Welcome back, guys.
In the last video, we have enabled these developer options and in this video we want to have a closer
look on them.
I mean, we go briefly over most of them, but to a very special one is the point, the location and
the other one is the Bluetooth work.
So for this video right now, we start with the point location, which is absolutely underrated.
And in this video I will show you why.
So let's have a look.
All right.
Here we are back in the Ubuntu VM.
And yes, we have enabled those developer options.
So what we need to do is simply plug in and USB cable into this device.
Let's do this.
All right.
And then we are opening a new shell and we type in ADB shell to make a connection to see if everything
is working.
And let's see.
Yes.
All right.
If the screen changes from this fancy color to WALL-E, then we know now we are on the device.
Perfect.
This one is working, which means we can now establish the or we can now transfer the screen on our
laptop with screen copy because this one is using ADB.
All right.
Here we have it.
In case if you encounter some errors, there is a huge section in the cheat sheet which yeah, the scribe,
I guess most of these errors I have encountered in the last seven years, the things that might occur
right now is a screen appearing on your smartphone, because if you do not check this box and do not
always trust it, you have to accept it all the time.
The other one could be that use P three is not enabled on this device I have encountered.
This causes some problems and the last one is that USB charging is enabled.
So simply go into the data transfer option on your sorry, into the data into the USB option of your
device.
This way if we can see charging device by a USB and sometimes I do not know why we have to select file
transfer and then we also get access to the SD card and things like this.
Okay.
All right.
In my case, it works with no data transfer, but I have encountered some issues with this, so please
try this out.
All right.
And back to this one.
So let's have a brief look into some useful developer options and then a closer look onto the point
location.
All right.
So system system advanced developer options.
Here we have them.
I mean, the first one is memory usage back report.
It's regarding to developers.
So that's not that interesting.
This one enabled Bluetooth his new block.
This will be a separate video afterwards because this is super amazing and we will use this to analyze
and mobile application that communicates with them within Bluetooth low energy device.
Then we will create this lock and see what information can we get out of this and also how we can use
them to hack in another application.
The the tempo is really fast regarding to the beginning right now.
But don't worry, this is only in this section where we get introduced to this device and all these
options later on.
If we perform some exercises, we start very slow and then increase further.
Furthermore, because I do not want to get too fast into one topic, so after this section, after the
device instruction, I guess it will be more convenient and convenient curve into all this Android epic.
All right.
Okay.
What's also interesting is this OEM unlocking.
So the boot sorry, the bootloader is already unlocked, the bootloader is being protected, but we
can unprotected by unlocking it.
And this means we can now flash custom roms on this device, for example, lineageos or also an custom
recovery like team win project, I guess pt wrp is it?
It's the short term.
So this one allows us to flash and a certain binary on this device.
For example, the Metrowest binary, which enables root access on a device.
I do not want to go too deep into rooting and device because it's different for every manufacturer,
for every version, for every device model and things like this.
So it's it cannot be summarized in in one video, but nevertheless, you will find an rooting example
for most common devices in the cheat sheet.
In case if you have certain questions, write me a message.
I try my best to help you out on this.
But keep in mind, if the rooting goes wrong, you might break your device.
And rooting is not required for this course because all we do with root access is already enabled in
our virtual machine.
So you do not need to break any device for this course over here.
Okay.
In my case, I had two heartbreaks.
So there is a soft break, which means we can recover it via software, but in heartbreak means we do
not get access to this device anymore.
And yes, I predict to in my last seven years.
So it was at the beginning, you can really make quickly and mistake and therefore be careful.
If you're doing this already, then what ads do we have?
The rest?
Not that interesting, you speedy packing.
I mean, this is the key feature.
Oh, let's see and select it back up.
This is also pretty cool.
We can debug applications on our Android device and if we select this one over here, it means if we
start this application then an debug port will be enabled which can be used to attach to it.
So we can then attach to this debug port and inspect the memory.
Change variables, pause and halt on certain functions and do a lot of funny things.
We will have a chapter on this at the end of this course because debugging, it's a little bit more
complex.
All right.
Okay.
If you talk about debugging, then also this wait for the backup.
Because if we start this application and if we try to attach to this, the application needs to pause
immediately.
Otherwise we lose the information if the application has been already started and executed some code.
So that's what this one is being used for.
If this is being enabled, the application starts but it doesn't run, so it immediately halts after
starting this app and we can then attach to it and we have the whole code in front of us.
All right.
Okay.
And then let's see.
The rest is not that interesting wifi stuff.
Yes.
Yeah, we've got the point, the location.
But I guess we missed this marking location.
So where we can fake GPS coordinates.
And let's quickly let's quickly scroll up before we dive too deep into this.
Okay.
For whatever reason, I'm not seeing it right now.
But I mean, this is why we have this search pattern over here.
So let's use this.
And we are searching for MOC select MOC location app and here we have it.
All right, so this one is also pretty handy.
We can use this to fake g b as coordinates for certain applications, but there's little downside to
this one because this does not work for all apps, which means, for example, the Google Maps application
doesn't rely on this one.
We cannot fake GPS coordinates for Google Maps.
It also might affect other applications.
But don't worry, I have a better solution for this one in the Frida section.
But we talk about runtime manipulation.
We will hook into the memory of our application or let's say into the memory of our smartphone.
And then we can exchange classes, methods, variables, instances, objects or this kind of stuff.
Absolutely amazing.
Right.
So we will use this to yeah.
To exchange the information in the method that retrieves the GPS location from smartphone, which means
every time an application fetches GPS coordinates, we can make the decision what coordinates should
be transferred to this application, which means we can be everywhere on this whole planet for every
application on our device.
This is absolutely awesome.
And yeah, this is what we are going to do in the Freedom section.
All right, then back to the point location and that's scroll down or let's simply use this search.
Let's use this search pointer location.
Well, all right.
Here we have it.
So point a location, screen overlay, showing current touch data.
You might ask yourself the question, why should this be that high p right now?
Is high P even a word, I guess?
Yes.
If not, we are creating this right now, so why should this be absolutely high?
P The reason for this is we can use this in many ways.
For example, if we are testing banking applications, then we have to insert a lot of data all the
time, large numbers and things like this into certain form fields.
By having the pointer location, we can address these form fields in our own scripts.
We can write short scripts that fill out several form fields, perform events on this device and other
amazing things.
But before I keep talking, why not simply figuring this out?
Right?
So let's enable pointer location and now we can see we've got a new touch bar over here.
So let's go back now.
It's a little bit more visible.
So here we can see x, y, x, v, why re and some other stuff.
If we now perform and click on our device, we can also simulate this with the left mouse button.
Then we've got those lines that shows us the exact position of our cursor.
And on the top navigation, we can now see the x and Y coordinates of our mouse button.
If we now track around, then we can also see where our mouse has has moved.
So these are very useful information to also hack certain applications, for example, online games.
But keep in mind, manipulating online games to get an advantage is not allowed.
So you are not allowed to do this unless you have the permission of the author.
I couldn't find an author that gave me the permission to do this.
Therefore, I have created my own app and if I show this right now to you, you might ask yourself the
question why I'm still doing app hacking and not app developing because this application is absolutely
awesome.
So therefore, let's have a look into this one because this is mobile game, very principle.
This game is based on is used in a large amount of mobile games out there.
So let's see how we can manipulate this.
All right.
Now we have and we have a lot of new topics thrown into this video.
And the tempo is really fast right now.
But don't worry, during this course, we will start a little bit more slow on new topics.
But I just want to give you some impressions, what we are going to do in this course right now.
I mean, this is it's not even close to be defined level, but I guess it's already fun at the beginning.
Okay.
So if we go into the attachment of the section, we will find mobile game.
I have already downloaded it and here we have it.
It's named App Game.
App K sounds absolutely promising, but nevertheless let's install it.
So here we've got an APK file and an APK file.
It's mobile application bundled into this file.
This is now a real app.
Normally we do not see those files because we installed via the Google play store and therefore we we
are not seeing an APK.
But if you are not installing an application, if you write our own, then we will output it into an
APK and this one can be now installed by the ADB shell.
So without having your google play store even on our device, how can we do this?
Well, let's see.
I'm doing a right click open and Termina.
Later on we will have an extensive view into all these ADB commands.
But for now I just want to provide you some impressions about this epic course.
Okay.
So if you want to install it, we are using ADB install and then the name we need to have an ADB connection.
So maybe you need to perform an ADB shell to see if everything works.
Then you can exit out and install it in this way.
Otherwise if you run ADB install, it should automatically happen that an ADB connection will be made
to this device.
So yeah, that's all the application has been installed.
Let's see.
Yes.
We've got this clicking game.
Wonderful.
I hope it's visible.
A flower.
This should be a flower.
Let's open this one.
And here we have it.
Does this look amazing?
Absolutely right.
So let's close this part.
So what is this game about?
I mean, the principle is super symbol.
And if you look at this, you might think, well, this is absolutely dumb, but I can name you ten
games, which exactly rely on this principle that have millions of downloads.
So let's see, we've got some fancy local looking apples over here and here.
What we need to do is we need to collect them.
If we click on the apple, then we can see the score increases.
The apple turns grey for a certain amount of time, and during this great phase, we cannot click it
once again.
So our aim right now would be reaching a score from about, let's say, 500,000.
Let's see how quick we can get there.
All right.
We are collecting all of them and we can see they disappear randomly.
So there's some random number generator that blocks this apple for a certain amount of time.
Okay.
I'm a 2000.
You know what?
I give up right now.
This is absolutely dumb to play this too.
Level till 500,000.
Right.
So let's try automating this process.
And this one is super easy with the pointer location.
So here we've got the coordinates, X and y.
And what we can do is we can send touch events based on coordinates.
We can also send texts and other stuff.
But for now, touch events would be right enough.
Okay, so let's see here.
We can see the coordinates are 556 527.
We do not need to be very precise because this area is pretty large.
We can click on.
So I would suggest 522, 548, for example.
Okay.
Now the question, how can we send this touch event?
And the answer for this one is once again, the ADB shell.
So let's go back into this one and we show I put this on the right side that we can see it.
The command we're using is input.
And this command looks a little bit complex, but I guess it isn't that complex.
So we've got input, then we've got the sources and the sources are deep head keyboard, mouse touchpad,
gamepad joystick, touch screen and so on.
In our case right now, we want to send an event to the touch screen.
Therefore, we are using simply trusty touch screen.
Then we've got display ID.
This can be ignored.
Then we've gotten command commands will be found over here and then we've got the arguments for this
command.
So therefore let's have a look.
Input text would mean default location is touch screen.
We can send a text to touch screen.
This is absolutely handy if you test banking applications then you have to fill out ten digit numbers
and yeah, always typing in them on on the screen is super annoying.
Therefore you can write your own script based on this phone.
But we do not want to send text.
We want to send touch events and this is what we are having here.
Tap.
Tap is in touch event on the screen.
We can also send swipe commands, which is also pretty amazing.
So here we have to define the starting point of this type command.
For example, here the end coordinates of the swipe command, for example, over here, and then the
duration, how long we should smile.
So let's say 500 milliseconds.
Then you would have something like this.
Can be useful in games.
We will definitely use this later on in an application.
I mean later on in an application.
I'm super excited to tell you already about this.
We will have an app to to be invincible, invisible, get infinitive lives, coins, high score things
like this.
And then we will use the swipe command to fully automate this game.
So it's absolutely ridiculous, right?
So we will have one game and then we will automate this game that we do not have to play it anymore.
Yes.
It doesn't make that much fun anymore, but it's really exciting to watch.
So this is what we're going to do later on in this course.
All right.
But for now, let's get back to our game.
We want to send input tap and then we need to provide those coordinates.
I get a little bit to hype up right now.
Sorry for this.
I focus right now on the topic.
So input tab, let's try this out.
Let's get, for example, this app.
750 756 750 756.
We have to wait.
Okay, now it's ready again.
So I'm doing this in 3 to 1.
Amazing.
Right?
So we can see the apple has been pressed.
What we need to do is simply getting all these coordinates and then performing this in a by loop and
we're done.
Let's do this.
And to do this, I also want to introduce an ENCODE editor, which is super handy.
The code editor is visits to the code and this one has some nice features like multi cursor, which
are super handy during this course to download it and let's simply search for it.
So simply Visual Studio code and if you go into code, Visual Studio dot com.
And then we already get this deep end package.
I have downloaded it and now we simply install it.
So over here I've got the stadium package and now I'm performing right click open and terminal and now
it's oh yes, I, I was already typing ADB installed, but I mean we are here on the Linux system.
So to install this package we need root privileges and DPI key dash I and then the package name inserting
our password.
And now this visits to the code ID, it will be installed all right.
And took a while.
But we are good to go.
So let's close this.
And now on activities.
We simply can search for code.
And here we have it.
So now let's open this one.
We create a new file, and then we can also select the language on the bottom, right?
So I mean, we could select, for example, shell script, but our shell script is not that huge that
I'm not sure if there's even an in syntax highlighting for this one.
All right.
But before we go into shell scripting, let's first collect the status and then write the script.
Okay.
So we need to get those coordinates.
Let's do this once again.
746 748 746 740 864
109.
References.
Yes.
Okay.
So now we've got these coordinates and we need to insert input tab in front of all of them and now we
can make use of the multi cursor highlight so we can for example, hit control F and then we can provide
this one, this Asterix which means we can, we can play around with the regular expressions.
I know I'm also not a big fan of regular expressions, but a few of them are super handy.
For example, if you want to insert an text in front of every single line right now, what we can do
is we can say, Please select me, the first character of every line, and all we need to do is hitting
this one, which is the beginning of the line and that's already enough.
Amazing, right?
So that's already enough.
We do not need to have this thought.
Yes.
So that's enough.
And now I'm hitting option enter and we get this blinking cursor.
So now I can simply select or type in input text and we have selected or inserted in text in front of
every line.
So we have now the half of our script already ready.
But first let's see if the coordinates are correct.
So let's copy them.
Now let's go back into our ADB shell and now let's insert them two, three, four and five.
Perfect.
All coordinates has been hit.
We have get a lot of points, but we do not want to repeat this over and over again.
We want to have this in an infinite loop.
And yes, I'm not even being close.
A good script apart.
At least some basic features are available for me right now.
And these are enough during this course.
We I guess we are not using best during this course anymore.
Yes.
We are not using it because later we we rely on Python.
But keep in mind, if we are performing something with ADB, if we if we get the Python framework on
our laptop, then we can also use this in a script.
But all the time in ADB connection is being made, the command is being executed and we have to wait.
So therefore, in my opinion, the best option to run in best script for this device is running it on
the device like in this shell over here.
So that's the that's the best performance, even if the performance is at all.
Not that good.
All right.
But back to this one.
So how can we put this into an infinite loop in bash?
One option is looking on StackOverflow.
I guess this is also the best option.
But I mean, this is something which is not too hard.
So we can simply say while true and normally I would immediately add this code, but this is Python
syntax, not bash.
So by true then we have to tell where the loop begins.
We are doing this with do so.
Please execute those commands and then we need to tell when we are finished.
So simply done and that's all.
So this is our whole script to hack this game over here, which can be applied to other online games,
but therefore you have to ask for permission.
All right, so let's copy this.
Let's put this on the right and then let's let's start this in 3 to 1.
Oh, nice, isn't it?
So now we can lean back and relax.
Why this app is being played by the script over here.
So this principle, I mean, it doesn't look that nice, but you can imagine a lot of games where exactly
this one is required sitting there for hours and hours and simply hitting your screen to collect certain
things.
All right.
So this is all for this video right now.
You do not have to wait until you hit the 500,000 points to move on in this course.
If you want to stop this, we can simply hit control C and then the script simply stops.
It's already mentioned at the beginning.
The tempo right now is a little bit high, but all of this take this as an impression and not as an
learning experience.
Regarding to the next video, we will have to look into the Bluetooth low energy connection, and this
one might be also a little bit overwhelming at the beginning.
I just want to show you some tricks to analyze this.
And during this course, it's not long being required.
So during this course we will perform some really awesome and complex hacks, but we will explain them
very deeply.
So we will we will start slow and then we will raise this curve slowly and steady.
Okay.
So, yes, as already mentioned, take this as an impression and otherwise, I'm looking forward to
see you in the next video.