Welcome back.
We have seen dealing with antique methods is not that easy, but we also do not have to do this.
There is always this easy approach hooking the method on the driver's side.
Then we have easy access to the parameters and also the return value.
Nevertheless, let's finish this exercise over here.
Let's have a look how we could have manipulated those parameters and also the return value.
See this as some kind of preparation for our last challenge.
The last challenge will be about and function or a method that is only available in the C++ word.
So we do not have access within our Java code and we also cannot influence parameters or return values.
Unfortunately, this challenge will be once again a little bit different from the things we are seeing
over here.
After going through this one over here, it won't be that hard anymore.
Therefore, let's have a look into this one.
So here we are back to our Ubuntu VM.
And first let's start our Freedom server.
And so we make our connection to our device.
We get root privileges and then within data, local temp, we start the server.
All right.
Now, let's get also back the smartphone screen over here.
There we have it.
And we are still talking about this application.
Which one?
This one, Alfreda, indicate.
Okay.
If we had cropped.
Yes, it's still working.
Everything has been set up so far.
Okay.
In the last video, we have done the following.
I've still got it open over here.
Yes, there we have it.
So we have put these parameters on the index side.
These are our arguments and we have seen how we can hook them.
We have to create a new string and then we can typecast it.
This argument to in string and regarding to our integer value, we have to use the function to enter
32.
All right.
I see right now we haven't done this for the return value, so maybe let's do this over here real quick.
Let's see if this script is working over here.
So I copy this and then we are using free data as you come ab hacking and decay free the.
Yes.
So now we attach to this process.
I make this a little bit larger and I put this on the left.
Okay, so now let's see, I paste it in and if we hit crypt.
Yes.
Then we can see this is our text, this is our parameter, this is the amount of rounds.
And here we're having this strange value hex 75 All right.
If you also want to print out the return value as a string, this one, we have to do exactly the same.
And let's go back into the script.
Okay.
So what we need to do is let's comment this over here.
I'm getting the string class reference and then we have to.
We have to typecast it.
Right to string.
Okay.
So let's see.
First, let's get this string.
Let's get this string class reference over here.
So string class ref.
And this can be done with dot use.
This is the class we want to use for typecasting later.
So java lang string.
Semicolon is missing and now we need to typecast it.
So we need to create a new instance, a string in or let's call it red instance or return value instance.
And now we need to use Java cast.
Then we've got our point, which is red and you want to typecast it to this string class ref.
All right.
And now we can use this one over here.
This should work.
Let's see.
I copy this and go back into this one.
And we have also seen it's not a good idea to overwrite with Intercept to attach scripts.
So scripts that are using interceptor attach.
If you keep overwriting them, then you will end up in a mess.
Therefore, we close this and we're using free that as you dash f to launch this application and we
do not want to resume automatically.
Sorry, we do not want to resume manually.
Therefore, we are doing it automatically with the no pause.
All right, let's do this.
Now I paste it in and let's see.
Yes.
Perfect.
And so here we can see.
All right.
And this is our return value, the string that's being returned.
Nice.
Let's have a look back.
Okay.
This is now our final script.
I save this.
Okay, so the next thing we want to make is manipulating these values.
And, for example, this argument over here or, let's say this integer value over here, or maybe also
the return value.
But therefore, we are starting with new script.
I mean, modifying this one would be it would be very convenient right now, but we haven't that much
practice regarding to our intercept to attach.
Therefore, I would like to keep it practicing.
So this is the reason why I would like to start a new script.
Because then we can also recap everything we need to know about this one.
Let's switch to JavaScript.
All right.
And this time we are doing this a little bit faster than the last time.
So let's see.
We want to hook the method and the script string and this one has some string PV sorry, p w and an
integer root and this is located in the native dash lit.
So the first step is we need to get the address of this function and this can be done with module enumerate
x ports and then we need our interceptor not attach on this address.
And here we are having our callbacks.
All right, let's do this.
And so and let's bring up our free the terminal over here.
Okay, let's do it on the free terminal.
And if it works there, then we copy paste the command to the left.
So module dot enumerate exports.
Enumerate exports.
Here we have it.
And this one has some parameter which is the name of the library.
We are looking for those exports.
This is native dash.
Let us oh so we have get this name out of the trade output so we have reverse engineer this application
and have seen this has in lib directory.
And within this lib directory we've got this library.
Okay, let's see if this one works.
Yes.
Perfect.
So this is our method.
We copy this.
And then let's see.
Okay.
This is part one.
This one over here is returning an error.
So we need to create a new array.
This is our export function array.
And now we need to find the.
Let's see the address.
And this one is returning an oops.
Okay.
So if we are using this one, then we've got this export function array and here we are having, for
example, element zero and then we can access the address or the name via this field.
So this is our first entry, the name.
Okay.
So what we need to do is we need to iterate over this array and this one over here, we can do this
with one for each providing an anonymous function and we are having an element over here.
And now if element dot name is lowercase.
So this one over here is now our element and we can access this name.
Yeah.
In this way.
Over here.
OC if element of name and in JavaScript it's not contains it is includes, I guess.
Yes.
And so I'm I'm really struggling remembering this one over here.
So yeah, if you want to search for and tack on string in our name, then you have to use includes.
So we are looking for string decrypt.
If this is the case, we want to print it out so we want to have console.log.
Then we've got element name equals, element name.
And here we are printing out element address equals.
Oops.
Sorry.
What happens?
Let's put us on the right as equals.
Element of address.
And let's see if this works.
Not because I made a typo.
Yes.
Element.
This is why I like to write my scripts on the right and then freed up terminal and then applying it
to the left to read script.
Then we've got also the syntax highlighting and things like this.
Okay.
It seems to work.
But the fact your name is different.
Oh, it's decrypt string.
Sorry.
Now I hope you're good to go.
Yes.
Okay.
There we go.
Here's our element address.
Nice.
So now we can create a new variable.
What's the function in decrypt the string address.
And now we are assigning this one over here.
Element of address.
And now we can use this within our interceptor dot attach.
So interceptor
dot attach.
Yes.
Looks good.
So here's our decrypt string address and here we having our callbacks.
I put the mouse on the right and I make this a little bit larger.
Book.
So callbacks simply double click and then curly brackets and enter.
The first one is on enter.
Anonymous function we're having here our ax.
That's an array.
And here we are having our on leave function.
We are also having a return value and that's it.
Maybe it's just some Deepak statements.
We are in in the crypt string ET sorry the crypt string function right now.
And here we are printing out sand and we are leaving and decrypt the string function right now.
Well, no semicolons.
All right, let's see if this works.
So we copy, paste all of this.
And yeah, I mentioned overwriting it once again and it's not a good idea.
But yeah, if it fails, we will restart this application.
Otherwise, let's stick to this one for now.
So let's see, we hit the script button and yes, we've got a bunch of output.
Yes, we can see it's not a good idea, because these are regarding to our first approach of the script.
All right.
I put this on the left and this one on the right, and then we are restarting this application.
Okay.
And now let's copy paste this one time.
Once more, we hit script and there we have it.
We are in the script string right now.
And this one.
Yes.
I guess the English or the grammar is not that good in the.
Okay.
So now we are good to go.
Okay, so here we have now the script and this is how we can indicate function.
I would like to keep practicing this approach at this point right now because these steps are all basically
saying we need to identify the address.
We can do this with module enumerate spots and then we need to attach to this one and define our two
callbacks.
We hadn't that much of practice regarding to this one over here.
Therefore, I'm repeating it.
All righty.
Okay.
But now we want to modify them.
So let's see our x.
Where do we have them?
Here we have them.
So this ax is an array and our first parameter is our string pv p w sorry.
And this one is ax two because our zero is regarding to the chain II environment function pointer and
ax one.
So the second parameter in our indicator function is regarding to the this object and therefore our
first parameter in here and this one over here, a string p w will start at ax two and this means our
integer round and round will be ax three.
Okay, nice.
Now, if you want to modify the integer value, let's start with this one over here, because that's
way more easy than the other one.
Then we have to override this argument.
So within our Java approach, we have simply taken those parameters and then we have called the original
method with our modified versions.
But this is not possible over here.
So over here we have to do it differently.
We need to take the pointer to this argument and this one over here, and then we need to override it.
So this means we are taking AX three, which is our integer value, integer value of round, and then
we can try to assign a new value.
Let's say two, this might not work, but we will later see how this works.
Okay, so let's see what Frieda is printing out.
Okay, let's restart it.
We insert it and we hit the button.
Yes, we expected a pointer and this makes absolute sense.
So if we go back, then we can see this one over here.
This is an pointer to argument for right now, and we are overwriting this pointer with aesthetic value
and this makes absolutely no sense.
So what do we need to provide over here is an pointer to this value to and the sounds now absolutely
complex, but it isn't free.
That is absolutely amazing.
And also the author thought about this problem.
So it might be way too complex to create a new pointer and assign it over here.
Therefore, the author has mentioned this and provided a function for us which is doing the whole shop.
Nice, isn't it nice?
So we can find this information within the official documentation.
Therefore let's have a look into this one.
So over here we're having the official documentation and free Daktari and within Doc's JavaScript API
we can look for the function.
Peter And this one is memory protect.
I guess here we are in some iOS stuff.
Let's see.
Yes.
Oh, exactly.
Nice.
We already used it within our travel forecast approach.
Okay.
So this function provides a pointer regarding to the value we are providing over here.
So let's see.
If you're expecting a point over here, all we need to do is providing this function pointer and this
will take our value and make a point out of this one.
Nice.
We can close this and let's see if this works.
So I copy this.
We restart this application and let's see, I hit script.
Yes, we can see.
It seems to work because this one over here is now in different output.
Let's see.
Okay, so let's provide the value zero in there.
So we go back, we restart this application and we hit script and there we have it.
So we've got our text once again, this means we are not providing this round parameter or we are providing
it, but this time with the value zero.
Therefore we are not scrambling our text.
Amazing.
So this is how we can hook or modify an integer value.
Nice, isn't it?
Absolutely.
Let's have a look in the string in this one over here.
Not this one.
Sorry, this one.
Okay, so let's see how we can hook this string.
This is unfortunately a little bit more complex, but I will show you an approach and most of the time
this approach should work.
We should also keep in mind that we are hooking and decay function so in function that has an interface
to our Java world and this is very important.
So let's see.
And this is our integer value round and now ax to.
Equals point.
And I mean, we could try something like this and let's see if this one works.
So we copy this.
We exit out.
And let's see.
No expected a pointer.
So we are providing a point over here, right?
Yes.
But it's unfortunately not working in this way.
And for integer values or things like this.
Yes, but not regarding to strings.
Okay.
So if you want to modify the string in Acts two, then this approach doesn't work.
So we cannot simply use in text and making pointer out of this one.
We have to create a new string, but not in Java string.
So in Java String also doesn't work over here.
The spring we have to create is an UTF string and we can do this with the Java environment.
So if you go back to our free determiner.
But we have it.
And this one over here.
Let's restart this application.
Okay, so we have something that is called Java VM.
And this one and this has a method get environment.
And this method has a lot of useful functions.
We can find this over here in the free the source code.
So within the free to Java Bridge, we can now see all this function that we are having in here.
And one of them is new string UTF.
And so this creates a new UTF string, and this can be assigned to our arguments.
I mean, we have to know this.
That's not something that we can make in conclusion out of this one over here.
We have to simply we have to simply know this fact already.
Okay.
Now we know this, and now we can use this.
So maybe let's go back over here, I guess.
Is it also mentioned in the documentation?
No, unfortunately not.
But maybe we get inv.
Yeah.
So here we can see object with the following methods and gets a wrapper for the current threats in chain
II environment.
So our chain environment, this is our first or first parameter and this one has some pointer to all
these functions and one of them is new string UTF, which can be used to to create new UTF string,
which is compatible to this one over here to this argument in this one.
As already mentioned, this is simply just something we have to know already.
Okay.
So let's see.
If you want to create a new string we can now use in java dot vm, then get E and v.
Let's see, i guess this E is capital.
Yes.
So the E is capital and then we can access this function.
We have an overview about all this function over here.
So within the Free Java Bridge and one of them is new string UTF.
So new string UTF.
And we are providing here now a new string overwriting the argument.
Okay.
Let's see if this works.
So let's copy this.
We close this one over here.
We restart it.
And let's also keep this in foreground.
Nice.
We do not have an error right now, but maybe we get one if we hit the crib button.
So let's see.
We are hitting this in three and two one.
Nice overwriting the argument.
So it works.
Perfect.
We can see over here, this is our this is our argument we have provided.
And over here we still got our text.
So this one enters our function, but we are overwriting it over here.
Amazing.
So it works nice.
This is how we can modify and decay functions regarding two strings and integer values.
Okay.
Okay, so let's have a look into the return value if this also works.
There we go back.
Okay.
So if we are copying this one over here, let's see.
Right as equals.
This one?
Yes.
Let's rewrite it.
Maybe overwriting the return of value.
All right.
Let's see if this one works.
So we copy this and then we restart this application.
We paste it in and we hit script.
Overriding the argument, it seems like the return value has not been replaced.
That's a little bit unfortunate, but we also got the solution for this one.
So if we go back into the documentation.
All right.
And if you're looking for that, replace.
And then let's see.
Yes.
So here we can see within the on leave callback function one argument that is the native pointer.
Containing zero return value you may call red will replace to replace the return value with the integer.
All right.
So therefore we need to use this function over here, this replace function on our right.
Well, we can also find this in loops.
We can also find this in the documentation over here.
And we can see that's not the case for our on enter.
It's only within the return value.
Therefore, as mentioned many times right now, this documentation is a treasure.
Have a look into this one and yeah, read through this all.
Alrighty.
Okay.
And so let's go back.
This doesn't work.
But this one over here, this looks very, very sloppy.
Dirty, actually.
However, you would call this.
Nevertheless, let's do this.
So we are restarting this application.
We are inserting this one, and we hit the script button and let's see.
And 3 to 1.
There we have it.
Amazing.
So this is how we can modify the return value.
Nice.
It looks complex.
So if we go back, we have to mention a lot of things.
And this one over here can be simply overwritten with an equal sign.
So assigning a new value, this one over here needs to be replaced with this replace function.
Sorry for this part, I really do not like this.
So return value as equals.
Let's put this.
Let's pull this out.
Okay.
That's way better.
So this one needs to be replaced with this replace function.
But the approach is the same.
We get our environment point over here.
We're using the new string UTF function to make a string that's compatible to this one over here, this
return or this argument, and then we can play around with this one.
Okay.
Regarding to the script, I have attached some comments that it's way easier to follow and this is how
we can hook and modify and K functions.
So if you want to modify an argument regarding to a string, we have to use the environment pointer
to fetch and function.
For example, this new string UTF function which can create in string that's compatible to our argument
these same for the return value, but then we have to use our call the replace method.
So this is something we simply just need to know.
I mean, there's no way around this.
We cannot make a conclusion out of this one to get to this point.
Alrighty.
Okay.
So this is all for this video right now.
And the next video we will have a look in a play C C++ function.
So we are not having access to those parameters and return value and still we will be able to figure
out how to hook certain methods in there.
Alrighty.
Okay.
So I'm really looking forward to see you there.