on the screen.
So we also have to call this one.
I know this is now really complex right now interacting with the UI because you need to have some Android
programming knowledge, I would say.
I wouldn't be able to do this if I'm not coding sometimes in Android, and that's absolutely perfect
for you right now.
Regarding to freedom, all these steps are clear in this one.
We have learned this one is new, but all the rest is clear.
And regarding to executing or triggering this function, unfortunately, we need to have a little bit
of an offline programming background over here, but this might be also a good idea if you really want
to go into Android Hacking, I can only recommend having a basic knowledge about programming in Android.
All right.
Okay.
So now let's also execute this method.
And now let's see.
And this time I do not count.
We simply just fire this thing up.
Amazing.
It works.
So I guess that's also my first toast message over here.
I didn't play around with toast messages at all.
Most of the time I just interacted with text views and things like this.
So this is also pretty amazing for me right now.
And yeah, with that we take and look really deep under the hood.
So we have to be a little bit precise.
And string in freedom seems to be different regarding tool, string and JavaScript.
We know this right now.
And yeah, this is how we can interact with the UI.
Nice, isn't it?
All right.
This is the last travel part.
This was intense also for me right now.
But regarding to the free to approach, I mean, we can understand everything, but we are using it
in this way.
We want to call a sorry, we want to call a method, this one over here.
And we have to provide these parameters.
And these are now a little bit more complex parameters we're having in context.
So we are getting the application context.
We're having a string.
And we're having this duration.
This wasn't that complex.
Okay.
So this is all for the speaker right now.
And this is also the finish of our attorney journey.
In the next one, we will write our trainer.
So we will take this space planning application and we will perform all of our scripts we have used
so far and provide them or include them as an single trainer.
So this will be a lot of fun.
Then we can toggle on and off certain features and let's see how far we can go with this one.
Alrighty.
All right.
So I'm really looking forward to see you in the next video.