Welcome back, friends.
This is the last final chapter in our free journey over here.
This is the missing piece in our puzzle hooking and decay functions.
And this is also freaking awesome.
We will later see how we can solve complex challenges or tasks in just a few minutes.
But before we can do this, we have to unfortunately do a little bit of theory.
Therefore, let's have a look what we have done so far and what's the difference from now on.
Here we are having our smartphone and the application we have seen so far are mostly or I guess all
written in Java, no big empty space ping application.
I guess this has some native code, but all the others, I guess these were written in Java.
So we've got our Java world and in our Java world we can now navigate easily around this.
We can hook method classes, instances, whatever we like, and all of them is done by a deep java between
a machine.
So we have seen those two approaches in Java.
Don't use getting those class references and performing some really nice actions on this one and Java
to choose scanning the memory for instances and working directly with them.
So manipulating games like this ping application to perform or create an own trainer.
This was a lot of fun.
Unfortunately, this is now over.
Not the fun part, but the Java dot use and Java got transfer.
So if you're dealing with C C++ code, we have to memorize an error scheme so we can ignore now Java
dot use and Java Dot choose and welcome interceptor dot attach.
And this is how we can hook native function with freedom.
And yes, unfortunately you have right with free dom.
Manipulating and function is easy, but accessing instance fields or classes pretty impossible without
having the address.
But that's most of the time all we need.
I mean, if we can manipulate and function those parameters or return values, we can perform, I guess,
90% of our task right now.
And regarding to our C C++ code, this is enough.
You will see this later on.
How much ability we still have only by hooking functions.
Alrighty.
Okay.
The structure to intercept the attach is pretty identical to travel dot, but also different of course.
So the first parameter over here, that's our native function pointer.
We can get this pretty easily in freedom.
Therefore it's also not that hard to hook this and we will later see how we can do this.
For now, we just keep this on a high level.
So here we are inserting the pointer of our function.
We want to hook the second parameter.
These are now our callbacks and this time we are having on enter and on leave.
On Enter means right now if we are entering a function and this means we are only having access to the
parameters in the on enter callback, the only callback is being called just before we leave this function
so we can apply some patches regarding to the return value just before we are leaving this out.
All right.
Okay.
On enter easy access to parameters on leave, easy access to the return value.
Okay, now let's have a look into an example.
So how is the C C++ code being included in our Java code?
And therefore, I have prepared the following application.
This one over here on the first look, it looks absolutely just pure Java code and maybe yes, I guess
it is also pure Java code.
But in there we are now having the bridge from the Java world into the C++ world.
Let's have a look.
So the first thing over here, we've got this main activity, all right?
And then we've got two variables.
And here we having now something new.
We've gotten static declaration and this one here that's in function system load library.
And here we are having now the library that's being loaded.
And this is the file, the shared object file in our lives directory of this application.
And this means this native dash lip dot as all is now being loaded into the context of this main activity
over here.
And this means the C++ code is now being available over here, but we have to build some kind of bridge
first.
So we have to build the bridge from the Java world into the C++ word.
And this one is being declared in line 25 in our Java code over here.
So if we go down to this one here, we can see we are having an a normal function at a first view.
So this one is the return type.
It's returning back in string and we've got this function in script string.
This one takes our pass and an integer value named as.
All right, beside this, we are now having this native in front of this.
And this is the new identifier that this one over here is a native function.
So this function, encrypt string is now being defined in our library over here in this native loop.
And therefore identifying native functions is super easy in Android.
All we need to do is we need to search for this one over here, this declaration native in front of
our function.
Then we know if you're looking for this function code right now, we have to take a look into the library.
Alrighty.
Okay.
Last but not least, we can call this function right now over here.
So here we are calling this.
And by looking at this one, we cannot tell if this one is now in Java or an antique function.
But we also do not bother about this right now.
The main important parts are this one.
Let's recap this real quick.
So our main activity looks on the first view like Java code, this one over here.
But on the second view, we have also identified this public native string and crypt function and this
one is C++ code.
To make this function accessible in our code, we first need to load this library where this function
is being defined and this one over here, the native lib.
So then we need to make a declaration from the Java world into the C++ word and this is being done over
here.
So here we are making our prototype of this function, this declaration, and by appending this native,
we now know, okay, and this function is being defined in this native library, but this is the prototype
of this.
So we need to provide two parameters and we are expecting a string to be returned after performing these
two steps.
We can now call this function in our code and this is being done over here in line 18.
So we can simply access this function with the function name and the parameters we need to provide over
here.
So this is finally all these are the steps we need to do to call this Indic function right now.
Okay, for now, I have only one question left.
How is this function or how does this function looks like in this C++ word, this encrypted string function?
And therefore, I have also attached the source code of this one over here.
So let's dive into this.
All right.
Okay.
So here we have it this time between different names.
So here I have named a decrypt string, but the functionality is absolutely identical.
I have just played around with those names over here.
Okay, on the top we've got the Java code and on the bottom we've got now the C C++ code.
And so we've got our includes and then we've got this, this really strange looking function name over
here, this one, this is now the complete class name.
So we can see we are having this Java in front of this.
But then we've got the app, Hacking and Decay.
Frieda, that's the package name.
And then we've got the main activity, which is the class name.
And after this one, there's now the method name finally of this function over here.
So we now right now we are using the decrypt string method in the main activity class, which is seen
over here in this one.
And therefore we could have multiple functions with the same name and we wouldn't interfere with them
in our application because we are already providing or always providing this huge package name, including
the class name in front of this.
All right.
Okay.
I mean, that's not something interesting.
This is just something we need to know the next one.
This one is really interesting because here we can see now the parameters of this function.
And we wouldn't even recognize this if you're not taking a close look onto this.
So we can see over here the decrypt string in this one has two parameters, the password and also the
round.
And here we can now see we are having four parameters.
We are having a chain I environment, we've got an object, then we've gotten a string, which is name
password.
I mean they can they do not need to match over here those two parameters because this is C C++ code,
this is the Java word, but the types over here these need to match.
Okay, last but not least, we've got this round or rotation parameter.
As already mentioned, the name doesn't matter, just type now.
So the question, what are those two in front of them?
These chain I environment and k object.
We also need to keep this in mind because this is very important.
For example, if you want to access this parameter over here, we would have assumed that this one is
ax zero because we are only having one parameter in here, but we are also having those two in front.
And this one and this one, which means this one becomes not ax zero.
And this one over here is ax two and this one over here is ax three.
All right.
This is something we definitely need to keep in mind.
And now let's talk about what are those two right now?
The first one to change E environment.
This is a very important one.
This is the pointer regarding to all those functions, all those chain E functions.
And this can come super handy also during the coding because we can now access these functions to perform
some type casting.
We will have look into this one in a moment in the second parameter k object over here.
This is the pointer regarding to the current object.
This can be completely ignored for us.
Right now, this is really not relevant.
All right.
So we are having a pointer regarding to all the index functions.
We've gotten pointer to our current object, and then we've got our two parameters.
All right.
Last but not least, we've got in return value this one over here and here we can see we are already
making use of this function pointer, this environment pointer over here because the string in the C++
world is not the same like having a string in the Java world.
I mean, we are talking here about two completely different programming languages and therefore it's
absolutely understandable that these are not compatible to each other just right now.
Therefore, we're having a lot of hyper functions that makes us transition from C++ into Java and also
backwards way easier.
And one of them is within the within the environment function pointer over here.
This is being called new string UTF.
So here we are providing now our C C++ string, this one encrypted PV.
Then we are calling this method C string, which creates an C string out of this one.
And then we have this new string UTF which makes out of these and compatible string in our Java world.
All right.
Maybe not, because this is really much right now.
So let's try to recap this a little bit.
So we are having our function definition over here, this public native string decrypt string.
This one is native function.
Therefore, the declaration of this function is within our C++ code in this shared object file.
We can see this over here.
Unfortunately, we are not having the source code.
If we are reverse engineering our applications right now.
Unfortunately, we are not having the source code over here.
This is not being available in our applications that we are reverse engineering.
We can also not construct this in a way like we have seen this in our Java world.
So this one over here, this one would be a simpler and therefore way harder to read.
But that's also not required.
We can see over here, for example, we are providing a string and password and some integer value regarding
two rounds and we can see it's being returned something back.
If you're hooking this one, then you can observe and manipulate it.
And here we can see what password goes into what the encrypted text goes out, things like this.
Alrighty.
Okay.
And then we have seen this decrypt string has a huge prefix.
This is java underscore then the whole class name.
And then we have this function n this one over here.
This is also important because if we are searching our functions later on, we will always have these
huge prefixes in front of them.
So if you're looking for decrypt string, we have to look for the function name at the end of this of
the string.
We are returning back later on.
Okay.
All right.
Last but not least, we can see it's not that easy to simply just return back and strain.
So we cannot use our string in the C++ word and simply return it back.
We have to typecast it.
And yeah, this is being done over here with the environment function pointer and this is typecasting
this too in string that can be understood in our Java world.
This is why we're having this definition over here in our Java world that we know what we are expecting
and what we are presenting to this function, the arguments and also the return value.
All right.
So this is all right now for this video over here.
I'm sorry that it has been only in theory part, but in the next one, we will already hook this method
and modify it.
Because if you want to deal with native functions, there's an easy way and also a very hard way.
The easy way is something we already know right now.
You might not recognize it, but you will see later on.
It's very easy to hook things like this.
The hard way will be also included in this course because I have seen a lot of questions out there on
how to hook these parameters and return values.
And I have rarely seen correct answers for this one.
All right.
After figuring this out the easy and hard way, we will have a look into the amazing way.
This is the last way.
And this one is it's freaking awesome.
This is how we can hook functions, for example, like string compare, string copy, mem copy and more.
I do not know more functions right now, but I guess there are more.
And this one is really amazing.
I mean, this is really fantastic.
We can perform complex tasks in just a few minutes and for example, we are dealing with a challenge
which is comparing in password in this application within an C++ function, for example, over here.
And we will find a way on how to hook this part directly within and function.
So not just the parameters and return values, we will see how we can hook this part in in function
and get out the correct password out of this.
So this is the amazing way and this is the last part in our journey over here.
Afterwards, you become an absolutely free to expert so you can hook and manipulate things like you
couldn't imagine right now.
All righty.
Okay.
So therefore, I'm really looking forward to see you in the next video.