- Welcome to the new video of Android Security and Exploitation by Pentester
Academy. My name is Aditya and I am your course instructor for this entire training
series. So, in the last few videos we have gone through how you can debug and hook
into the various API methods and calls of your application and basically analyze
what the application is doing, what kind of methods it is calling, what are the
different arguments, and all these different kind of things. But one of the
problems is even if you are able to analyze the application and maybe you can
modify some of the variables, how do you make these changes permanent. So, in those
particular situations, the debugging and hooking which we have done so far will not
be that much useful. One of the ways in which you can actually do it is by
patching the application by reverse engineering and then adding your changes
and recompiling them back. But it is often too much time consuming and it's really,
really complicated in some of the cases. So, one of the really good alternatives
which we have over here is we can use something called a Cydia Substrate as well
as another framework called Xposed in order to make permanent changes to the
application. So for this particular video we'll go through how you can make changes
for your application or basically patch your application without doing any apk
modification using Cydia Substrate. Now, Cydia is a platform for customizing your
applications. So, Cydia is written by the guy, Jay Freeman who is also known as
Saurik and he has written great bunch of software for IOS jail-breaking and all
these kind of things. So, Cydia and Android or Cydia Substrate and Android
provides you with an API with which you can hook into an application methods and
API calls and from there you can simply change the behavior of the application and
it's really simple to do that. So, for this particular situation we'll take the
example of an application called Listlock which written by the team at GDS Security
and you can basically download the application as well as the bypass at this
GitHub URL. So, once you have downloaded the application, you can then go ahead and
install it. So, let me just install the application real quick.
So, let me first see if I have the device
connected. I'll just connect my Genymotion over here which 57.101. Then, I can go
ahead and install the Listlock.apk. Let me first locate the Listlock.apk.
Or I can simply download it from GitHub which will be much more convenient.
Great. So, now I have the Listlock.apk over here and I can simply go ahead and
install it.
So, this is how the application looks like which says that the list is currently
locked and we don't know the password obviously. So, let's try with any random
password. All right, it simply refuses to unlock the application. So, what we can do
here is we can try to reverse the application and figure out which method is
responsible for authenticating the user. So, we can use a dex2jar in order to
reverse the application.
Once dex2jar has successfully converted it to a jar, you can simply use jd-gui in
order to view the jar.
So, if you look over here, the package name is com.historypeats.listlock. If we
go inside the classes there is a Authenticate class over here and inside
the Authenticate Class you see an interesting method that is called validate
password and if you look closely, it's simply taking in two arguments or one
argument in this case which is the input. Most probably the input which the user has
supplied and validating it against the actual password. So, this is how the
application looks like and this is how the application is authenticating the user. So
now we can go ahead and try to bypass this using Cydia Substrate, but before actually
doing it we need to get ourselves familiar with the Cydia Substrate API so that we
can write our own module on top of the Cydia Substrate. So one of the most
important things in Cydia Substrate is the MS.hookClassLoad which basically notifies
you whenever a particular class or particular application class gets active.
So unlike IOS in Java or in Android, the classes are not active all the time. So
once the class gets activated, then you can hook into it and basically change all
the input variables, or basically even change the return value. So you can use
MS.hookClassLoad to notify you whenever the class gets active, and once you know
that the class is active, you can use the MS.hookMethod to make all the changes. And
you can simply have a look at the Cydia API by going to the Cydia Substrate API
webpage, and... So you can check out the MS.hookClassLoad, MS.hookMethod, what they
actually do. This is kind of broken. Anyways, so coming back. So Cydia
Substrate API, you can use MS.hookClassLoad to basically tell Cydia
that this is the method and this is the class that you are looking for and once
that class and method gets activated, it will simply let you know. Here you can
make all the changes whichever you want. So we have reversed the application, we
have identified the method responsible for validating the password, but how do we
actually make the authentication successful? The answer lies in the
application source code itself. So if you look over here, it says, public boolean
validatePassword. This means that the return type is boolean, which simply means
that if the user has successfully entered the correct password, it will simply
return it true and if the user hasn't inputted a correct password, it will
return a false. So all we need to do is change the return value to be true no
matter what the user has entered. Simply start up my eclipse which is the IDE for
Android application development. I have a list bypass project already created over
here, which if you get to ListBypass. Basically it's the VI SRC, gdsecurity
listbypass.java. Excuse me. So if you'll look over here, we have mentioned the
class name and we are using the MS.hookClassLoad to see when the class
gets activated and we've also mentioned the method name, which is the validate
password and if the class and method matches, that it is currently loaded, it
further goes ahead and uses the MS.hookMethod in order to change some of
the components. So what it does is it changes the original return value with a
new return value which is true. So, no matter what the original return value is,
the new return value will be used in this particular case and that is returning true
all the times. You can simply...run this application.
Let's make sure that we have Genymotion
connected, which it is. Install it. So if you notice over here the Substrate
extensions have updated. So, all you need to do is drag down the top navigation bar
and click on the substrate extensions and then you simply restart system soft which
will allow Cydia to add all the extensions to the Android system. And now if you go
to the ListLock, let's try to enter any password, and click unlock and you have
the application unlocked. Also you can check it in the logcat. So if you do adb
logcat, you'll see that the class was loaded, the method was hooked and the
original return value was false because we didn't enter the correct password. But
Cydia actually went ahead and changed the return value to true and that is why we
were able to authenticate ourselves. So this is how we can basically change or
modify the application behavior using Cydia Substrate and it is really one of
the most interesting things which you can do in an Android. So that's all for this
video. I hope you liked the video and if you have any feedback and queries, feel
free to drop me a mail at adi@attify.com. You can also tweet out to me @adi1391.
Thanks for watching the video.