‫Narrator: Hi, within this lecture
‫we're going to deep dive into this model
‫that we have found
‫and actually this method that we have found.
‫And we're going to take a look
‫at Dalvik bytecode as well
‫and manipulate our app.
‫So far we have understood
‫that this looks for something containing some string input
‫and this annotation suggests
‫that it either returns one or zero.
‫So we don't normally use this annotation in Java,
‫but it's commonly used in Swift,
‫for example, it means that it's looking for something
‫and as a result of this, it returns one or zero.
‫So if you see something
‫like this question mark and a column
‫it means that it's either returning this or that.
‫So let's try to find that out.
‫So let me just paste the F248 thing,
‫and let's see the usage of that.
‫And for some reason it doesn't show me.
‫Let's try to find this one.
‫Yep. So F2493Y, F2493Y.
‫So this is a game model object.
‫One more time.
‫So we have found out that a game model
‫or a custom class is used
‫and this custom class actually has some object
‫and that object
‫either contains the input or it doesn't contain.
‫So at this point we should get suspicious.
‫We should get suspicious that this object, whatever this is,
‫we don't know, most probably it's an array
‫but we are not certain at this point.
‫It either returns one,
‫if it contains something, or else it will return zero.
‫So let's go into Dalvik bytecode
‫and try to find the same thing.
‫Let's open our game activity.
‫Okay, small e-file.
‫I'm gonna use Geany one more time.
‫So let's find the Geany.
‫Yep, this is the one and double click on it
‫and the code will be opened for us.
‫And here is our Dalvik bytecode.
‫So first thing first, I'm gonna zoom in
‫so we can see it better, okay.
‫And then we will try to find the related methods
‫and we will try to make sense out of this Dalvik bytecode.
‫So let me make this a little bit bigger.
‫So here you go.
‫We still have the methods over here on create
‫and we have change category clicked.
‫So we had this method in the JDX files as well.
‫We had the on create as well.
‫We already have the send button clicked
‫and this is what we were looking for.
‫Okay, so great.
‫We have another thing called final qr here.
‫We don't know what this is,
‫but still we are interested
‫in finding send button clicked, right?
‫So if you come over here, you will see the same thing
‫but it's in the Dalvik bytecode
‫And right now we already have a suspicion, right?
‫It's looking for something that contains something.
‫And if it is the one that we are looking for,
‫if we change this to be returning one at all times
‫then we will have done a great job.
‫We will now hacked into this game.
‫But the problem here is that
‫if you don't know how Dalvik bytecode work
‫then you cannot find the related method or related line.
‫So we have to make sure that we dig deeper
‫we deep dive into this Dalvik bytecode
‫So we are going to work, we are going to look for hints.
‫So we already know that it looks
‫for something containing something.
‫And actually if you see over here
‫it actually looks for an array list containing an object.
‫So you can compare the Dalvik bytecode
‫and the JDX decompile code
‫to make a much better sense out of this one.
‫For example, here it's changing the score string, okay?
‫And over here there is a text view definition.
‫So it should be above this.
‫And over here at this four or five lines
‫we have the contains method as well.
‫So it should be one of these methods
‫one of these lines actually defining either one or zero.
‫So we narrowed down the possibilities.
‫So actually we can have a try
‫and fail at this moment
‫so that we can try to see which one works.
‫However, there are some still clues
‫that we can look for
‫and we can understand it in a much better way.
‫For example, we see this move result P1 thing.
‫It's right coming after the contains line
‫and it is used in this lines as well.
‫So what does move result mean?
‫And where is it coming from?
‫So this should be the question that we want to ask.
‫So if you go to our Dalvik opcodes,
‫like the Dalvik cheat sheet
‫that I have shared with you before
‫then we can see the move result command over here.
‫As you can see
‫it moves the result value of the previous method
‫into some variable or into some register.
‫So most probably at this point, we know
‫that after seeing for contains,
‫after checking for contains,
‫it moves the result to something called P1.
‫So this is the value that we are looking for.
‫If we can change this to return one
‫as P1 at any condition, at any given condition,
‫then we would get what we want, right?
‫And as you can see
‫there are some still other lines here using P1
‫and it's most probably going to be used to set the score.
‫So if you come over to this cheat sheet one more time
‫you can find the definition
‫of adding or subtracting integers.
‫Here we go.
‫We see the add-int,
‫and as you can see, it calculates the value.
‫So there is something or here named V zero
‫and it's adding DP1 into a V zero
‫and V zero is the current score.
‫And maybe at this point we don't know of that
‫but we are definitely sure
‫at this moment that P1 is used to set the score later on.
‫So this is where we should actually change the P1
‫into 1 no matter what.
‫So rather than moving the previous result into P1,
‫we can actually define the P1 as one, right?
‫All we had to do, all we have to do over here
‫is to find Dalvik bytecode in order to define an integer.
‫And that integer would be one in our case.
‫We can actually go for a higher score as well.
‫We can define that integer by 10, for example.
‫But we don't know if game has some kind of permission,
‫if it checks for, if score is greater than one
‫then it won't add, then we can fail actually.
‫So I'm gonna go for safe fruit,
‫which is const vx, lit32.
‫As you can see, this comment
‫puts the integer constant into vx.
‫So what we wanna do is to create vx like const P1,
‫and then give it a value of one.
‫So we are actually going to use this thing.
‫I'm gonna say const P1, one,
‫and I'm going to do that in our Dalvik bytecode.
‫So I'm going to delete this move results.
‫And rather than move result
‫I'm going to say const P1 comma one
‫and it will define P1 as one.
‫So no matter what, P1 will have the value of one.
‫So this is what we were looking for.
‫And as you can see, even though it's a very easy game,
‫even though it's a very small game,
‫it took us really some effort to find this one out.
‫So there isn't a guaranteed way for you
‫to make a hacking out of every game
‫or out of every app
‫but this time we managed to do it.
‫At least we think so.
‫So I'm going to close this down
‫and I'm going to build this from scratch
‫so that we can actually try
‫and see if this worked or not.
‫So if you come to this point
‫then it's a great way to take your break
‫and then go into the next lecture.