All right.
After the installation of freedom, let's have look into hooking a method.
So this is now overwriting an existing method in memory, and that's the power about freedom.
Therefore, we start with the example that's also provided in the API documentation.
But let me introduce some background information for this one over here.
So we've got our application and this application is loading a bunch of code in Java code, for example,
we are using some strings in our application.
We are also maybe having an additional class.
And most important for this exercise right now we are importing or using an activity activity.
We have seen this before.
This is just a screen content and an activity has some kind of lifecycle.
So there are certain events in an activity then can occur.
And for example, if we pause an application so we put this application into the background and then
we are opening it once again.
Then the on resume method is being called.
If an activity gets created, the on create method is being started.
This is the place we are inserting our code all the time.
So an activity has a bunch of methods and what we are doing right now in this exercise is the following.
The activity is being loaded out of this Java virtual machine and by running the free the server right
now we are connecting to this one with our client and we are overriding this method.
So we are hooking into the activity class and then we are overwriting this with our own code.
So we are we are manipulating this class in the first example over here.
We are not doing any malicious stuff over here.
We just print some statements that this method has been executed.
So this is also a really amazing thing to keep track on which methods are being caught.
And of course we can do a bunch of more stuff over here.
But first, let's start with this example.
Let's print out some text if this method is being code.
So we are overwriting this method in the Java between machine and every time the on resume method is
being called, we are printing out in text to our console.
Alrighty.
Okay.
And therefore let's dive into this.
Okay.
Back at Ubuntu VM.
Let's first start our setup, our set not regarding to the man in the middle connection, our setup
regarding to the free the server.
So let's check out if we have our return machine running.
Yes.
So we can also fetch the screen over here.
Nice.
Then we need a new terminal and we go into this virtual machine.
We need root privileges and we go into data local temp.
Now we start our free server.
And in my case, I'm guess I'm using a 32 bit version of the free servers running.
We put this on the right because this is now running on the smartphone.
And if we open a new terminal, we can now use a free data piece and we have to provide the dash parameter
to read out the processes via the ADB connection and get it back over here.
Let's see.
There we have it.
Okay.
Now let's have a look how we can hook into this Java virtual machine and manipulate all these classes,
methods, variables, and things like this.
We can find this in the official documentation and this is very, very helpful.
Therefore, I would like to go this way.
So within free dot dot re and the docs.
And then within the JavaScript IP.
We can now search for java.
Dot perform.
We will talk about this in a moment.
Here you have it.
And this is now how we can hook an activity.
And so we take this code and we will we will completely disassemble it to figure out what's going on
over here.
Therefore, let's copy this code and we open a new terminal, Visual Studio code editor, and then we
open a new file and you paste it in.
We can now select the JavaScript language because this code is JavaScript.
For now, I would like to rewrite this code a little bit and then we will take this on a graphic template
and we will discuss every line in there.
What I like to rewrite is the following I do not like this this convention over here, so I delete this
one over here because what we are having here is an anonymous function call.
All right?
It's exactly the same.
But I like to use it over here this way because then I see, okay, we are having a function java to
perform and as in parameter we are providing now an anonymous function.
Don't worry about this.
We will take this now on the graphic tablet and then we will have we will completely disassemble it.
Alrighty, let's go.
Okay, guys, you know what?
Let's simply run this code first, because I guess then it's a little bit easier to follow this on the
graphic tablet.
All right.
We do not understand anything in this code right here.
Absolutely perfect.
We did also start with the smiley the exact same way.
And after a few sections, we became absolutely smiley ninjas.
That's the same for the freedom over here.
I will promise this to you.
Therefore, let's simply take this code and let's see how we can run this.
So let's see.
Okay.
First we need an application we want to target.
Let's see what's installed over here.
We can use whatever application you like.
You can also use.
Yeah.
Pre-installed application, like the camera app, the gallery or things like this.
In my case, I like to use the as application because the the layout was pretty sick in there, right?
Absolutely.
Okay.
So now we have this application running.
The first thing we need to do is we need to get the package identifier for this one, because this is
the identifier which Frieda uses to hook into this process.
Let me make this terminal a little bit larger.
And we put this on the right to get the package identifier, we can simply use freed up as the issue.
And then we are searching for or grabbing for a year.
Here we have it.
This is the process I.D. and this one is the package identifier.
Nice.
So now and let's copy this and then let's make this a little bit larger.
And now we start hooking into this process.
So how can we hook into this?
The command is pretty simple.
All we need to do is the running Frida dash you to tell Frida to use the ADB connection and then we
need to provide the package identifier.
So the process we want to hook into this and that's all for now.
We will learn about some additional parameters later on.
But for now, this is all we need to do to hook into this process.
All right.
And now we can see we are now in free terminal over here.
So this is on our laptop, but this is now in the terminal that can interact with the process.
Over here.
We can have two ways to run a free script directly in this terminal over here.
Or we can also provide this free to script as some kind of parameter over here so we can save this free
the script, for example, this one here in a JavaScript file, and then we can tell free to load this
script over here.
Then the action we are mentioned here will be performed in this process.
All right, maybe not, but I guess it will be a little bit more clear if we get into this topic further
and further.
Okay.
So let's see, we have copy pasted this and now all we need to do is we need to paste it in here.
It looks absolutely messy and we can see free does also providing some intelligence over here.
But this code should be working out of the box.
So if you hit enter right now.
All right, we do not get an error.
That's good.
So what is this code doing right now?
I will give you an short introduction to this one.
We are hooking into the Android app activity class.
This is the root class of all activities and then we are hooking into the method on resume.
We will take and look into this in a moment.
Every time this method is now being called, we print out in debug text and this one over here in this
terminal.
And so what we are doing right now is the following the hooking in the on resume method of every application
right now in this process.
So in this app over here and then we are overriding this method, we tell print out the following statement
and if we do this, the application would afterwards completely crash because this is now the new definition
of this method.
Therefore, afterwards we are also calling the original on receive method that this application can
load with the original code that's inserted there.
I know it's a little bit complex right now, but I guess if you test this and if you get into this topic,
you will get more and more familiar with it.
All right.
Therefore, let's simply run this.
We have already run this, let's execute this.
We can trigger this if we call the on the resume method.
And this one, if you take a look at the activity lifecycle and this one over here.
And so here we are now in the official Android developer documentation and this is in lifecycle of an
activity.
If you scroll down a little bit, we can see this perfectly over here.
So when the activity is being launched, the on create method is being caught.
We have seen this a lot.
This creates the activity.
And yeah, that's also the the place we are putting in our code.
Then after the on create, the on start method is being called and then the on resume method is being
called.
Then our activity is running.
This is the state we are having right now.
The app is simply just running.
If we can trigger the on post method, for example, if we put this into the background, this application,
then after what's the on resume method over here will be called once again.
And then our application will simply run again.
So it switches into the activity running state after the resume.
All right.
So to trigger the resume method, all we have to do is putting the app into the background and then
opening it once again.
And let's do this.
Maybe.
Let's close this over here on the left, we've got our client and we have now overridden this this method
over here.
So if you put this into the background, so we simply go into the home screen.
All right.
So far, nothing happened because we have now called the on method if we go back into this application.
So if you're opening it once again, then the RSU method will be called let's see.
There we go.
We have now a message payload on resume.
Let's call the original implementation.
So this is our debug text over here and this is now every time the case we put this application into
the background so we have overwritten the on resume method with this following code, print out in debug
statement and then call the original method once again why this one is important.
We will find out in the next section.
For now, let's have a quick introduction into hooking a method generally.
All right, so here we are back on the graphic tablet.
And now let's figure out what this function over here does.
We will disassemble every single line and we will try to figure out what every single line in here does
at the beginning.
It's a little bit confusing.
Absolutely.
But you will get better and better the more we practice.
All right.
So let's go.
We start with the first line over here, this one to perform.
But the first thing before we dive into this is I find the structure a little bit confusing.
Therefore, let's figure out where those brackets begins and where they edge, because it looks absolutely
messy, even more messy than my drawings right now.
Therefore, let's see, travel, perform.
This one is a function and we've got the opening bracket here and now the closing bracket is here at
the end.
So we do not have a function body in there.
We just got this function call and this whole stuff in here.
And let me draw this really quick in this stuff here.
This isn't parameter.
I know.
It's absolutely.
It looks strange.
We've kapton function as a parameter.
So yeah, it looks a little bit messy, but we will make our way through this.
All right?
Okay, so let's get rid of this one.
And now let's let's take the the next function, this one over here.
So this is now our parameter.
And here we have an anonymous function, and this one ends over here.
Yes.
Then within this function, we've got another function.
This one over here.
In this one.
This starts here.
And it ends over here.
Okay.
So I guess now it's a little bit more clean, but all those function begins and ends, right?
Okay.
So now we can start with analyzing this, this function code over here and we start with the first one
Chabot performed.
And we can see regarding to the brackets and this one is just the function call.
So this is not in function definition we are calling here function.
So let's write this down in Java dot perform.
And we are calling a function in this case, we do not have the function body, so we do not have it
like this way.
This is not a function definition.
Therefore we do not have those two.
We are just calling a function.
Therefore we only have this function called regarding to those brackets.
So let me get rid of this one.
Okay.
And within this function we are now providing an anonymous function as an parameter.
I know, absolutely crazy, but beyond JavaScript right now and yeah, that's the way it goes right
here.
All right.
Now, what does Java perform do?
We have seen that features available for multiple platforms.
We have seen it's available for iOS, it's available for Linux, Windows, Android and maybe more.
I'm not sure about this one.
And therefore we have to tell freedom on which platform we are operating right now.
On what freedom should do.
In this case, we want to overwrite in Java function, this Java function.
We will get into this in a moment, but this one is stored in the Java virtual machine on your Android
smartphone.
So when you put up your smartphone, the whole classes of those Java code gets loaded into this Java
virtual machine.
And now by using Java to perform in freedom, we are telling freedom.
Please attach to this Java virtual machine.
So maybe, maybe let's draw this over here.
So here we have the smartphone.
All right.
And the smartphone has now this JVM, this Java virtual machine, and this one is loading or hosting
all those Java classes and methods and more.
And now if you are writing Java Dot, perform a freedom is attaching into this Java virtual machine.
Therefore, we have now access to all those classes and methods over here and this is exactly what we
want to do.
We want to overwrite an class which this application is using and every time the application is being
opened.
So here we have our application.
This one is being opened on the smartphone.
It's also accessing those class files over here.
So these are those.
Yeah, this is the code which is get loaded by this application and now by using Frieda, we can hook
into this Java virtual machine, this one over here, and we can tell it.
Okay.
If you want to override this method, for example, which this application is using, and then when
the application is calling this method, we are overwriting it with our stuff.
We want to yeah, we want to do in this function.
All right.
Okay.
So, yeah, I announced it that it's a little bit confusing, but but if we do this more and more and
keep practicing this, it will get a little bit clear to you.
All right.
So this is what Java Dot perform is doing.
It's just telling free to please hook into the Java virtual machine that we have access to those Java
classes and methods.
All right.
Let me clean this up real quick.
Okay.
So I didn't clean it up.
I did write it a little bit more clean because I guess it's useful if we have this on the on the top
left to get back on this one.
All right.
So now we know what Travel Dot Perform is doing.
There's some magic happening in the background, but this simply tells free to hook into the Java virtual
machine.
Okay, next we've got an anonymous function.
So this is our parameter over here.
So we are providing a whole function as parameter.
Okay.
So in the next line we have now the, the magic that Frieda is doing and the whole concept of freedom,
it's super amazing.
So therefore, let's figure out what's going on over here in this one.
The first part that's yeah, that's normal JavaScript part.
So this one here, this is just a variable and let's write this down and const activity.
Okay.
This is Charleston, Barry.
April, we can.
We can name this whatever we like.
There's nothing special on here.
The magic over here happens in the second part.
And this one over here.
But don't use.
This is another function call.
So let's write this down.
And Java don't use.
OC.
What does Tramadol use doing?
And first, let's figure out what's the parameter of this function.
And this one over here is Android app activity.
This is now a class reference.
So the package name is Android app and the class name over here.
That's the class name.
This is now in short class and what everybody else is doing over here, it's getting a reference of
this class and it's assigning it into this activity variable.
So here we are providing our class name.
And this one is now being assigned into the activity.
If you take a look on the top left, it looks in the following way.
So the Java virtual machine has loaded this activity class during the application initialization, the
start up of this app.
So here we are having an activity class and this activity class is now being referenced into this activity
variable.
In this one over here.
This means if the application is using an activity in this one, for example, because the application
is using an activity, that's the screen content here.
We're having an activity.
That's the screen content of this application we are now having in reference to the screen content in
this one over here into our or at our sorry, at our activity variable.
So this is just in reference to this activity class in the Java virtual machine.
And this is it's absolutely mind blowing because this means every time the application is using an activity
over here, we are now having a reference to this activity so we can now overwrite every every activity
function method variable in here.
And this is exactly what happens in the next line.
So this line, all it's doing, it's it's simply just getting in reference to this class name into this
variable activity.
All right.
Okay.
And the next line we can see we have now our variable name activity.
So let's take yellow again.
So we are having activity.
And then we we are providing a dot and now we are accessing this this class like we do this in our Java
world, which is it's mind blowing.
So we can say activity dot and now we can provide the method we want to override.
And in this case, the method is named.
On resume.
So we are telling activity.
On resume.
This is now the method.
And now we can tell the implementation.
So that's that's a point here we have a thought.
And now that's the third part over here.
And this one is now dot implementation.
And this means we can now provide a new implementation to this method.
So let's take a look on the top left.
Once again, this activity has methods and for example, on start, on resume, on pause and so on.
And what we are doing right now is we, we tell free to hook into the Java virtual machine over here,
search the activity class now get the method on resume.
This is no method.
And now we want to redefine this.
We want to provide a new function for this method over here.
So we want to overwrite this code at this point.
Okay.
So this is what we are doing right here.
We've got our activity, we've got our own resume.
And now we tell we want to have a new implementation.
Implementation,
and now we can provide a new function to this one.
So we are telling equal sign and now we are telling, okay, we want to have a new function in this
one over here.
I'm going to write this down here.
So we want to provide a new function and this will now overwrite the existing method on resume with
our code right now.
So we are overwriting this piece of code in the Java virtual machine with our code right now.
And what we are doing is simply over here, we, we are printing out an debug statement sent.
On resume and so on.
And then that's the important point right now.
So this one over here, this line.
And this one is simply just printing out an impact statement to our attack machine, our terminal in
our attack machine.
So if you have here our attack machine, we get now just simply printed out debug statement over here
and if you would leave this function as it is right now.
So if you are overriding the own resume function in this way, then the application would crash.
Why?
Because if you take a look back to this one over here, here we have overwritten in this one.
We have overwritten the original method right now.
But the original method serves a purpose, of course.
So there are some code that needs to be done, otherwise the application doesn't function anymore.
And if we are overwriting this piece of code over here right now with our code, with the sign code,
I guess that's what the color is named.
Then we are printing out our debug statement over here and this one.
But we have overwritten the original function and therefore the original code is not being called anymore.
Therefore the application crashes and this is the reason for the next line here.
What we are doing is we are having this this operator.
This and this operator over here.
This one.
This.
This operator.
This is now a reference to the original activity object.
So if they are calling this dot on resume over here and this dot on resume.
We are calling back the original function of this of this class over here.
So what Frieda is doing, we've got Java to perform.
This means, Frieda, please hook into this Java virtual machine.
Okay, now we've got access to all this methods and classes which are stored in there.
And we tell Frieda over here at this line, please get a reference from the activity class in this one
and store this in the activity variable over here.
Okay, then we are using this activity variable and now we want to get into the on resume method because
we have now a reference into our Java virtual machine classes activity, this one over here and now
we we want to overwrite the on resume method over here.
And we want to define a new implementation in this one.
Now we are providing a new implementation which is here in the Colossians.
So we are overwriting the existing the existing code with our code right now.
But this would lead to a problem because if we do not call the original code afterwards, then the application
will crash because we have overwritten original existing necessary code with our code and we have interrupted
the application flow at this point.
Therefore, what we are doing is after calling our method, we need to call the original method on resume.
So we need to call this original method here once again and then the application can work properly.
So after printing out our debug statement over here, this one over here, the application gets called
in their original state.
So not the application.
The function gets code in their original state.
So after printing out the debug statement, we are calling this function once again.
And then this one calls the original on resume method, which means the application is now loading the
original on resume method and works properly.
I know this is a lot of stuff in there, but it will get clearer.
I've got a lot of exercises for you where you can see the difference between not calling this function
over here and calling this function and when we need to call this original function and when we do not
need to do it.
All right.
So at this point, right now, it's just important that you've gotten basic understanding of what Frieda
is doing right now and the things that seems right now a little bit complex.
They will get clearer if we move on on this point.
So you do not have to understand this example fully.
Right now, I've got a really nice exercise where we split up these whole steps into single pieces and
experiment around with this.
And by doing this, you will get an understanding of what's going on over here.
For now, I just want to give you an introduction into freedom, what these fancy brackets and scripts
look like and yeah, what it's doing and how it's basically working.
All right.
So this was the introduction to freedom.
We have already seen this life on an example where we have put the application into the background and
after calling or opening it up once again and this one over here, we have seen our debug statement
here has been printed out.
So this is the way how we can hook into an existing method and overriding the functionality of this
one.
Okay.
And the next video, we start with a very nice example which is in this application.
So if you are a person like me who has not had much luck, then we will find a way how we can circumvent
this, at least in the Android world right now.
Okay.
All right.
If you haven't understand everything in here, absolutely no problem.
We will get through this over and over again so you can directly move on with the next video.
And I'm looking forward to see you there.