In my opinion, cheating acceptable - it merely means expanding the frame of an application to the point, which is beyond what the creators of the application have ever imagined. In this talk, we explore how the popular instumentalisation framework Frida can be used to hack applications from games to mobile banking applications.

1. CHEATS FOR EVERYTHING
ANDROID
HACKTIVITY 2018

2. 'PROGRAMMING IS SUPER BORING.
GAME CHEATS ARE THE ONLY COOL THINGS
ABOUT CODING.'
- an 11-year-old kid

3. WRITING CHEATS IS SEXY.

4. HACKTIVITY 2018
WHOAMI
▸ Zsombor Kovacs CISSP,
OSCP, OSWP, OSCE
▸ Researcher, testing pens for
a decade
▸ Director of Research @MRG
Effitas
▸ Founder of Hackersuli

5. HACKTIVITY 2018
ANDROID APPLICATIONS
LOCAL
FILES
NETWORK
ENDPOINT
LOCAL DEVICE
APP CODE
HARDWARE

6. HACKTIVITY 2018
ANDROID APPLICATIONS
LOCAL
FILES
NETWORK
ENDPOINT
LOCAL DEVICE
APP CODE
HARDWARE
RUNTIME
NETWORK
STACK
FILE
HANDLERS
DRIVERS
NETWORK

7. LOCAL
FILES
NETWORK
ENDPOINT
LOCAL DEVICE
APP CODE
HARDWARE
RUNTIME
NETWORK
STACK
FILE
HANDLERS
DRIVERS
NETWORK
HACKTIVITY 2018
ANDROID APPLICATIONS
OFFLINE PATCHING
MITM ATTACKS
ATTACK THE
ENDPOINT
MOCK THINGS
CHANGE LOCAL
FILES
CHANGE THE
RUNTIME

8. HACKTIVITY 2018
TAMPERING WITH THE RUNTIME
▸ Run-time manipulation of...
everything
▸ Intercept and change method
call parameters
▸ Overwrite methods
▸ ...and go home like nothing
happened

9. HACKTIVITY 2018
TOOLS OF THE TRADE
▸ From KitKat on
▸ Designed for permanent
changes
▸ Lots of modules
XPOSED FRAMEWORK

10. HACKTIVITY 2018
TOOLS OF THE TRADE
▸ Lots of modules
▸ Supported only on KitKat :(
CYDIA SUBSTRATE

11. HACKTIVITY 2018
TOOLS OF THE TRADE
▸ Perfect for pentesters
▸ Scriptable in JavaScript
▸ Rock solid architecture
FRIDA
© freepic.com

12. HACKTIVITY 2018
A TYPICAL WORKFLOW WITH FRIDA
▸ Decompile the application.
▸ Pinpoint the relevant bits in the code.
▸ Create a frida script to tweak the code while the app is
being run.
▸ Run app and the script.
▸ Profit.

13. HACKTIVITY 2018
FRIDA INTERNALS
LOCAL DEVICE
APP CODE
RUNTIME
FRIDA SERVER
FRIDA
CLIENT

14. HACKTIVITY 2018
FRIDA INTERNALS

15. HACKTIVITY 2018
APPLICATION DECOMPILATION
▸ Gives an approximation of the actual code (no re-
compilation)
▸ Tools of the trade
▸ dex2jar (from .apk to .jar)
▸ Your Favourite Java Decompiler (from .jar to actual
code)
▸ http://apkdecompilers.com

16. HACKTIVITY 2018
FRIDA CHEAT SHEET TO TWEAK METHODS

17. HACKTIVITY 2018
FRIDA CHEAT SHEET TO DUMP OBJECT DATA

18. HACKTIVITY 2018
FRIDA CHEAT SHEET TO DUMP OBJECT DATA
NOTE THE _

19. HACKTIVITY 2018
DEMO - FIND THE KEY

20. HACKTIVITY 2018
DEMO - FIND THE KEY

21. HACKTIVITY 2018
DEMO - FIND THE KEY

22. HACKTIVITY 2018
DEMO - BRUTE FORCE LOCAL PIN SCREEN

23. HACKTIVITY 2018
DEMO - BRUTE FORCE LOCAL PIN SCREEN

24. HACKTIVITY 2018
DEMO - BRUTE FORCE LOCAL PIN SCREEN

25. HACKTIVITY 2018
DEMO - BYPASS ROOT DETECTION

26. HACKTIVITY 2018
DEMO - BYPASS ROOT DETECTION

27. HACKTIVITY 2018
DEMO - BYPASS ROOT DETECTION IN A MOBILE BANKING APP
NO SOURCE OR CODE - OBVIOUSLY :)

28. HACKTIVITY 2018
DEMO - A CHEATER FOR A SIMPLE MINESWEEPER GAME
NO SOURCE OR CODE - OBVIOUSLY :)

29. HACKTIVITY 2018
DEMO - A CHEATER FOR A BLACKJACK GAME
NO SOURCE OR CODE - OBVIOUSLY :)

30. HACKTIVITY 2018
DEMO - A CHEATER FOR A BLACKJACK GAME