For the next section we're going to be taking a look at the different ways of saving data and which
ones are potentially insecure.
And one thing that's going to help a lot with this is actually having access to a reading device or
device that we can use super user with energy to do this.
We can do it using emulators inside of Android Studio.
So this doesn't require you to route a device or have your own routed device or actually a few that
are built into Android Studio.
But the way of accessing them is not always particularly clear.
So I'm going to show you how to setup a routed device and access it through HDB through this through
Android Studio.
So we're going to create a virtual device as we typically do.
And the devices that I like to use for these are any of the ones with the placed or icons on them.
And usually for instance I would pick one that is just sort of like a generic device.
There's generic devices are usually just like more compatible with the different images but it does
it really matter in reality which when you pick really any of these will work.
But I think without the placed or icon it's typically what we want to stick with.
So I'm going to pick the five point four inch FTB VBA I will hit next.
Now the image that we're using is also very important instead of using the typical recommended images
we want to use an x 86 image and we want to use one that will not have the Google API included or.
Well you can pick any of the ones in the Google API as well but you want to pick one from here that
doesn't help like.
The typical place setup the one I mean by that is essentially like when you're taking a look at these
ones these ones are for specifically by Google Inc.
And these ones are through the android open source project.
So to give a little bit of background.
Android is an open source operating system which means that anyone could build images of them the images
that are in the 86 images are more generic and essentially the benefit of this is that we're able to
do things such as like accessing the permissions on them rather than the ones that are built by Google
which they have locked down to the point where you aren't able to access them without finding some form
of exploit to be able to do that.
So in this case I'm using the the PI one which is nine point so the 86 built so once you've selected
the one that you want to use you can click next and then we'll give it a name.
I'll just call this one name.
I'll call it routed to because I already have one that's routed and we'll press finish.
Now when we put this up we'll get the typical sort of android emulator device.
This specific one that I picked has a bit of a larger resolution compared to the original one that we
were working with.
So I'm gonna go ahead and let this boot.
And while that's booting up I'm gonna launch up my command line and what I want to do is going to demonstrate
to you how you can enable the route permissions and the route aspects of Android through this device.
So once you have the device put it up you're able to still utilize like ADP in the same place you could
do a ADP shell to shell into the device.
You can also use ADP install to install the applications onto the device that we've been using.
The main thing is once you're inside of the shell typically we don't have full permissions.
You can see here permissions are denied for instance.
Now if you want to fix this you can just type in Eskew and this will escort you to super user which
you can tell by the pound symbol that is now on the command line instead of the dollar sign.
Once you have this you'll see that you know we can get the permission denied errors.
This means that you are now a user on the device.
So it's really as simple as this.
Now again the reason I want to show you this is because there are specific folders such as data folders
here that will store data for all of the applications.
And as you can see as a root user we can access these files.
So what are the times when people are making applications they'll see data to these files that is sensitive
data.
And if we're able to access it as a root user then it could potentially mean that there are vulnerabilities.
For instance if they're stirring things like their api keys or something like that or the string data
that database that is confidential to them then we might be able to access that and be able to exploit
that information.
So that's a we'll take a look at the next video for this I just want to show you how to get rid of device
through the entry data ADP system.