Welcome back, guys.
After all this theory right now, let's have a look into some practical exercises.
Let's see how we can hook and decay method on the first time we're doing it the easy way.
And there's absolutely no reason to go one hard way if there is such an easy way like this one over
here.
So while we are doing this over here, you might really think that I'm trolling you, but I do not want
to spoil that too much.
And therefore, let's have a look into this one.
Okay.
So here we have back at Ubuntu VM and now let's have a look into this application so you can find this
as an attachment of the section over here and it's named let's see.
But Frida indicate.
All right, and let's install this application.
So we get back our smartphone screen over here.
There we have it.
And then let's copy this application into a new directory first.
So within EPS and free the end decay.
All right.
Now we open this in a new terminal and we perform our ADB install on this one.
Let's have a look into this.
Here we have it.
So you can see I play a lot around with different colors in my applications, and this is really what
I like.
All right.
Let's open this one.
And here we can see this time I really did play around maybe a little bit too much.
But nevertheless, we have look into the function, not at the design.
Right now.
We've got this text over here.
You mean app hacking?
And if we click script and then we can see it appears over here.
So this is decrypted text.
Okay, now let's change this text over here.
In this one, let's say Frieda is awesome.
We hit the button and we can see the decrypted text over here also changes.
Nice.
Let's have a look into this application.
So we reverse engineer this application right now.
Therefore, we go into apps free to indicate and we are opening this one with shade excuse.
Okay.
On first look into the Android manifest.
And this one over here, we can see we've got an Internet permission and then we can see only one activity
and otherwise nothing fancy in there.
We can see over here we're having a lip or many lips.
So over here we've got a lot of compatible libraries.
We've got 64 bit support.
We've got 32 bit support for ARM.
We've got X 86 and 64 for our virtual machine.
But right now we are working on a new device.
This one over here, this is the arm, 64 bit.
This version, lip, native dash, lip.
So this is the shared object by the library that gets loaded into our application where I guess within
the main activity.
And let's have a look.
Yes.
So here we have it.
Here we have the static context system load library, and then we've got this native lib.
All right.
We can also see we've got the native function over here, the string.
So this one is taking a parameter and string parameter and an integer value.
I guess that's exactly the same function.
We have already analysed the source code regarding to this application on the slides.
All right.
This means this one over here.
This is our parameter.
So let's see where this is being called.
Over here, and it's been covered with this passport and this one over here and with the value for.
So these are our roads.
Okay.
If you now want to have look into this function, this is unfortunately not that easy because this one
is being included in our library in this little native lib.
So this means even if you click on this one over here, it's not defined in our Java code.
So we would have to reverse engineer this one over here.
But that's a sampler.
This is an whole topic on itself, and this is something we cannot cover right now in this course over
here.
I will prepare another course for this one.
But for now on, we will be we will be absolutely fine if we are able to hook this function to see what
are these values, these parameters, to play around with these values, and also to observe the return
value.
Let's have a look how we could do this.
So we put this on the right.
We open our visits to the code and project over here.
All right, now a new file, and let's see.
Okay, so I have told you, if you want to hook, observe Native method, we have to do it with the
interceptor.
Attach this one over here and let's first change to JavaScript, interceptor, dot attach.
And then we've got our two parameters, the native function pointer
and our callbacks.
Whoops, there's some problem.
Never mind, I guess.
Yes.
Screen copy that.
Disconnect.
But we can forget this right now.
Maybe.
Let's put this on the left.
Okay.
So this is how we can hook native functions, but this is the hard way.
So this is the hard way now is the question, what is the easy way then?
Well, if you take a look into this one, we can simply hook the Java function.
So there's absolutely no reason in this application to hook the native function over here.
The native function is being defined in this library and what we need to do is we need to get this function
address, then we have to provide our callbacks and then we can observe the parameters and return values.
We will do this in the next video, but over here it's absolutely enough if you're just hooking the
Java function.
I mean, this is exactly the same.
We are calling this function on the Java side.
We make our transition into the C++ side and then backwards.
It's absolutely enough to only hook the Java side.
And now you might ask yourself the question, Why are we even learning this?
Why do we learn how to hook native function with the intercept attach?
The reason for this is not all functions we want to hook are defined in the Java word.
For example, let's assume we've gotten function only written in C C++ and this function is performing
some stuff in this library, but it never leaves this library.
This will also mean that we do not have to define and function in our Java code in prototype for this
function.
And this means we cannot hook this in our Java world.
All right, maybe not, but we will find this out in some further sections for now.
On if we are dealing with native function that has some prototype in the Java world We go the easy way
and the easy way is the way we already know.
So let's get rid of this one.
Go away.
We want to have the easy way.
Okay.
What do we need to do?
I mean, this is simply just an class method, so therefore, let's get the class reference.
Let's define a new implementation for this one and then let's see what are the parameters, what's the
return value?
And let's play around with this one.
Alrighty.
Amazing.
Let's do this.
So therefore we are back to the perform.
We've got our anonymous function and here we now need to get the class reference of the main activity.
So main activity in Java use.
Package name appending the A which has not been copied and taking the class.
All right.
Now we're having this class reference.
This method has been defined in this class and therefore we can now also access it.
So we are using this main activity and then this method name, and we want to define a new implementation.
We provide this anonymous function.
We've gotten parameter one, we've got the parameter to whoops.
And now we simply want to print them out.
Param one is equals.
Let me put this on the right.
Param one and param two as equals.
Param two Now we can also check the return value.
So our return value is in this one.
Maybe let's throw this in a variable.
Let's see, we have to get this this object from the original.
And so we need to call the original method.
Therefore, this thought decrypts string.
Then we need to provide our two parameters.
And now we're having here our return value.
Oops, that's not a bracket.
Okay.
Now we can also print out the return value.
And now we can also return back the return value.
All right.
And now we have done everything regarding to printing this out.
So we are printing out those two parameters of this function.
Then we are fetching the original return value in the variable that we can print it out and we can also
return back the original value which has been here, which has been returned back from this method over
here, the original method.
Alrighty.
Okay, let's see.
We get back our smartphone screen.
Here we have it.
And then we need to start our Frida server data, local temp.
Frida All right, this is running in the background.
Then we need to attach to this process free data issue.
We can find this package identifier in the Android manifest.
Well, we still got it here.
Let's see.
You call them at pecking and decay, Frieda.
All right.
Com app hacking and decay freedom.
Now we are attached.
Let us apply our script.
And let's simply hook this one over here.
Let's see.
I make this a little bit larger.
I guess that's good.
And now I'm clicking crude in 3 to 1.
There we go.
We've got payload one.
This is our text.
All right.
This is the text that's being provided over here.
And this is our payload, too.
This is the integer value, and this one is the text that's being returned.
Perfect.
We have hooked an anti k function in freedom.
Okay, this one.
I mean, that's the easy way because we are having a prototype and function definition in our Java world
over here.
Then we have easy access.
And please, if you're having this easy access, there's absolutely no reason to go on the hard way
for this one.
All right.
The only reason to go on this hard way is flexing in some kind of report.
So if you provide an report to the customer, then you might want to flex over there and show all your
skills you've got right now.
But if you're doing this in a reverse engineering approach or to test an application, absolutely no
reason for doing this.
Alrighty.
Okay.
Now let's manipulate these values a little bit.
So let's see.
I mean, this one over here, this is an amount of round.
Maybe let's set this number to one.
Let's see what happens regarding to the output.
This one is now a little bit annoying for me.
Therefore, let's take this into a script and then we are just saving this one and updating our free
to instance.
So we save this.
In apps and free to indicate
flexing on native methods.
Yes.
All right.
And now let's close this one here and load it with the script.
Within apps, I'm free to indicate flexing on native methods.
All right, now let's get back our smartphone screen, which has disappeared once again.
This one is a little bit rough to get it out.
Okay.
Here we have it.
All right.
Now, just a little bit.
Okay.
So here we have it back.
Let's see.
We hit script.
Oh, and this one over here has changed.
So the amount of rounds seems to affect our output.
And do we have a feeling in which way does it affect?
I mean, something is recognizable.
So if you're taking a look at these two spaces, we can see these are now being represented with this
exclamation mark.
And this might also happen for other letters.
Let's see.
At least I cannot see anything.
All right.
We can now do some kind of analysis.
And for example, we could put this a little bit down.
And then we can look sorry and we can change this 1 to 2.
Let's keep this in foreground.
We save this and we hit crop once again.
Okay, so it changes a little bit again.
Therefore, we are having now these two characters three save.
Batten Once again, there seems to be some pattern.
Let's see.
Some negative value.
All right.
Correct.
Once again, we've got some non printable ASCII characters, it looks like.
Okay, let's provide the number zero.
Huh?
We've cut back our output.
This is one of the most basic cryptographic examples you will find out there.
This is the key cipher.
If you're having a fixed value, for example, the number 13, it might be also known as rot 13.
So this is just notation based on the numbers of rounds we are providing over here.
For example, the number 13 will rotate every character in our letter by 13 values.
So for example, A becomes, let's see, I'm not sure, rot 13.
Let's only do the capital A.
Well, I have to save it.
Okay.
Now we can do it.
It becomes an and so on.
Let's do it this way.
Yes.
And so here we have it.
All righty.
All right.
So this is all for this video right now.
We have seen if you've gotten function definition in our Java code over here in this one, then we can
easily hook this method even if it's an SDK within our Java world.
Absolutely easy, but nevertheless we will also do the K approach within the next section.
The reason for this is we need to be familiar with this one also on a training example like this one
over here to get into this topic, because after what we're doing, some complex hooking, we're hooking
native functions that are only defined in this native library.
So they do not have an external access over here in our Java world.
And this would mean that we are not able to hook them easily like we have seen this over here.
So if this function has been only defined in this native library, then we do not have this Java approach
over here and we need to be familiar on how to do this because then we can also solve really complex
challenges in just a few minutes.
Alrighty.
Okay.
So I'm looking forward to see you in the next one where we talk about the hard way.
See you there.