‫Instructor: Hi.
‫Within this lecture we are going to manipulate our app
‫so that it won't detect the jail break, but it will take us
‫to the second view controller every time we
‫hit the test button.
‫And as you can see, even
‫though we don't know anything about assembly, okay
‫even if you don't know, you can still find some clues.
‫You can still find some hints
‫that you can use in real reverse engineering process.
‫And if this has worked, like we called
‫we tried to call this print methods.
‫If this has printed out the methods
‫then we would have seen the SGL broken method
‫and we would have understood it in a better way.
‫But even though it didn't work, it doesn't still matter
‫because we can't see it in our hyper disassembler.
‫So just try to understand where you should look.
‫Okay, we have seen the test button.
‫We search for test and now we
‫then we knew that there is a function called test click
‫and then we focused on that.
‫So make sure you open your detect jail
‫and run CYC repeat detect jail one more time.
‫And I'm going to call this
‫UIapp.keywindow.routeviewcontroller again.
‫And as you can see our view controller
‫is named view controller.
‫And then I'm going to say viewController.prototype.
‫So if we want to manipulate any method
‫like this is jail broken, rather
‫than saying view controller dot jail is jail broken,
‫we are gonna have to say
‫viewController.prototype and then .isJailbroken.
‫And of course this is jailbroken should be spelled exactly
‫the same as we see in the assembler like this.
‫So viewController.prototype.isJailbroken.
‫Now I can make this equal to anything I want.
‫Now I can write some new JavaScript code
‫in order to replace this function in run time.
‫Now my iPad is connected to the internet
‫and I am connecting it to it via SSH
‫and I am actually manipulating it in the wrong time.
‫So I'm going to assign this function to
‫return zero, return false to me every time it's called.
‫So I'm going to say function and open and close parentheses.
‫Then I'm going to use curly braces to actually
‫write the code itself.
‫So all I'm going to do is to say return false
‫and then semicolon
‫and then close the curly braces like this.
‫So maybe it looks very simple to you.
‫Okay?
‫And maybe you think that this
‫is actually a very simple exercise
‫but this will work pretty much in every app.
‫If you find related application related method
‫and related view controller like this.
‫Here you go.
‫Now, when I hit on the test button, it actually
‫takes me to the second view controller where
‫I can see the flag itself.
‫Flag is Barley and Barley's, my dog.
‫And we managed to complete the CTF.
‫And again, maybe you're thinking right now.
‫Yeah, it was too easy.
‫All you had to do is just write to return false
‫and you knew that it's returning either true or false
‫but it shouldn't be necessarily the case.
‫Maybe we could have returned 10 or returned five in a game
‫or maybe we could have returned true
‫in a game in order to do some cheating.
‫And I have seen a lot
‫of examples where people actually manage to hack into games
‫hack into other apps
‫or big projects using exactly this method
‫by manipulating the function and it
‫it really works in real life.
‫It's a matter of digging deeper.
‫So you have to be a proficient in SWIFT or in objective
‫see in any programming language
‫in order to understand where to look.
‫For example, if you're looking for a hack in a game, like
‫if you're trying to find some vulnerabilities in a game
‫maybe game is using a function in order to define
‫if you made a purchase for some extra life or extra items.
‫I don't know.
‫And most probably this function is returning zero
‫or one or like false and true.
‫Then you can change it
‫to false or true in order to manipulate it
‫exactly using this method, right?
‫So all you have to do is just around the hopper disassembler
‫against the IPA and try to locate the related function.
‫And it's not very easy to do so, okay?
‫As you can see, if I run it one more time
‫it'll return to the original state.
‫You are not changing the app itself
‫you're manipulating it in runtime.
‫However, you can do whatever you wanna do with this.
‫For example, if you're playing an online game
‫you can manipulate your score and if your score gets sent
‫to the server, then your score will be recorded
‫so in that server, okay?
‫And make sure you try to get familiarized
‫with this hopper disassembler.
‫Make sure you try to read the lines
‫make sure you try Cyc reps.
‫Make sure you do the jail breaking
‫in a proper way in order to understand
‫and comprehend all of those things in a better way.
‫Make sure you try to build your,
‫build your apps on your own.
‫Make sure you purchase an iOS course
‫like mine or anyone else's on Udemy.
‫You order to understand this in a better way
‫so that you can actually find vulnerabilities
‫security breaches in most efficient way.
‫So now we're going to take a look
‫at challenges in SWIFT applications
‫and then we are going to end this section.