All right, so now in this lecture, I want to show you the route detection bypass vulnerability again
for those who want to use the RPK studio.
So the changes in the code are the same, but with a book studio, you're going to manually sign the
RPK and upload it to the device.
Now, if you don't want to use a studio and you've already practices vulnerability with a lab extension,
just go ahead and skip this lecture.
For those of you here, let's get started.
I'm sure you remember we successfully installed the APJ studio just by adding the necessary binaries.
Now, if you see version number of each tool, it means that you have also installed them successfully.
Otherwise, please just go back and check the installation of a case studio.
Now under the final tab at the APK file.
OK, open.
And select the decompiled Java option and click on Decompiled.
And you might have to wait for a bit.
Display project folders.
So let's first have a look at the Java source code to understand exactly what the method does.
So there's a method called cheroot status that returns a message based on whether the device is routed
or not.
So looking into this method, two methods called does super user APIC exist and does Asou exist?
Are used to determine if the device has been routed.
Now, in order to bypass route detection, we can force a jump to always at device not rooted just by
changing the conditional loop.
So let's open the assembly code and make the changes.
Press control F and search for condition to.
And down here online, 450, there is a conditional.
And it means that when, if not equal, jump to the device, not routed tag.
So mapping this to the previously decompiled Java files, this is a loop where if two methods are true,
then jump to Rouda device or else jump to device not rooted.
Sort of force a jump to always add device not rooted, we can change the conditional loop into a go
to loop.
But first, we need to disable this line.
So to make this line comment, just add a sharp character and add a go to loop, to jump to condition
to directly.
And remember to add space after go to.
And now you can say the changes.
So this means that we're ready to rebuild and resign the AP file.
So under the Project Tab, click on Billed.
And wait for a bit.
So the new HBK file happens to be under the dust folder.
Now, unlike in RPK lab will do the signing and installing on the device manually this time.
So on the project tab, click on the sign and export.
Design the RPK file, we need to have a key created with key tool.
So open a terminal screen.
Now, I want to say my key to the desktop, so I'll go to desktop.
Ron.
Key tool dash the dash jenky dash keester.
And here I can give a name for a new keester.
And alias.
Defined RSA as a key algorithm.
Define the key size.
And finally, at a validity option, and it's just an expiration date, so you can give a really big
number if you want.
Now create a password for keester.
And and we can skip these questions.
All right, yeah, so it's created a key store on the desktop.
Now we're ready to sign the APK with this key, so if you go under the project tab.
Click on the sign and export.
Select the key store, enter the password that you just created when generating the key.
Enter areas and the same password for the alias password.
Click on Sign.
All right, so there's only one step left open the terminal screen.
Go to the disk folder where the signed APIC is.
And we'll check the connectivity.
All right, so we can install the APK to the device.
Now, before installing the new one, don't forget to uninstall the old.
Now, run ADB, install and give the new APK file.
Click on install anyway.
And do not send.
And could continue.
OK.
So first, make sure you have configured the server IP.
And let's go ahead and log into the app to see the changes.
And there is you can see the device not routed is the message on the screen, what does that mean?
We have bypass route detection mechanism quite successfully, if I do say so myself.
Very good job.