{% endhint %}
### Database
You might also notice `simplenosql.db` , which is stored in the `databases` folder. If you open it, there are only two tables.
Inside the table simplenosql, there are a couple of rows:
Each row appears to pertain to a 'bucket', which in our case is either albums or albums\_decoy. Inside the data column is quite a bit of JSON data:
It appears that this may provide some intelligence as to where our encrypted media could be stored. Let's see if we can find these files in the `files/media/orig/` directory as indicated.
### Encrypted Media
As expected, we have a number of jpg files with timestamps as names. If we view them using a hex editor we can see they appear to be high entropy crypto containers.
If we continue to look through the other encrypted media, the only obvious similarity you may note between them is that they all begin with 01 01.
# \[2] Perform static analysis to locate some functions of interest
To begin the static analysis phase, we will need a copy of our APK file to serve as our specimen. There are a number of ways to obtain this:
* Extract a sample from the device directly (see [guide here](/other-processes/extracting-apk-specimen-from-the-device))
* Work with the acquired device data.
* Note the version from your acquired content and download a website (like [APKPure](https://www.apkpure.com))
{% hint style="info" %}
In our lab, the specimen has already been obtained and can be found in the lab directory under "APKs".
{% endhint %}
Let's fire up [jadx gui](https://github.com/skylot/jadx/releases/). This is a free reverse engineering tool for Android APKs. It requires the Java Runtime Environment (JRE) 8 installed, but is also available prepackaged in a version that includes it. The releases page for jadx can be found [here](https://github.com/skylot/jadx/releases). Look for the download ending with "-with-jre-windows.zip".
Once launched, it will give you the following Open File dialog. If you downloaded the lab kit, look in the folder called 'APKs'. Double click to open the APK.
Once loaded, you can begin browsing through the list of classes on the lefthand side. You will see lots of entries beginning with 'android', 'com.facebook' etc. A lot of these are from libraries used by the app. Rather than sifting through this list manually, we will use the clues we established in Lab 1 in order to point us in the right direction.
To open up the text search window, press CTRL+SHIFT+F or select it from the Navigation menu.
The first time you open the text search, it will take some time as the app has to perform APK-wide decompilation. When finished, we are ready to start searching for our suspects.
Let's search for some values from [lab 1.2](/lab/1-lab-setup-and-initial-app-exploration/1.2-review-files-in-the-app-data-directory), starting with `pin`
So we do hits, but... 3k is a lot to go through and as you can see, there is significant false positives. So, what do we do? Well, in our case the key for pin is a string. In Java, strings are enclosed in double quotes. Let's modify our search to include double quotes and see how we do on results:
Much better. Now, instead of "android.support" (and many others) we are seeing only classes from within the "com.github.browep.privatephotovault" namespace and, if we look at the **Code** side of the view, we can see some super interesting stuff.
At this point, we have developed some leads to investigate using static analysis.
Looking at the list, in the class `CryptoUtils`, we see two calls to a function called `pinsMatch`, so let's check that out by double clicking on the result and then right clicking and choosing "go to declaration".
{% hint style="warning" %}
In this case, it turns out the target function is only a few lines away! But, **Go to declaration** is capable of looking across the whole APK and can be very useful.
{% endhint %}
Alright, so there's a couple of things happening here. However, rather than working to develop an understanding first, then testing later, let's dive in to some DBI to give us a bit of a roadmap to follow.
{% hint style="info" %}
Unlike many APKs, this one is not obfuscated. Were it obfuscated, instead of seeing `com.github.browep.privatephotovault.crypto.CryptoUtils.pinsMatch` we might see `a.b.a.c.d.d.a`.
If this happens, all is not lost, we simply have more work to do in terms of static analysis. Dealing with obfuscation is out of scope for this lab, but rest assured it's still very doable.
{% endhint %}
# \[3] Deploy method hooks using frida REPL
Alright, so - time to move on to DBI and inject Frida into our app!
#### Inject Frida
In the command prompt, navigate to the course scripts directory and type the following:
`frida -U --runtime=v8 -l privatePhotoVault.js -F`
To quickly pick apart the extra arguments we're passing:
* `-U` tells frida to look for a device connected via USB (virtually or otherwise)
* `--runtime=v8` tells frida to use a newer version of JavaScript which has a number of quality of life improvements. I generally always use it.
* `-l privatePhotoVault.js` tells frida to inject our course script with some pre-made functions useful for reversing.
* For more reading on frida command line arguments, see [frida](/frida-tool-reference/frida).
This should get you to the following terminal view (hereinafter called the [REPL](/frida-tool-reference/frida)):
If you made it here – excellent! Now, we’re ready to have some fun. If you’ve never written code before, that’s about to change! Don’t worry, we’ll take it slow!
#### Autocomplete / Intellisense
One thing Frida does that can make life a bit easier is provide a bit of good old intellisense. This means when you start typing, an autocomplete box appears which you can navigate with the up and down arrow keys.
In [Lab 2](/lab/2-perform-static-analysis-to-locate-some-functions-of-interest), we identified the pinsMatch function as a candidate for method hooking, so let's start with that.
#### Get your hooks in!
To apply a method hook, we will use the traceMethod command. traceMethod is from the Raptor iOS tracing script and takes the class name as a string.
`traceMethod('com.github.browep.privatephotovault.crypto.CryptoUtils.pinsMatch')`
If successful, you should see a message from Frida saying:
`Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.pinsMatch [1 overload(s)]`
{% hint style="warning" %}
If a class has multiple implementations of the same function name (each with different parameters), these are called **overloads**. This is common when an application has been obfuscated.
{% endhint %}
Time to see if we are on the right track! Enter the PIN on the device or emulator.
Excellent, so it appears our pinsMatch function is indeed getting called twice. The parameters are the same, except for argument\[1] which is "pin" and "pin\_decoy".
Now we will head back to our static analysis tool. From here, we have some options. Since our goal is to learn, we'll do a little bit of everything!
* Continue to push through via static analysis, building our understanding up as we go. This option may appeal to those with more programming experience. \[[Lab 4a](/lab/4a-moar-static-analysis)]* Cast a wider net with method hooks, hooking additional functions of interest, or even an entire class worth of functions. \[[Lab 4b](/lab/4b-cast-a-wider-net-with-dbi)]
* Go full ham and write a PIN bruteforce, because it's fun (and **relatively** easy!) \[[Lab 4c](/lab/4c-pin-bruteforce)] # \[4a] Moar Static Analysis Let's head back to the static analysis and see if this helps us to fill in the gaps any. What do we know about pinsMatch? Well, it returns false when the PIN is wrong. But what else. Let's break it apart:  So in our incorrect PIN entry, we called pinsMatch with `"1234"`, `"pin"` and a `Context`. #### First line : String string So our function begins with a variable `string` being declared and immediately assigned a value:  So what's happening here? You might think to right click `PreferenceManager` or `getDefaultSharedPreferences`, but you won't have the option to "Go to declaration" - it's disabled. In this situation, it may be worth it to search Google. You can search for the class name, method name, or both. The results should be similar. I used: `getDefaultSharedPreferences`  Sure enough, the reason we can't view the declaration is because it's not part of our app - this is part of the Android API. The best part about that is it's well documented in the Android Developer docs. If we dig into the function, eventually we will be able to uncover a plain english explanation for what `getString` is doing.  Cool - so [earlier in Lab 1](/lab/1-lab-setup-and-initial-app-exploration/1.2-review-files-in-the-app-data-directory#shared-preferences-sharedprefs) we located a number of keys for interest, including one called `"pin"` right?  So it would appear the value for "string" is actually going to be this hash, `2c357e386f80a13452cfec7ef58a6609034f5c08`. #### Return statement If you try to read this function in place, even for someone with programming knowledge this one is a bit tricky. {% hint style="warning" %} It's unlikely this code was written like this. Remember, decompilers **try** to recreate what it might have looked like originally, but they don't have all the information, and occasionally constructs like the above result and can be quite difficult to interpret. {% endhint %} One technique I would recommend when dealing with a complex function body is to break it into a few pieces in NP++ and fill in the values. So start with a copy, format it, and then fill in what you know:  A couple of things you need to know about Java to understand the above: * when you see two vertical bars or `||` , these can be read as "OR". Its counterpart is `&&` which is read "AND".
* the symbol `!` can be read as "NOT". In the case of a boolean, this means true becomes false, and false becomes true.
* the word `null` means nothing - unset - no value.
* The use of `?` and `:` here is a shortcut for an if / else check.\ (expression) ? (action/value if true) : (action/value if false) Ok, so let's fill in our known values.  Essentially, any of the three things in the brackets evaluating to `true` will result in the function returning `false`. Confused yet? We're not done! We now know that str is our entered PIN, str2 is either "pin" or "pin\_decoy". The function returns boolean (true or false), takes two strings (str and str2) and a Context. At the end of this, we've developed a pretty solid understanding, however, by casting a wider net with Frida, we can shore things up and confirm. Rather than tracing a list of functions one by one, # \[4b] Cast a wide net with DBI Back in DBI land, we are ready to 'cast a wider net' by doing a less specific trace. This time, instead of using `traceMethod`, we will instead use `traceClass`. `Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.decrypt [2 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.encrypt [2 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.encryptPin [1 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.getBucketIdForPin [1 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.getEncryptedKeysForPin [1 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.getPinKeyForPin [1 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.padKeyForDes [1 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.patternMatches [1 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.persistPin [1 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.pinsMatch [1 overload(s)] Tracing com.github.browep.privatephotovault.crypto.CryptoUtils.setEncryptedKeysForPin [1 overload(s)]` Perfect - looks like everything got hooked. Let's try entering a bad PIN again.  Frida has turned our app into quite the storyteller! If we peruse the list, it looks like the functions are called in this order: * getBucketIdForPin - eventually returns null * pinsMatch - eventually returns false * encryptPin - returns `"7110eda4d09e062aa5e4a390b0a572ac0d2c0220"` * pinsMatch - returns false # \[4c] PIN bruteforce The lab kit comes with a pre-written bruteforce and this step of the lab will cover how to run it. If you're more interested in the technical details, check out [\[4c.1\] - PIN bruteforce (in depth)](/lab/4c-pin-bruteforce/4c.1-pin-bruteforce-in-depth) In the frida REPL, simply type bruteforcePIN() and press enter.  Hey, that was pretty easy and fast right? Sadly, they aren’t all this quick. In fact, you may have noticed from the static analysis section that the encryptPin function simply computes SHA1 and returns the "hex string" equivalent.  This explains why it is so quick for us to bruteforce all 10,000 possibilities. More secure apps tend to use much more complex and computationally expensive algorithms called Key Derivation Functions (KDF) to ensure that this type of bruteforce script would be much, much slower. # \[4c.1] PIN bruteforce (in depth) This page is intended to cover how the PIN bruteforce works and how it all goes together. The requirements of our bruteforcing function can be summed up as: iterate every possible combinations of PINs, starting with 0000 and working our way up to 9999, and invoke the `pinsMatch` function on each combination until we get a `true` result. ``` function bruteforcePIN() { Java.perform(() => { var CryptoUtils = Java.use('com.github.browep.privatephotovault.crypto.CryptoUtils'); var StringUtils = Java.use('org.apache.commons.lang.StringUtils'); var context = getApplicationContext(); for (var i = 0; i < 10000; i++) { if (i % 1000 == 0) { console.log('Tried', i, 'PINs'); } var currentPin = StringUtils.leftPad(i.toString(), 4, '0'); if (CryptoUtils.pinsMatch(currentPin, 'pin', context)) { console.log('found it!', currentPin); break; } } }); } ``` ### Line 2 - Java.perform ``` Java.perform(() => { // do stuff }); ``` Wrapping code in a Java.perform are a necessary evil whenever we use frida on Android. You can bank on needing to wrap just about every call you make inside of one.  ### Lines 3 and 4 - Java.use ``` var CryptoUtils = Java.use('com.github.browep.privatephotovault.crypto.CryptoUtils'); var StringUtils = Java.use('org.apache.commons.lang.StringUtils'); ``` Java.use statements are necessary whenever you want to interact with Java classes. This goes for both classes that are part of the target app, and also classes that are part of the standard libraries. Java.use provides a wrapper with which you can do fun things with like invoking functions! In this case, we are obtaining two wrappers: CryptoUtils, and StringUtils. If you consider the namespaces, you may note that StringUtils is not part of the "privatephotovault" but rather part of the Apache Commons library. ### Line 5 - getApplicationContext() ``` var context = getApplicationContext(); ``` At the risk of delving too far into the programming concepts, I want to explain the purpose of this call very simply to start: we need a Context to pass to our `pinsMatch` function (argument 3). That's it. That's the only reason! *Ok, that makes sense, but what is a Context?* Essentially, every single Android app is going to have Application Context. [This article on mindorks.com](https://blog.mindorks.com/understanding-context-in-android-application-330913e32514) provides a decent explanation. One last thing -- the getApplicationContext function is actually defined earlier in our `privatePhotoVault.js` script. ``` function getApplicationContext() { const ActivityThread = Java.use("android.app.ActivityThread"); const currentApplication = ActivityThread.currentApplication(); var ret = currentApplication.getApplicationContext(); return ret; } ``` As you can see, it is doing more of the same of what we've done earlier in the script. We're getting a wrapper to `android.app.ActivityThread`, then invoking two functions and ultimately returning our Application Context. ### Line 6 - For loop ``` for (var i = 0; i < 10000; i++) { // Loop stuff... } ``` Now we finally get to the good stuff! This loop starts at 0, and works its way up to 9999, and incrementing by one at a time. ### Lines 7-9 - Update Progress ``` if (i % 1000 == 0) { console.log('Tried', i, 'PINs'); } ``` This section isn't necessary -- it's just for information. Every 1000 entries, we want to let the console know how many tries we've done. {% hint style="info" %} If you're wondering what the % operator is, it's called [modulo](https://en.wikipedia.org/wiki/Modulo_operation). Essentially, what if anything left over after dividing by a number. {% endhint %} ### Line 10 - Preparing our PIN attempt ``` var currentPin = StringUtils.leftPad(i.toString(), 4, '0'); ``` We're tantalizingly close to trying our PIN now! We have one final step: currently, our loop is counting from 0 to 9999, but the passcode we need to try is "0000", "0001", etc. # Ready for more? We hope you've enjoyed the content in this lab! If you're interested in more content, please reach out and let us know! Contact links are on the top of the page. # Installation & Common Flags The frida-tools suite comes from this repo: {% embed url="