Welcome back.
And one thing you might have encountered by playing around with this application that there's a difference
if you're hooking into a running process or providing our script at startup, providing our script at
startup will fail while hooking to a running process will work.
The difference between those two is the timing.
And this is a very important point in freedom, which we need to talk about.
You know what?
This is exactly what this video is for and therefore let's switch back to the Ubuntu VM and let's figure
out what the problem is right now.
This is our Ubuntu VM and this is our script and this one over here.
So here we can see we are hooking those parameters, the string and also the integer value and the return
value will not be printed out right now as the string, but to be honest, all you need to do is simply
using this class reference and typecasting it as we have done it over here.
We will wrap this up in the beginning of the next video over here.
I would like to talk about the timing.
And so what's the difference in there if you're opening this application?
So let's see, it's still being opened.
And if you're now connecting to this application with freedom so free today as you come up hacking and
decay freedom, then we can apply our script and everything works perfectly fine and therefore let's
keep this in foreground and let's paste this in here.
We can see we've got our pointer and we hit script.
Here we have our parameters.
YouTube app hacking and the value for nice.
And this also works if you're providing the script over here as a parameter for freedom.
So if we go back, if you're using the script, this one, let's see.
This one is being stored in apps and freedom in decay and decay.
Yes.
Then we can see it's getting automatically executed.
And we've got once again our point that if we hit correct once again, we get those parameter values
and everything is nice.
All right.
Now we are relaunching this application, but this time we are telling Frieda to start it and we are
providing our script as a start up parameter.
So let's get over here and we close out of this one.
And now let's see.
We tell Frieda to relaunch this application and we provide our script at the startup of this app.
Alrighty, let's see what happens.
I start this in three, two, one, and there we have it.
We get an arrow expected a pointer.
And we might also realize right now why this is the case.
The application has been booted up.
All right.
But now we are looking for those exported functions, this one over here and this one.
And this is right now not being available because the code has not been executed yet and therefore we
can also not find them.
And this is why we are getting this error expected.
A pointer because this one is empty.
Our exported functions.
I guess we can also print this out.
There we have it.
Yes, this one is null because there are no modules.
Sorry, there are no exports to be enumerated with this command module enumerate exports.
And therefore we can also not attach to anything in here.
Why add this one?
So maybe let's put this on the right.
Okay.
So what happens is the following.
We are trying to enumerate those exports out of this library.
We cannot find anything because this application has not been booted up and therefore this value is
empty.
If this value is empty, this value will be also empty over here.
But then we are trying to attach to this one with the interceptor attach, and this is why we are getting
an error over here.
This is, of course, also the case if you relaunch this application and providing no pause.
So to automatically resume this application and let's see.
Yes, here we have it expected a pointer.
And the problem right now is if we click script, then we can see it's working over here.
But we are not attached to this native function right now.
This is, of course, also the case sorry over here, if you're using the command line interface.
And so if you are starting this application by the command line interface and if we're now trying to
apply our script to this one and then we can see expected a pointer once again, if we are resuming,
we will be not attached to the native function.
If you hit clip sorry then we can see it's working.
But no output over here.
This is a problem in many situations, but we will find out how to deal with this one in just a moment.
For now, all I can recommend is the following.
If you are using the interceptor attach, then please start up this application until it's running,
then using the command line interface and apply the script to this one to the seal over here.
It's super annoying copy pasting this all the time into into the terminal over here.
But if you're using a script and you keep overwriting or reloading the script all the time, then this
will be a huge mess and the application will sooner or later crash.
This is super annoying, I know, but unfortunately that's the only way right now.
Okay.
Now we will get back on our slides and we will draw our timeline and figure out what's happening.
And then we will also see what's the solution for this one here.
And this will be a very nice solution which will work all the time.
So I have included a whole bonus section just for this case over here.
Let's get back to the slides and then we will have a look into this.
Okay, so here we are back on the slides and now let's recap this here.
So we draw our timeline and we've got these two main events, we've got the start and we've got them
running in between of them.
There's now a lot happening.
And for example, this one over here, at this point, the libraries will be loaded.
This is our system load library.
And then we've got methods, for example, D on create in our main activity and after this one our indie
k function will be executed.
So there's no button that triggers it.
It will be directly executed after the on create method.
And for now we have the following two options to hook this method.
We could try it at the beginning so we can use freedom this free the hook at the beginning and launch
this application with the dash f option.
The problem we have seen at this point, no libraries will be loaded.
Therefore our module enumerate exports will be empty and we do not have access to this function.
This will definitely not work.
And the other option is hooking into the running.
Process directly here, but also here we're having a problem because the method has been already executed.
So we are too late right now if we are trying to hook it over here.
What we need to do is the following.
We need to attach the debugger at the system load library directly in here.
So we need to pass this application and then we can step forward so we can signal step every instruction
in there.
We can make one single step that the library has been loaded and then we've got access to those functions
here.
We can apply our freedom hook and afterwards we can resume this application, which means the application
will be loaded.
Our free the hook can take place because this library module has been fetched and the function, if
it's being called, will be observed right now, which is absolutely amazing.
And for me right now, that's the only way we can deal with this one.
And this is really in high advanced setup, which will be shown in the bonus section.
Okay.
For now, I just want to point out that we cannot launch our application, but we are having our free
script being attached.
We can also not override our free test script all the time while we are attaching to the running process,
because this will mess up the whole intercept, the attach approach.
We have seen this in the past and we will see this maybe also in the further videos right now, overriding
an intercept, the attach.
But this will be a huge mess and it's absolutely not recommended.
And fortunately, the things we have to do is we need to restart the application manually until it has
been booted up.
Then we can apply our script or we can apply our our hook within the command line interface of freedom.
Already, if you are encountering these error messages expecting a pointer, then you know right now
what's the reason for this one?
So you are trying to load or enumerate modules that has not been loaded right now and therefore the
pointer is empty within our interceptor dot attach.
And this is all for this video right now.
I just want to point it out that you are not running all the time into this error.
We will wrap this up in the bonus section when we're talking about debugging and application.
But for now, let's move on with modifying these parameters or return values.
All right.
Okay.
So I'm looking forward to see you in the next video.