吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

查看: 12302|回复: 15
收起左侧

[Android 分享] 去除安卓程序自动发短信权限 与天天跑你妹的另类破解

  [复制链接]
御剑 发表于 2014-4-28 17:03
本帖最后由 御剑 于 2014-4-28 17:08 编辑

【文章标题】: 去除安卓程序自动发短信权限 与天天跑你妹的另类破解
【文章作者】: 御剑
【作者邮箱】: 408885352@qq.com
【作者主页】: 无
【作者QQ号】: 无
【软件名称】: 天天跑你妹
【下载地址】: http://pan.baidu.com/s/1gdmnaU3  为方便新手研究我就把这个版本上传百度网盘吧
【加壳方式】: 无
【编写语言】: JAVA
【使用工具】: ApkIDE
【软件介绍】: 【安卓游戏】没什么好介绍的...
【作者声明】: 只是技术交流,没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】

经过上次的破解后我们已经可以免费购买游戏中的道具与钻石(地址:http://www.52pojie.cn/thread-254443-1-1.html
但我们发现购买多次道具或钻石后再次购买的话会提示“支付失败,请稍后再试(30003)”  
1.jpg
现在我们就先来解决下这个问题吧!
首先用 ApkIDE 打开 天天跑你妹 然后搜索“支付失败”(记得先转换为Unicode)
2.jpg
很明显第一条就是我们所要的 ,我们双击进去
[Asm] 纯文本查看 复制代码
.method public final a(ILjava/lang/String;)V
    .locals 3

    const-string v0, "uucunpay"

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "onError arg0="

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v1, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, ", arg1="

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1, p2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v0, v1}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I

    iget-object v0, p0, Lcom/luyougame/pay/a/b;->a:Lcom/luyougame/pay/a/a;

    invoke-static {v0, p2}, Lcom/luyougame/pay/a/a;->a(Lcom/luyougame/pay/a/a;Ljava/lang/String;)V

    if-eqz p2, :cond_0

    invoke-virtual {p2}, Ljava/lang/String;->length()I

    move-result v0

    const/4 v1, 0x1

    if-gt v0, v1, :cond_1

    :cond_0
    iget-object v0, p0, Lcom/luyougame/pay/a/b;->a:Lcom/luyougame/pay/a/a;

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "\u652f\u4ed8\u5931\u8d25\uff0c\u8bf7\u7a0d\u540e\u518d\u8bd5("

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v1, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, ")"

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v0, v1}, Lcom/luyougame/pay/a/a;->a(Lcom/luyougame/pay/a/a;Ljava/lang/String;)V

    :cond_1
    new-instance v0, Lcom/luyougame/pay/a/c;

    invoke-direct {v0, p0}, Lcom/luyougame/pay/a/c;-><init>(Lcom/luyougame/pay/a/b;)V

    invoke-static {}, Lcom/luyougame/uucun_meizhirun/MZRun;->a()Lcom/luyougame/uucun_meizhirun/MZRun;

    move-result-object v1

    invoke-virtual {v1, v0}, Lcom/luyougame/uucun_meizhirun/MZRun;->a(Ljava/lang/Runnable;)V

    const/4 v0, 0x0

    invoke-static {v0, p1}, Lcom/luyougame/jni/GameJniTools;->CallGamePayBilling(ZI)V

    invoke-static {}, Lcom/luyougame/uucun_meizhirun/MZRun;->a()Lcom/luyougame/uucun_meizhirun/MZRun;

    move-result-object v0

    const/16 v1, 0x3ea

    invoke-virtual {v0, v1}, Lcom/luyougame/uucun_meizhirun/MZRun;->a(I)V

    return-void
.end method

下面我们大概的分析下
[Asm] 纯文本查看 复制代码
.method public final a(ILjava/lang/String;)V
    .locals 3

    const-string v0, "uucunpay" 

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "onError arg0=" //arg0的错误信息 = 

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v1, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, ", arg1="  //arg1 =

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1, p2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v0, v1}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I

    iget-object v0, p0, Lcom/luyougame/pay/a/b;->a:Lcom/luyougame/pay/a/a;

    invoke-static {v0, p2}, Lcom/luyougame/pay/a/a;->a(Lcom/luyougame/pay/a/a;Ljava/lang/String;)V

    if-eqz p2, :cond_0  //判断是否跳转到:cond_0 

    invoke-virtual {p2}, Ljava/lang/String;->length()I

    move-result v0

    const/4 v1, 0x1

    if-gt v0, v1, :cond_1 //判断是否跳转到:cond_1 

    :cond_0  //跳转到这里则提示“支付失败,请稍后再试”
    iget-object v0, p0, Lcom/luyougame/pay/a/b;->a:Lcom/luyougame/pay/a/a;

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "\u652f\u4ed8\u5931\u8d25\uff0c\u8bf7\u7a0d\u540e\u518d\u8bd5("

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v1, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, ")"

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v0, v1}, Lcom/luyougame/pay/a/a;->a(Lcom/luyougame/pay/a/a;Ljava/lang/String;)V

    :cond_1  //跳转到这里则重启程序
    new-instance v0, Lcom/luyougame/pay/a/c;

    invoke-direct {v0, p0}, Lcom/luyougame/pay/a/c;-><init>(Lcom/luyougame/pay/a/b;)V

    invoke-static {}, Lcom/luyougame/uucun_meizhirun/MZRun;->a()Lcom/luyougame/uucun_meizhirun/MZRun;

    move-result-object v1

    invoke-virtual {v1, v0}, Lcom/luyougame/uucun_meizhirun/MZRun;->a(Ljava/lang/Runnable;)V

    const/4 v0, 0x0

    invoke-static {v0, p1}, Lcom/luyougame/jni/GameJniTools;->CallGamePayBilling(ZI)V

    invoke-static {}, Lcom/luyougame/uucun_meizhirun/MZRun;->a()Lcom/luyougame/uucun_meizhirun/MZRun;

    move-result-object v0

    const/16 v1, 0x3ea

    invoke-virtual {v0, v1}, Lcom/luyougame/uucun_meizhirun/MZRun;->a(I)V

    return-void
.end method

经过分析我们知道这只是一个错误提示的函数。
我们搜索下函数头 (a(ILjava/lang/String;)V) 来看看是哪个位置调用了这个函数
4.jpg
搜索到了很多...但我们不知道具体是哪个才是我们所需要的.所以我们只能慢慢分析。
双击第一条找到的信息
[Asm] 纯文本查看 复制代码
# virtual methods
.method public abstract a()V
.end method

.method public abstract a(ILjava/lang/String;)V
.end method

.method public abstract b()V
.end method

.method public abstract b(ILjava/lang/String;)V
.end method

很明显这并不是我们所需要的,继续查看下一条
[Asm] 纯文本查看 复制代码
.method public onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z
    .locals 3

    const/4 v0, 0x1

    sparse-switch p1, :sswitch_data_0

    invoke-super {p0, p1, p2, p3, p4}, Landroid/os/Binder;->onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z

    move-result v0

    :goto_0
    return v0

    :sswitch_0
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p3, v1}, Landroid/os/Parcel;->writeString(Ljava/lang/String;)V

    goto :goto_0

    :sswitch_1
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->a()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_2
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->b()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_3
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->a(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_4
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->b(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    nop

    :sswitch_data_0
    .sparse-switch
        0x1 -> :sswitch_1
        0x2 -> :sswitch_2
        0x3 -> :sswitch_3
        0x4 -> :sswitch_4
        0x5f4e5446 -> :sswitch_0
    .end sparse-switch
.end method

这条看起来就比较可疑了...
那么我们来进行分析下
[Asm] 纯文本查看 复制代码
.method public onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z
    .locals 3

    const/4 v0, 0x1
        
    sparse-switch p1, :sswitch_data_0 进行分支选择

    invoke-super {p0, p1, p2, p3, p4}, Landroid/os/Binder;->onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z

    move-result v0

    :goto_0
    return v0

    :sswitch_0//重启程序
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p3, v1}, Landroid/os/Parcel;->writeString(Ljava/lang/String;)V

    goto :goto_0

    :sswitch_1//进行安全检测
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->a()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_2//进入支付验证
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->b()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_3//支付失败,请稍后再试
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->a(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_4//进行安全检测后返回
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->b(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    nop

    :sswitch_data_0
    .sparse-switch
        0x1 -> :sswitch_1
        0x2 -> :sswitch_2
        0x3 -> :sswitch_3
        0x4 -> :sswitch_4
        0x5f4e5446 -> :sswitch_0
    .end sparse-switch
.end method

经过上面的分析后相信大家都知道接下来该怎么做了吧...
我们的目标是让它进入支付验证..至于怎么让它进入支付验证嘛...
方法有很多...其中最简单的就是直接用我们之前常用goto语句了...直接在switch语句前goto 到:sswitch_2 就能实现我们所需达到的目标了
[Asm] 纯文本查看 复制代码
.method public onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z
    .locals 3

    const/4 v0, 0x1
goto :sswitch_2//我们就在执行switch分支选择语句前直接用goto语句跳转到 :sswitch_2 这样就可以直接进入支付验证了
    sparse-switch p1, :sswitch_data_0 //进行分支选择

    invoke-super {p0, p1, p2, p3, p4}, Landroid/os/Binder;->onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z

    move-result v0

    :goto_0
    return v0

    :sswitch_0//重启程序
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p3, v1}, Landroid/os/Parcel;->writeString(Ljava/lang/String;)V

    goto :goto_0

    :sswitch_1//进行安全检测
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->a()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_2//进入支付验证
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->b()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_3//支付失败,请稍后再试
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->a(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_4//进行安全检测后返回
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->b(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    nop

    :sswitch_data_0
    .sparse-switch
        0x1 -> :sswitch_1
        0x2 -> :sswitch_2
        0x3 -> :sswitch_3
        0x4 -> :sswitch_4
        0x5f4e5446 -> :sswitch_0
    .end sparse-switch
.end method

OK 现在基本已完美破解了...
还有经过测试我们发现了一个意外惊喜!
那就是我们只需要在执行switch分支选择语句前直接用goto语句跳转到 :sswitch_2就可以直接达到破解的效果了...
6.jpg
7.jpg

不过会先提示支付失败的信息然后再提示充值成功...而且钻石神马依然会购买成功的!
至于提示失败的解决方法请参考天天跑你妹的破解教程(地址:http://www.52pojie.cn/thread-254443-1-1.html


接下来就是去除游戏自动发送短信的权限...以避免某些不必要的麻烦...
其实去除安卓程序自动发送短信的权限很简单,只需要把“安卓程序注册发送短信权限”的语句删除即可

Android注册发送短信权限: <uses-permission android:name="android.permission.SEND_SMS" />
Android注册写短信权限:<uses-permission android:name="android.permission.WRITE_SMS" />
或者把“安卓程序注册写短信权限”的语句删除也一样可以达到效果

现在我来演示下吧
我们搜索<uses-permission android:name="android.permission.SEND_SMS" />
8.jpg
双击打开搜索到的结果
[Asm] 纯文本查看 复制代码
<?xml version="1.0" encoding="utf-8"?>
<manifest android:versionCode="3" android:versionName="1.2.0" package="com.luyougame.uucun_meizhirun"
  xmlns:android="http://schemas.android.com/apk/res/android">
    <supports-screens android:anyDensity="true" android:smallScreens="true" android:normalScreens="true" android:largeScreens="true" android:resizeable="true" />
    <uses-feature android:glEsVersion="0x20000" />
    <uses-permission android:name="android.permission.RUN_INSTRUMENTATION" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.READ_PHONE_STATE" />
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.WRITE_SETTINGS" />
    <uses-permission android:name="android.permission.RECEIVE_SMS" />
    <uses-permission android:name="android.permission.RECEIVE_MMS" />
    <uses-permission android:name="android.permission.SEND_SMS" /> //Android注册发送短信权限
    <uses-permission android:name="android.permission.READ_SMS" />//Android注册接收短信权限
    <uses-permission android:name="android.permission.WRITE_SMS" />//Android注册写短信权限
    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
    <uses-permission android:name="android.permission.GET_TASKS" />
    <uses-permission android:name="android.permission.READ_LOGS" />
    <uses-permission android:name="android.permission.RESTART_PACKAGES" />
    <uses-permission android:name="android.permission.RECEIVE_WAP_PUSH" />
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
    <uses-permission android:name="android.permission.WAKE_LOCK" />
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
    <application android:label="@string/app_name" android:icon="@drawable/icon" android:debuggable="true">
        <activity android:theme="@android:style/Theme.NoTitleBar.Fullscreen" android:label="@string/app_name" android:name="com.luyougame.uucun_meizhirun.MZRun" android:screenOrientation="landscape" android:configChanges="orientation">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
        <receiver android:name="com.uucun.smspay.receiver.BootReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <category android:name="android.intent.category.HOME" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.SIM_STATE_CHANGED" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.intent.action.TIME_SET" />
            </intent-filter>
        </receiver>
        <receiver android:name="com.uucun.smspay.receiver.ShutdownReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
            </intent-filter>
        </receiver>
        <receiver android:name="com.uucun.smspay.receiver.SMSReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.USER_PRESENT" />
                <action android:name="android.intent.action.ACTION_POWER_CONNECTED" />
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.provider.Telephony.SMS_RECEIVED" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
            <intent-filter>
                <action android:name="android.provider.Telephony.WAP_PUSH_RECEIVED" />
                <data android:mimeType="application/vnd.wap.mms-message" />
            </intent-filter>
            <intent-filter>
                <action android:name="com.android.mms.transaction.MESSAGE_SENT" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <data android:scheme="package" />
            </intent-filter>
        </receiver>
        <receiver android:name="com.uucun.smspay.receiver.NetworkChangeReceiver">
            <intent-filter>
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            </intent-filter>
        </receiver>
        <service android:name="com.uucun.smspay.service.DataService" />
        <service android:name="com.uucun.smspay.aidl.PayService" android:exported="true" />
        <activity android:theme="@style/payment_uucun_NoTitleDialog" android:name="com.uucun.smspay.activity.UpdateDialogActivity" android:excludeFromRecents="true" />
        <activity android:theme="@style/payment_uucun_NoTitleDialog" android:name="com.uucun.smspay.activity.NetworkActivity" android:excludeFromRecents="true" />
        <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.SplashActivity" android:excludeFromRecents="true" android:configChanges="keyboardHidden|orientation" />
        <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.SMSPayActivity" android:configChanges="keyboardHidden|orientation" />
        <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.LocalSMSPayActivity" android:configChanges="keyboardHidden|orientation" />
        <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.PayResultActivity" android:configChanges="keyboardHidden|orientation" />
        <meta-data android:name="TDGA_APP_ID" android:value="19397EF50B38A0E678C78C494B3CCED2" />
        <meta-data android:name="TDGA_CHANNEL_ID" android:value="108_3" />
    </application>
    <supports-screens android:anyDensity="true" android:smallScreens="true" android:normalScreens="true" android:largeScreens="true" />
</manifest>

我们把<uses-permission android:name="android.permission.SEND_SMS" /> //Android注册发送短信权限 删除
[Asm] 纯文本查看 复制代码
<?xml version="1.0" encoding="utf-8"?>
<manifest android:versionCode="3" android:versionName="1.2.0" package="com.luyougame.uucun_meizhirun"
  xmlns:android="http://schemas.android.com/apk/res/android">
    <supports-screens android:anyDensity="true" android:smallScreens="true" android:normalScreens="true" android:largeScreens="true" android:resizeable="true" />
    <uses-feature android:glEsVersion="0x20000" />
    <uses-permission android:name="android.permission.RUN_INSTRUMENTATION" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.READ_PHONE_STATE" />
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.WRITE_SETTINGS" />
    <uses-permission android:name="android.permission.RECEIVE_SMS" />
    <uses-permission android:name="android.permission.RECEIVE_MMS" />

    <uses-permission android:name="android.permission.READ_SMS" />//Android注册接收短信权限
<uses-permission android:name="android.permission.WRITE_SMS" />//Android注册写短信权限
<uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
    <uses-permission android:name="android.permission.GET_TASKS" />
    <uses-permission android:name="android.permission.READ_LOGS" />
    <uses-permission android:name="android.permission.RESTART_PACKAGES" />
    <uses-permission android:name="android.permission.RECEIVE_WAP_PUSH" />
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
    <uses-permission android:name="android.permission.WAKE_LOCK" />
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
    <application android:label="@string/app_name" android:icon="@drawable/icon" android:debuggable="true">
        <activity android:theme="@android:style/Theme.NoTitleBar.Fullscreen" android:label="@string/app_name" android:name="com.luyougame.uucun_meizhirun.MZRun" android:screenOrientation="landscape" android:configChanges="orientation">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
        <receiver android:name="com.uucun.smspay.receiver.BootReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <category android:name="android.intent.category.HOME" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.SIM_STATE_CHANGED" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.intent.action.TIME_SET" />
            </intent-filter>
        </receiver>
        <receiver android:name="com.uucun.smspay.receiver.ShutdownReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
            </intent-filter>
        </receiver>
        <receiver android:name="com.uucun.smspay.receiver.SMSReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.USER_PRESENT" />
                <action android:name="android.intent.action.ACTION_POWER_CONNECTED" />
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.provider.Telephony.SMS_RECEIVED" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
            <intent-filter>
                <action android:name="android.provider.Telephony.WAP_PUSH_RECEIVED" />
                <data android:mimeType="application/vnd.wap.mms-message" />
            </intent-filter>
            <intent-filter>
                <action android:name="com.android.mms.transaction.MESSAGE_SENT" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <data android:scheme="package" />
            </intent-filter>
        </receiver>
        <receiver android:name="com.uucun.smspay.receiver.NetworkChangeReceiver">
            <intent-filter>
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            </intent-filter>
        </receiver>
        <service android:name="com.uucun.smspay.service.DataService" />
        <service android:name="com.uucun.smspay.aidl.PayService" android:exported="true" />
        <activity android:theme="@style/payment_uucun_NoTitleDialog" android:name="com.uucun.smspay.activity.UpdateDialogActivity" android:excludeFromRecents="true" />
        <activity android:theme="@style/payment_uucun_NoTitleDialog" android:name="com.uucun.smspay.activity.NetworkActivity" android:excludeFromRecents="true" />
        <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.SplashActivity" android:excludeFromRecents="true" android:configChanges="keyboardHidden|orientation" />
        <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.SMSPayActivity" android:configChanges="keyboardHidden|orientation" />
        <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.LocalSMSPayActivity" android:configChanges="keyboardHidden|orientation" />
        <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.PayResultActivity" android:configChanges="keyboardHidden|orientation" />
        <meta-data android:name="TDGA_APP_ID" android:value="19397EF50B38A0E678C78C494B3CCED2" />
        <meta-data android:name="TDGA_CHANNEL_ID" android:value="108_3" />
    </application>
    <supports-screens android:anyDensity="true" android:smallScreens="true" android:normalScreens="true" android:largeScreens="true" />
</manifest>

OK 修改完毕...记得修改保存,重新编译,签名!


免费评分

参与人数 2热心值 +2 收起 理由
小试锋芒 + 1 欢迎分析讨论交流,吾爱破解论坛有你更精彩.
周卫国 + 1 谢谢@Thanks!

查看全部评分

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

周卫国 发表于 2014-4-28 17:47
请教楼主,以下两段代码并无区别,GOTO语句的意义是什么?

:sswitch_1//进行安全检测
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->a()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_2//进入支付验证
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->b()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

点评

goto 语句 = 汇编的JMP    也就是无条件跳转  发表于 2014-4-28 20:30
 楼主| 御剑 发表于 2014-4-28 18:10
本帖最后由 御剑 于 2014-4-28 20:30 编辑
周卫国 发表于 2014-4-28 17:47
请教楼主,以下两段代码并无区别,GOTO语句的意义是什么?

:sswitch_1//进行安全检测

:sswitch_1//进行安全检测
invoke-virtual {p0}, Lcom/a/a/a/b;->a()V
:sswitch_2//进入支付验证
invoke-virtual {p0}, Lcom/a/a/a/b;->b()V
goto 语句 = 汇编的JMP   
也就是无条件跳转


点评

就是个A与B的区别  发表于 2014-4-28 19:37
看走眼了,估计把下面那句复制上去,效果也一样  发表于 2014-4-28 19:36
djy597060921 发表于 2014-4-28 17:10
阿富汗2013 发表于 2014-4-28 17:38
看看不说话{:1_912:}
星期五 发表于 2014-4-28 17:58
谢谢楼主分享哈····
头像被屏蔽
w780628d 发表于 2014-4-28 18:29
提示: 作者被禁止或删除 内容自动屏蔽
zc123 发表于 2014-4-28 18:54
很好的教程
头像被屏蔽
sos521qqq 发表于 2014-4-29 11:25 来自手机
提示: 作者被禁止或删除 内容自动屏蔽
落草为寇 发表于 2014-4-29 12:00
看了不回复,于心不安,晚上回家试试,谢谢楼主
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告:本版块禁止灌水或回复与主题无关内容,违者重罚!

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2024-5-23 21:37

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表