- Hello all and welcome to the new video of the Android Security and Exploitation
by Pentester Academy. My name is Aditya and I'm your course instructor for this
training series. So, this course is being run on http://PentesterAcademy.com and you
also can check out the certifications at http://securitytube-training.com. So, in
the previous video we actually had a look at how we can bypass the ListLock
application authentication using Cydia Substrate API and it was really convenient
to use the Cydia Substrate and hook into the method which was responsible for
authentication and simply return a Boolean True in order to validate ourselves. So in
this particular video, we are going to achieve the same goal but with a different
framework in this case that is called XPosed. So, XPosed is a framework which is
use for modifying system and application behavior. So, it is written by XDA developer
member called rovo89 and there are a lot of similarities between XPosed and Cydia
Substrate. There are a couple of differences as well which you can check
out at this particular URL. The way in which XPosed works is whenever you install
XPosed, it copies itself into /system/bin and basically launches itself at the time
of system boot. Once it launches, it adds a couple of additional jars at this
respective places in order to make all those changes. So, for this video we will
use the same application ListLock and we'll proceed in a different way in order
to authentic ourselves. Instead of simply changing the return values, we will change
the variables over here. So, if we go to the VM, inside APIHooking/Cydia and we
have the ListLlock apk. If we look over here. If we look in the dex2jar output
what we are trying to achieve here is we are going to make these two variables
which is the input string and the password of the actual application. So, we are
going to make both of them the same and then the validate password method will get
called and will basically get authenticated. So, the way to write Xposed
modules is really straight forward and you can checkout the development guide over
here. Then checkout the XposedBridge Wiki and basically get started by creating a
sample application. So in order to use the Xposed framework, you first have to
install Xposed. Let's go ahead and install the Xposed application. So adb install.
Connect. So this application is already installed on my device, but all
you need to do is simply install the apk and you have the installer over here. Once
you have installed the application, you just need to go to Framework and click on
Install. So once you have installed Xposed successfully, you can go to modules and
you can notice that there's no any Xposed modules currently installed and this is
because we haven't installed any of the modules so far. So we'll write a custom
module for Xposed which will help us bypass the Listlock authentication. Let's
go to Eclipse and write our own custom module. In order to write the custom
module, you need to go through the Wiki guide of Xposed on how to use the API in
order to basically hook into a method and modify some of the variables. So some of
the things which are important over here in the API is the handle load package
which simply notifies when a package has been loaded. Now if you notice, this is
quite similar to the Cydia Substrate MS.hookClassLoad. So there are a lot of
similarities between Xposed and Cydia which you'll figure out as you start using
both of them. After the handleLoadPackage, once you have notified that a package has
been loaded you can use the findAndHookMethod to simply identify that
this is the method you want to hook into and use it to hook into that particular
method. Then you can simply use the beforeHookedMethod and afterHookedMethod
in order to manipulate the parameters and change what the function or the method
actually returns. So this is how the overall structure looks like. So first of
all the beforeHookedMethod will get loaded and then you have the original method get
loaded and then the afterHookedMethod. So you can change some of the variables in
the beforeHookMethod which will then be used in the original method. So that's
what we'll do now. So we'll identify the package name. We'll figure out what's the
method we want to hook into. We will write the beforeHookMethod and inside that we
will change the variables so that both the variables actually match each other. So
whenever it tries to validate for a password, both the password or both the
user input and the actual password turned out to be the same value. And once that is
done, you will have the authentication granted. So this is how the overall
architecture looks like. If you go to Eclipes...we have the bypass validation
over here which is using the XposedBridge API. If you look in the source code, you
have the package name which is com.historypeats.listluck and then you are
using the findAndHookMethod specifying the class name authenticate, the method name
validate password. Then we're using the beforeHookMethod and specifying that the
param.args [1] = param.args [0] which is basically making both the values to be the
same. Then once that is done we are simply adding a bunch of login statement just our
convenience. So let's go ahead and install this application. And once you do that you
see that you have a module installed over here. Now in order to install this module,
you need to restart your device. So I'll simply close this and restart the device.
Also at the same time, let's do a adb logcat so that we keep track of whatever
is happening. Adb logcat and probably go back to Genymotion and if we notice an
Xposed modules that we have BypassValidation activated and we come
back to Listlock and enter test123 and click on unlock. If you notice that Xposed
is showing you the previous argument which is test123 and the actual password
C@ntSeeMyList and after hooking it changes both of the arguments to be the same as
test123. If you notice you have the authentication granted over here. So this
is how Xposed works and this is one of the other ways in which you can hook into
methods and basically change the return values and some of the variables as well.
So that's all for this video and if you have any feedback or queries, feel free
write out to me at adi@attify.com or you can tweet to me @adi1391. Thank you.