‫Instructor: Hi,
‫Within this lecture
‫we are going to solve our first challenge,
‫regarding our CTF,
‫and when we open our app,
‫the thing that I have caught my eye is
‫the rooted device thing.
‫We have seen how
‫to bypass root detection in iOS,
‫but we haven't seen it yet on Android.
‫Actually, we know how to do it,
‫since we know how to do decompiling,
‫how to manipulate Dalvik bytecodes and stuff,
‫but we have to practice it as well.
‫So I want to start with this.
‫So I want to make this,
‫and not through to the device, okay?
‫So I want to bypass
‫the root detection
‫and in any case I want
‫to see not rooted over here.
‫Of course, in this example,
‫we will only get not rooted,
‫but in real life examples
‫we will see the menus
‫or we will see the actions
‫that a non-rooted app
‫or non-rooted device can see
‫in a rooted device, okay?
‫This will give us some advantage
‫over the application when we engage
‫with reverse engineering.
‫So this is our first challenge,
‫we want to see if we can make
‫this root detection go away.
‫And in order to do that,
‫of course we are going to start
‫with the things that we have done before,
‫we are going to follow
‫the exact same steps
‫that we have seen in
‫the reverse engineering section.
‫So maybe you may want to pause the video
‫and try this on your own.
‫Maybe you will not get
‫that far too by password detection,
‫but I believe you will reach some point
‫that you can understand
‫what's going on inside of this application.
‫And the steps that I will follow is
‫to use the jadx,
‫use the APK tool,
‫in order to do reverse engineering
‫and then try to understand
‫which methods do what,
‫and actually try to see
‫if we can manipulate them or not.
‫So that's exactly what I'm going to do.
‫So I'm going to work with an APK over here,
‫so I'm going to make
‫this go away and paste the APK on my desktop,
‫so that we won't actually change
‫the original one,
‫but we are going to work with a copied one, okay?
‫And over here, as you can see,
‫my server is running on my terminal,
‫so I'm going to actually open a new terminal,
‫and if you're on Windows at this point,
‫maybe you may want to switch
‫to Kali Linux so you can use jadx.
‫Okay, so I'm gonna open another terminal,
‫and I'm going to actually go
‫to desktop first,
‫because my APK is located on desktop,
‫and then I'm going to run APK tool
‫and jadx on it.
‫So make sure you browse to your own folder,
‫like if it's on download folder,
‫then you're gonna have to go
‫to Downloads folder.
‫So let me do that,
‫and of course if you're on Kali Linux,
‫if you have downloaded it
‫and if you just left it on the Documents
‫or Downloads the folder,
‫you can do the exact same thing
‫on your terminal,
‫on your Kali Linux.
‫So let's do that.
‫Let me run cd Desktop, okay?
‫And it says that there is
‫not such thing,
‫so yeah, I'm gonna have to go
‫to my original folder,
‫and then run cd Desktop,
‫here we go.
‫Now I'm going to say ls,
‫and I will see the APK,
‫and then I'm going to start with APK tool,
‫I'm gonna run -d in order to decompile it, okay?
‫And I'm going to run the APK name like this.
‫Here we go.
‫Now if you hit Enter,
‫it'll just do the thing for you,
‫and it gives us some error.
‫So let me see.
‫Yeah, in order to do that,
‫we don't have to use -d
‫but just d,
‫remember this is not jadx,
‫this is just APK tool.
‫There you go.
‫So after that we are going to go for jadx.
‫And actually jadx will be very helpful
‫in this case if we can get
‫the source without any encryption,
‫without any ProGuard for instance,
‫and in order to do that,
‫of course I'm going to run jadx,
‫and this time I'm going to use -d,
‫and we're gonna have to choose a name
‫for our folder to be created.
‫Okay, so I'm gonna call this jadxbanking,
‫so it will just decompile it
‫and create a jadxbanking folder,
‫and it will just put the files
‫on that folder.
‫So if you write the APK name like that
‫it will be sufficient for you.
‫And I'm gonna hit Enter.
‫Of course, we can actually add
‫the deobfuscation parameter as well,
‫I didn't do that,
‫I actually forgot to do that,
‫but let's see if we can get
‫the source code without any decryption over here,
‫and that we're gonna move on
‫to the other methods or other parameters
‫if it's needed.
‫So let's see,
‫we already have the APK folder,
‫APK tool folder and jdax folder.
‫So you can just open the APK tool folder
‫in order to see what's in there.
‫As you can see,
‫we have the smali files over here like this.
‫So here you go,
‫we now reach the Dalvik bytecode files.
‫So this will be very helpful for us
‫in order to manipulate this app later on.
‫Of course, if I actually open them right now,
‫we wouldn't actually understand it very much.
‫So if we have the source codes,
‫then it would be very good,
‫if we don't have of course we can try
‫to read the Dalvik bytecode as well,
‫but if we have the source code then it
‫it won't be necessary for us to do so,
‫'cause reading Java
‫or reading Kotlin is much more easier
‫than reading Dalvik bytecode.
‫So as you can see
‫we have different activities over here,
‫like ChangePassword.java, right?
‫So we have some CryptoClass.java.
‫So they're very self explanatory,
‫for example, if we open this ChangePassword.java
‫on Geany or any other text reader
‫or text editor like this,
‫we can see all these source codes
‫which which is good,
‫so let me try to zoom in a little bit,
‫and make sure we can see the source code.
‫Yeah, here we go,
‫there is no encryption which is very good
‫for us at this point,
‫and we will see
‫the things over here like that.
‫So this is good.
‫For example,
‫we have the password pattern over here,
‫I'm gonna show you in a minute,
‫so let me see if we have anything funny.
‫No, let's just focus
‫on the password pattern,
‫as you can see,
‫it asks us to create password in
‫this pattern like with capital,
‫uppercase letters,
‫lowercase letters
‫with spatial characters only,
‫with the 6 to 20 characters.
‫Okay, so we didn't comply
‫with these rules,
‫and we got the error in return, right?
‫So now we can understand why,
‫but we are not going
‫to spend too much time on this
‫because we don't need to.
‫Okay, if we want to change
‫the password later on,
‫or if you wanna do something with it
‫of course we can focus on this,
‫but right now I just want
‫to focus on root detection bypass.
‫So there is no point spending time
‫in this change password thing.
‫So I'm gonna close this down,
‫and try to find some related file over here,
‫like CryptoClass won't do much,
‫do translator no,
‫LoginActivity maybe,
‫but it's not even the LoginActivity
‫it comes after the login,
‫but as you can see there is a PostLogin.java,
‫which is exactly what we are looking for.
‫So remember we see this activity
‫we see the screen after logging in.
‫So it should read that,
‫and it actually says in the title PostLogin,
‫so this is exactly the thing
‫that we are looking for.
‫So we can open this with Geany, okay?
‫So we are pretty certain
‫that this is the class
‫that we are looking for,
‫and I'm gonna zoom in again one more time,
‫and of course what we wanna do over here is
‫to find the root detection method,
‫so that we will try to manipulate it.
‫And you can just browse through here,
‫like scan through with your eyes
‫in order to find the root detection method,
‫and as you can see we have all this
‫on create and showRootStatus,
‫yeah, here you go,
‫we have something called showRootStatus,
‫and this is exactly the thing
‫that we are looking for.
‫It says that if Superuser.apk exists,
‫like this so it's looking
‫for something called Superuser.apk,
‫it says that rooted device and else,
‫if this is not the case,
‫it says that Device not Rooted.
‫So in in real life examples
‫we can see something like that.
‫So rather than just setting the text,
‫it may limit some other actions,
‫but over here,
‫we are just going to make sure
‫that this showRootStatus
‫does not return the first condition at all,
‫but it always returns
‫the second condition,
‫which is Device not Rooted, okay?
‫So if we can do that,
‫it will just work in real life examples as well.
‫So we're going to focus on that.
‫Of course we can delete
‫or change the code from here
‫but it won't do much,
‫because we need to build
‫this app one more time using APK tool, right?
‫But using jdax we we have now understood
‫where to look for.
‫So I'm going to open the APK tool folder
‫and find the com.android
‫.insecurebankv2,
‫and over here we will see
‫the PostLogin.smali like this,
‫and we're going to focus on that one.
‫So I'm going to open this PostLogin.smali, okay?
‫And we are going to manipulate it, right?
‫And I'm going to say Open,
‫and it doesn't give me Geany.
‫So let me try to find Geany
‫from here like that,
‫and here you go.
‫So I think we are gonna have
‫to wait a little bit
‫for some reason.
‫Let me try to open the Geany
‫and see if something's wrong.
‫Yeah, I believe this is blocking it.
‫So actually we can't just close this down,
‫but I'm going to try
‫this one more time,
‫let me come over here and find it again.
‫Like I can open this
‫with any other app like Text editor
‫or Sublime Text,
‫but I'm gonna try with Geany one more time.
‫If it doesn't work,
‫I'm going to try something else,
‫yeah, it doesn't work.
‫So let me close this down
‫and try this one last time.
‫Come on Geany,
‫and yeah, here you go,
‫now it's working.
‫So we have this smali file over here,
‫let me zoom in a little bit, okay?
‫And of course this is very ugly
‫when we compared to the Java code,
‫it is a little bit difficult,
‫and it's a little bit different
‫than what we used to see,
‫but right now we know how to look for things,
‫like I can just search
‫for showRootStatus
‫and it will take us there like that, right?
‫So as you can see
‫in line 48 we have this PostLogin looking
‫for showRootStatus methods, okay?
‫Calling the showRootStatus methods.
‫And that is not exactly
‫what we are looking for,
‫because we are looking for the content,
‫we're looking for the code inside
‫of this showRootStatus.
‫So I believe we can search one more time
‫and here you go,
‫now we see the method of showRootStatus,
‫this is exactly what we are looking for.
‫So you know how to read Dalvik,
‫at least a little bit.
‫for example,
‫we have three local variables over here, right?
‫We know that,
‫and if we scroll down a little bit,
‫we can see a const-string like this,
‫so we can understand
‫that /system/app/Superuser.apk is
‫going to be used somewhere, okay?
‫And over here we see
‫doesSuperuserApkExist method,
‫and it search searches for this string
‫that that is defined
‫on the previous line like that.
‫So it searches for this thing,
‫and if it finds it,
‫it will just move the result
‫to some register called v2, okay?
‫If we come over here,
‫we see conditions,
‫like condition zero
‫and some other conditions as well,
‫so like cond_1 and cond_2.
‫So this is like an if case, okay?
‫If statement.
‫So it's looking for something,
‫and if that holds,
‫if that condition holds,
‫it takes us somewhere.
‫If it doesn't hold,
‫it takes us other somewhere, okay?
‫And we're going to try
‫and see what are those things.
‫So if you come over here,
‫we see that isrooted, okay?
‫And we see that local register
‫isrooted over here,
‫and we see something like this,
‫if-ne v0, v1,
‫cond_2.
‫So what does it even mean?
‫It means that if-ne means
‫that if not equal to, okay?
‫So we see something like this
‫if not equal to,
‫if v0 and v1 is not equal to each other,
‫it takes us to something called condition two.
‫So we don't know what a condition two is
‫like just let me search for it, okay?
‫And if you come over here we can see
‫the condition 2,
‫and as you can see in
‫the condition 2 we get Device not Rooted.
‫So right now we know condition 2 is
‫the thing that we are looking for.
‫And in this code,
‫in this Dalvik bytecode,
‫we go to condition 2,
‫as long as v0 and v1 is
‫actually are not equal to each other, Okay?
‫So what we want to do instead?
‫We want to go to condition 2 no matter what.
‫So we don't want this equation,
‫we don't want this if statement,
‫we don't want any conditions,
‫no matter what,
‫we want to go to condition 2.
‫And in order to do that,
‫I'm just going to disable it like this
‫by putting a hash,
‫and I can of course delete it as well,
‫but I'm not gonna do that, okay?
‫And I will write goto like this,
‫so it will take us
‫to some condition that I will specify like that,
‫so it means that go to condition two,
‫it will just take us to condition two.
‫and since I have disabled this,
‫now I can save it,
‫and it won't even look for this equation,
‫it won't look for this statement,
‫and it'll just take us directly
‫to the condition 2.
‫Now I'm gonna delete this, okay?
‫Because we are going
‫to build our APK one more time.
‫So I'm going to come over here
‫and I'm of course going to use
‫the apktool, rather than d,
‫I'm going to call this b,
‫because we are building it,
‫and I'm going to build it.
‫Since I haven't specified
‫an output APK name,
‫it will put the APK inside of our folder,
‫current folder insecurebank folder,
‫we're going to find this APK
‫and we are going to run it
‫on our Genymotion emulator.
‫So wait until this is built like this,
‫and if you come over to dist,
‫you will see the newly created APK, okay?
‫Just I'm going to take this
‫to my desktop,
‫and of course it's time to try this.
‫So over here I believe we have
‫to open the Genymotion
‫and we have to delete the existing one
‫and then install the new thing.
‫So of course we have
‫to sign it first, right?
‫We have created an APK.
‫So I'm going to use keytool and Jar signer,
‫like we did before,
‫so I'm just going to copy and paste those
‫because we have done
‫this several times by now,
‫I believe you figured out
‫how to do it yourself.
‫So I'm going to give you the password,
‫and it will ask before some credentials,
‫I'm not going to give it,
‫but if it's asks if it's true or not,
‫I'm gonna say yes it's correct,
‫and it will create me a key store,
‫and by using this key store,
‫I'm going to sign the APK file.
‫Of course, we have to change the name
‫of the APK file
‫before we use ngroktest, I believe,
‫so I'm going to just write
‫InsecureBankv2.apk over here,
‫and it'll ask me
‫for my previously chosen password,
‫if I give it and hit Enter.
‫Here you go,
‫now it's signed for me.
‫So let me just open the Genymotion,
‫and we have to close this down like that,
‫and we have to uninstall this, okay?
‫So let me try to uninstall this like that, okay?
‫And now we can actually try
‫to install the fresh one.
‫However, before we do
‫that I'm going to show you
‫a setting of the Genymotion,
‫it's actually a setting
‫of the Android devices, okay?
‫So I'm gonna come over here to settings
‫and I'm going to find
‫the System settings like this,
‫and I'm going to come over here
‫to About phone,
‫and find the Build number.
‫So I'm going to click over here
‫like six or seven times,
‫it'll make me a developer, okay?
‫And after being a developer,
‫I'm going to come over here,
‫and search for Developer options,
‫and under Developer options
‫you will have something like USB debugging,
‫make sure it's enabled, okay?
‫Or it may cause you some problems
‫when you try to install the fresh APKs,
‫and it will let me see
‫if we have something funny over here,
‫like Verify apps over USB,
‫we make sure this is disabled, okay?
‫We don't have to verify things,
‫we're just testing
‫with our emulator over here.
‫And I'm going to install
‫this one like that,
‫and I'm going to come over here
‫and say dnesh,
‫I think the password
‫was dnesh@123$.
‫If I say Login,
‫yeah, it asks me for my Server IP
‫which is correct,
‫we forgot to do it.
‫So I'm going to say
‫192.168.1.21,
‫and say Submit,
‫and then Login and here we go,
‫now we see the Device not Rooted
‫message over here.
‫So we managed to bypass
‫the root detection for our app,
‫which is very good,
‫which is a good starting point for us,
‫and we have practiced
‫what we have learned so far,
‫we didn't even learn a new skill here,
‫we have just practiced the old ones
‫because we have learned
‫so much until this point, right?
‫So it's good.
‫So we are going to stop here,
‫and we're going to continue
‫within the next lecture.