安卓逆向破解教程之支付宝内购

笑对VS人生

今天简单给大家讲个采用支付宝支付的安卓应用内购破解  

采用工具：手机端用MT管理器（电脑上用Android killer）
破解对象：BC后台间谍相机
软件加固方式：360加固（由于某些原因脱壳不详细介绍）


下面这个链接已经破解好的（脱壳后未破解样本我晚点上传本帖）

BC后台间谍相机（偷拍神器）内购破解版（附最新版）
http://www.52pojie.cn/thread-509724-1-1.html
(出处: 吾爱破解论坛)


未破解内购360脱壳版样本下载地址
https://yunpan.cn/cBsru5SK4Idfd
（仅供大家练手）


首先支付宝快捷支付成功都有一个特殊标志  9000
（部分软件可能转换16进制或者采用其它方式加密）
今天我讲的这个BC后台相机
直接可以通过搜索字符搜索到9000
首先准备好脱壳好的软件以及工具MT管理器
（如果电脑端用Android killer直接反编译后可以搜索到）
用MT管理器找到软件安装包
点击>查看>classes.dex>编辑代码>搜索类>输入9000>搜索字符串
会搜索到一个父类，点击选择 搜索方法，直到看见熟的handleMessage
打开后你将看到以下内容（由于手机上操作代码可能有点乱）
这里我就在代码里面加详细说明
label_0:
iget-object v0 v11 Landroid/os/Message;->obj:Ljava/lang/Object;check-cast v0 Ljava/lang/String;
iget v1 v11 Landroid/os/Message;->what:I
packed-switch v1 :label_344（删除黄颜色这行调试代码）
label_9:
invoke-super {v10,v11} Landroid/os/Handler;->handleMessage(Landroid/os/Message;)V
label_12:return-void
（绿色标记的下面会用到，直接剪切到剪切板，注意是剪切）
switch_13:
const-string v1 ""
const-string v4 ""
label_17:
const-string v1 "resultStatus={"
const-string v2 "resultStatus="
invoke-virtual {v0,v2} Ljava/lang/String;->indexOf(Ljava/lang/String;)I
move-result v2
invoke-virtual {v1} Ljava/lang/String;->length()I
move-result v3
add-int/2addr v2 v3
const-string v3 "};memo="
invoke-virtual {v0,v3} Ljava/lang/String;->indexOf(Ljava/lang/String;)I
move-result v3
invoke-virtual {v0,v2,v3} Ljava/lang/String;->substring(II)Ljava/lang/String;
label_39:
move-result-object v9
label_40:
const-string v4 "memo={"
const-string v1 "memo={"
invoke-virtual {v0,v1} Ljava/lang/String;->indexOf(Ljava/lang/String;)I
move-result v1
invoke-virtual {v4} Ljava/lang/String;->length()I
move-result v2
add-int/2addr v1 v2
const-string v2 "};result="
invoke-virtual {v0,v2} Ljava/lang/String;->indexOf(Ljava/lang/String;)I
move-result v2
invoke-virtual {v0,v1,v2} Ljava/lang/String;->substring(II)Ljava/lang/String;
label_62:
move-result-object v8
label_63:
iget-object v1 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v1 v1 Lcom/wanpu/pay/a;->j:Lcom/wanpu/pay/login/u;
if-eqz v1 :label_181（此行删除）
new-instance v1 Lcom/wanpu/pay/f;
const-string v2 "balance"
invoke-direct {v1,v0,v2} Lcom/wanpu/pay/f;-><init>(Ljava/lang/String;Ljava/lang/String;)V
move-object v0 v1
label_77:invoke-virtual {v0} Lcom/wanpu/pay/f;->a()I
move-result v0
iget-object v1 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
invoke-static {v1} Lcom/wanpu/pay/a;->d(Lcom/wanpu/pay/a;)V
const/4 v1 1
if-ne v0 v1 :label_190
iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v0 v0 Lcom/wanpu/pay/a;->a:Landroid/content/Context;check-cast v0 Landroid/app/Activity;
const-string v1 "提示"
const-string v2 "您的订单信息已被非法篡改。"
const v3 0x1080027
invoke-static {v0,v1,v2,v3} Lcom/wanpu/pay/PayTools;->showDialog(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;I)V
label_105:
goto :label_9
label_106:
move-exception v0
move-object v4 v8
move-object v8 v9label_109:
invoke-virtual {v0} Ljava/lang/Exception;->printStackTrace()V
iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v0 v0 Lcom/wanpu/pay/a;->i:Lcom/wanpu/pay/PayResultListener;
if-eqz v0 :label_143
iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v0 v0 Lcom/wanpu/pay/a;->i:Lcom/wanpu/pay/PayResultListener;
iget-object v1 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v1 v1 Lcom/wanpu/pay/a;->a:Landroid/content/Context;
iget-object v2 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v2 v2 Lcom/wanpu/pay/a;->c:Ljava/lang/String;
invoke-static {v8} Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I
move-result v3
const/4 v5 2const/4 v6 0
iget-object v7 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v7 v7 Lcom/wanpu/pay/a;->d:Ljava/lang/String;
invoke-interface/range {v0..v7} Lcom/wanpu/pay/PayResultListener;->onPayFinish(Landroid/content/Context;Ljava/lang/String;ILjava/lang/String;IFLjava/lang/String;)V
label_143:
iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v0 v0 Lcom/wanpu/pay/a;->j:Lcom/wanpu/pay/login/u;
if-eqz v0 :label_9
iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v1 v0 Lcom/wanpu/pay/a;->j:Lcom/wanpu/pay/login/u;
iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v2 v0 Lcom/wanpu/pay/a;->a:Landroid/content/Context;
invoke-static {v8} Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I
move-result v3
const-string v5 "0"
const-string v6 "0"
iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v7 v0 Lcom/wanpu/pay/a;->c:Ljava/lang/String;
const/4 v8 5
invoke-interface/range {v1..v8} Lcom/wanpu/pay/login/u;->a(Landroid/content/Context;ILjava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;I)V
label_173:
goto/16 :label_9
label_175:
move-exception v0
invoke-virtual {v0} Ljava/lang/Exception;->printStackTrace()V
goto/16 :
label_12
label_181:
new-instance v1 Lcom/wanpu/pay/f;
const-string v2 "normal"
invoke-direct {v1,v0,v2} Lcom/wanpu/pay/f;-><init>(Ljava/lang/String;Ljava/lang/String;)V
move-object v0 v1
goto :label_77
label_190:（这段蓝色标记的判断代码直接删除）
const-string v0 "9000"
invoke-virtual {v9,v0} Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v0
if-eqz v0 :label_270（这段蓝色标记判断也直接删除）
iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v0 v0 Lcom/wanpu/pay/a;->i:Lcom/wanpu/pay/PayResultListener;
if-eqz v0 :label_233（同上直接删除这行）
iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v0 v0 Lcom/wanpu/pay/a;->i:Lcom/wanpu/pay/PayResultListener;
iget-object v1 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v1 v1 Lcom/wanpu/pay/a;->a:Landroid/content/Context;
iget-object v2 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v2 v2 Lcom/wanpu/pay/a;->c:Ljava/lang/String;
const/4 v3 0
const-string v4 "支付成功"
const/4 v5 2
iget-object v6 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget v6 v6 Lcom/wanpu/pay/a;->b:F
iget-object v7 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;
iget-object v7 v7 Lcom/wanpu/pay/a;->d:Ljava/lang/String;
invoke-interface/range {v0..v7} Lcom/wanpu/pay/PayResultListener;->onPayFinish(Landroid/content/Context;Ljava/lang/String;ILjava/lang/String;IFLjava/lang/String;)V
goto/16 :label_9
label_9:
invoke-super {v10,v11} Landroid/os/Handler;->handleMessage(Landroid/os/Message;)V
label_12:
return-void
（这句是后来新插入的，就是上面剪切的那句，注意上面那句必须删除）

（将下面的所有代码全部删除）
由于纯手机发帖且下面的全部要删除，就没必要整理换行了
label_233:iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v0 v0 Lcom/wanpu/pay/a;->j:Lcom/wanpu/pay/login/u;if-eqz v0 :label_9new-instance v0 Lcom/wanpu/pay/d;iget-object v1 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v2 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v2 v2 Lcom/wanpu/pay/a;->a:Landroid/content/Context;iget-object v3 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v3 v3 Lcom/wanpu/pay/a;->j:Lcom/wanpu/pay/login/u;iget-object v4 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v4 v4 Lcom/wanpu/pay/a;->n:Ljava/lang/String;iget-object v5 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v5 v5 Lcom/wanpu/pay/a;->c:Ljava/lang/String;invoke-direct/range {v0..v5} Lcom/wanpu/pay/d;-><init>(Lcom/wanpu/pay/a;Landroid/content/Context;Lcom/wanpu/pay/login/u;Ljava/lang/String;Ljava/lang/String;)Vconst/4 v1 0new-array v1 v1 [Ljava/lang/Void;invoke-virtual {v0,v1} Lcom/wanpu/pay/d;->execute([Ljava/lang/Object;)Landroid/os/AsyncTask;goto/16 :label_9label_270:iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v0 v0 Lcom/wanpu/pay/a;->i:Lcom/wanpu/pay/PayResultListener;if-eqz v0 :label_302iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v0 v0 Lcom/wanpu/pay/a;->i:Lcom/wanpu/pay/PayResultListener;iget-object v1 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v1 v1 Lcom/wanpu/pay/a;->a:Landroid/content/Context;iget-object v2 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v2 v2 Lcom/wanpu/pay/a;->c:Ljava/lang/String;invoke-static {v9} Ljava/lang/Integer;->parseInt(Ljava/lang/String;)Imove-result v3const/4 v5 2const/4 v6 0iget-object v4 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v7 v4 Lcom/wanpu/pay/a;->d:Ljava/lang/String;move-object v4 v8invoke-interface/range {v0..v7} Lcom/wanpu/pay/PayResultListener;->onPayFinish(Landroid/content/Context;Ljava/lang/String;ILjava/lang/String;IFLjava/lang/String;)Vlabel_302:iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v0 v0 Lcom/wanpu/pay/a;->j:Lcom/wanpu/pay/login/u;if-eqz v0 :label_9iget-object v0 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v0 v0 Lcom/wanpu/pay/a;->j:Lcom/wanpu/pay/login/u;iget-object v1 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v1 v1 Lcom/wanpu/pay/a;->a:Landroid/content/Context;invoke-static {v9} Ljava/lang/Integer;->parseInt(Ljava/lang/String;)Imove-result v2const-string v4 "0"const-string v5 "0"iget-object v3 v10 Lcom/wanpu/pay/b;->a:Lcom/wanpu/pay/a;iget-object v6 v3 Lcom/wanpu/pay/a;->c:Ljava/lang/String;const/4 v7 5move-object v3 v8invoke-interface/range {v0..v7} Lcom/wanpu/pay/login/u;->a(Landroid/content/Context;ILjava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;I)Vlabel_333:goto/16 :label_9label_335:move-exception v0move-object v8 v1goto/16 :label_109label_339:move-exception v0move-object v8 v9goto/16 :label_109label_344:.pswitch_data 1    1 : switch_13.end pswitch_data

#Handler Exceptions
.catch Ljava/lang/Exception;    start : label_0    end : label_17    handler : label_175.end catch
.catch Ljava/lang/Exception;    start : label_17    end : label_39    handler : label_335.end catch
.catch Ljava/lang/Exception;    start : label_40    end : label_62    handler : label_339.end catch
.catch Ljava/lang/Exception;    start : label_63    end : label_105    handler : label_106.end catch
.catch Ljava/lang/Exception;    start : label_109    end : label_173    handler : label_175.end catch
.catch Ljava/lang/Exception;    start : label_181    end : label_333    handler : label_106.end catch

最后保存，注意用MT管理器最后还要确认，不管电脑还是手机上都要修改再签名。
安装后点击购买，选择支付宝方式支付测试。
注意：如果破解的这个软件没有自带支付宝快捷支付插件（手机必须安装支付宝）
在跳转到支付宝确认付费页面时（没登录支付宝也可以，是登录页面），直接返回。
软件会提示购买成功！这里就完成简单的内购破解了！


当然此教程没什么技术含量仅供参考！
部分开发者可能混淆或者将9000这个数字转换16进制或者加密。
反正依葫芦画瓢，建议大家找个类似软件自己练练手，然后再去尝试更多变化较大的。


（当然支付宝内购破解更加彻底可以做到不用安装支付宝和快捷支付插件，直接忽略跳转支付包）   
      
          这些就等论坛更多“大师”来补充........                                                               




                              By 笑对VS人生                              
                                  2016.6.30

1187112183

const/4 v9 2
const/4 v8 -1
const/4 v7 1
const/4 v6 0
iget v0 v11 Landroid/os/Message;->what:I
packed-switch v0 :label_540
label_9:
return-void
switch_10:
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Lcom/qihoo/gamecenter/sdk/pay/a$a;
move-result-object v0
const-string v1 ""
invoke-virtual {v0,v7,v1} Lcom/qihoo/gamecenter/sdk/pay/a$a;->a(ZLjava/lang/String;)V
goto :label_9
switch_22:
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
iput-boolean v6 v0 Lcom/qihoo/gamecenter/sdk/pay/b/b;->a:Z
iget-object v0 v11 Landroid/os/Message;->obj:Ljava/lang/Object;
check-cast v0 Ljava/lang/String;
invoke-static {v0} Landroid/text/TextUtils;->isEmpty(Ljava/lang/CharSequence;)Z
move-result v1
if-eqz v1 :label_146
const-string v0 "QiHooPayAlipay"
new-array v1 v7 [Ljava/lang/Object;
const-string v2 "支付宝支付接口通知result:TextUtils.isEmpty(strRet)==true"
aput-object v2 v1 v6
invoke-static {v0,v1} Lcom/qihoo/gamecenter/sdk/pay/k/c;->a(Ljava/lang/String;[Ljava/lang/Object;)V
const-string v0 "360sdk_alipay_fail"
new-instance v1 Ljava/lang/StringBuilder;
invoke-direct {v1} Ljava/lang/StringBuilder;-><init>()V
const-string v2 "orderId:"
invoke-virtual {v1,v2} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v1
iget-object v2 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
iget-object v2 v2 Lcom/qihoo/gamecenter/sdk/pay/b/b;->b:Ljava/lang/String;
invoke-virtual {v1,v2} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v1
invoke-virtual {v1} Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v1
invoke-static {v1} Lcom/qihoo/gamecenter/sdk/common/i/c;->a(Ljava/lang/String;)Ljava/util/Map;
move-result-object v1
invoke-static {v0,v1} Lcom/qihoo/stat/QHStatDo;->event(Ljava/lang/String;Ljava/util/Map;)V
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->b(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Landroid/app/Activity;
move-result-object v0
const-string v1 "360sdk_pay_alipay_fail"
new-instance v2 Ljava/lang/StringBuilder;
invoke-direct {v2} Ljava/lang/StringBuilder;-><init>()V
const-string v3 "orderId:"
invoke-virtual {v2,v3} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v2
iget-object v3 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
iget-object v3 v3 Lcom/qihoo/gamecenter/sdk/pay/b/b;->b:Ljava/lang/String;
invoke-virtual {v2,v3} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v2
invoke-virtual {v2} Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v2
invoke-static {v2} Lcom/qihoo/gamecenter/sdk/common/i/a;->a(Ljava/lang/String;)Ljava/util/HashMap;
move-result-object v2
invoke-static {v0,v1,v2} Lcom/qihoo/gamecenter/sdk/common/i/a;->a(Landroid/content/Context;Ljava/lang/String;Ljava/util/HashMap;)V
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Lcom/qihoo/gamecenter/sdk/pay/a$a;
move-result-object v0
if-eqz v0 :label_9
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Lcom/qihoo/gamecenter/sdk/pay/a$a;
move-result-object v0
sget-object v1 Lcom/qihoo/gamecenter/sdk/pay/a$b;->b:Lcom/qihoo/gamecenter/sdk/pay/a$b;
const-string v2 ""
sget-object v3 Lcom/qihoo/gamecenter/sdk/common/e/a$a;->q:Lcom/qihoo/gamecenter/sdk/common/e/a$a;
invoke-static {v3} Lcom/qihoo/gamecenter/sdk/common/e/a;->a(Lcom/qihoo/gamecenter/sdk/common/e/a$a;)Ljava/lang/String;
move-result-object v3
invoke-virtual {v0,v1,v2,v3} Lcom/qihoo/gamecenter/sdk/pay/a$a;->a(Lcom/qihoo/gamecenter/sdk/pay/a$b;Ljava/lang/String;Ljava/lang/String;)V
goto/16 :label_9
label_146:
const-string v1 "QiHooPayAlipay"
new-array v2 v7 [Ljava/lang/Object;
new-instance v3 Ljava/lang/StringBuilder;
invoke-direct {v3} Ljava/lang/StringBuilder;-><init>()V
const-string v4 "支付宝支付接口通知result:"
invoke-virtual {v3,v4} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v3
invoke-virtual {v3,v0} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v3
invoke-virtual {v3} Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v3
aput-object v3 v2 v6
invoke-static {v1,v2} Lcom/qihoo/gamecenter/sdk/pay/k/c;->a(Ljava/lang/String;[Ljava/lang/Object;)V
const-string v1 "resultStatus={"
invoke-virtual {v0,v1} Ljava/lang/String;->indexOf(Ljava/lang/String;)I
move-result v2
if-le v2 v8 :label_225
invoke-virtual {v1} Ljava/lang/String;->length()I
move-result v1
add-int/2addr v1 v2
const-string v2 "};"
invoke-virtual {v0,v2,v1} Ljava/lang/String;->indexOf(Ljava/lang/String;I)I
move-result v2
invoke-virtual {v0,v1,v2} Ljava/lang/String;->substring(II)Ljava/lang/String;
move-result-object v1
const-string v2 "QiHooPayAlipay"
new-array v3 v7 [Ljava/lang/Object;
new-instance v4 Ljava/lang/StringBuilder;
invoke-direct {v4} Ljava/lang/StringBuilder;-><init>()V
const-string v5 "支付宝支付接口通知statusCode:"
invoke-virtual {v4,v5} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
invoke-virtual {v4,v1} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
invoke-virtual {v4} Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v4
aput-object v4 v3 v6
invoke-static {v2,v3} Lcom/qihoo/gamecenter/sdk/pay/k/c;->a(Ljava/lang/String;[Ljava/lang/Object;)V
label_225:
const/4 v2 0
const-string v3 "out_trade_no=\""
invoke-virtual {v0,v3} Ljava/lang/String;->indexOf(Ljava/lang/String;)I
move-result v4
if-le v4 v8 :label_249
invoke-virtual {v3} Ljava/lang/String;->length()I
move-result v2
add-int/2addr v2 v4
const-string v3 "\""
invoke-virtual {v0,v3,v2} Ljava/lang/String;->indexOf(Ljava/lang/String;I)I
move-result v3
invoke-virtual {v0,v2,v3} Ljava/lang/String;->substring(II)Ljava/lang/String;
move-result-object v2
label_249:
const-string v3 "QiHooPayAlipay"
new-array v4 v9 [Ljava/lang/Object;
const-string v5 "tradeNo = "
aput-object v5 v4 v6
invoke-static {v2} Landroid/text/TextUtils;->isEmpty(Ljava/lang/CharSequence;)Z
move-result v5
if-eqz v5 :label_265
const-string v2 ""
label_265:
aput-object v2 v4 v7
invoke-static {v3,v4} Lcom/qihoo/gamecenter/sdk/pay/k/c;->a(Ljava/lang/String;[Ljava/lang/Object;)V
const-string v2 "9000"
invoke-virtual {v1,v2} Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v2
if-eqz v2 :label_385
const-string v1 "success=\""
invoke-virtual {v0,v1} Ljava/lang/String;->indexOf(Ljava/lang/String;)I
move-result v2
if-le v2 v8 :label_536
invoke-virtual {v1} Ljava/lang/String;->length()I
move-result v1
add-int/2addr v1 v2
const-string v2 "\""
invoke-virtual {v0,v2,v1} Ljava/lang/String;->indexOf(Ljava/lang/String;I)I
move-result v2
invoke-virtual {v0,v1,v2} Ljava/lang/String;->substring(II)Ljava/lang/String;
move-result-object v0
label_301:
const-string v1 "QiHooPayAlipay"
new-array v2 v9 [Ljava/lang/Object;
const-string v3 "success = "
aput-object v3 v2 v6
aput-object v0 v2 v7
invoke-static {v1,v2} Lcom/qihoo/gamecenter/sdk/pay/k/c;->a(Ljava/lang/String;[Ljava/lang/Object;)V
const-string v1 "true"
invoke-virtual {v0,v1} Ljava/lang/String;->equalsIgnoreCase(Ljava/lang/String;)Z
move-result v0
if-eqz v0 :label_9
const-string v0 "360sdk_alipay_success"
iget-object v1 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v1} Lcom/qihoo/gamecenter/sdk/pay/b/b;->b(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Landroid/app/Activity;
move-result-object v1
invoke-static {v1} Lcom/qihoo/gamecenter/sdk/common/i/c;->a(Landroid/content/Context;)Ljava/util/Map;
move-result-object v1
invoke-static {v0,v1} Lcom/qihoo/stat/QHStatDo;->event(Ljava/lang/String;Ljava/util/Map;)V
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->b(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Landroid/app/Activity;
move-result-object v0
const-string v1 "360sdk_pay_alipay_success"
invoke-static {v0,v1} Lcom/qihoo/gamecenter/sdk/common/i/a;->a(Landroid/content/Context;Ljava/lang/String;)V
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Lcom/qihoo/gamecenter/sdk/pay/a$a;
move-result-object v0
if-eqz v0 :label_9
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Lcom/qihoo/gamecenter/sdk/pay/a$a;
move-result-object v1
sget-object v2 Lcom/qihoo/gamecenter/sdk/pay/a$b;->a:Lcom/qihoo/gamecenter/sdk/pay/a$b;
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
iget-object v3 v0 Lcom/qihoo/gamecenter/sdk/pay/b/b;->b:Ljava/lang/String;
invoke-static {} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a()Ljava/util/Map;
move-result-object v0
const-string v4 "9000"
invoke-interface {v0,v4} Ljava/util/Map;->get(Ljava/lang/Object;)Ljava/lang/Object;
move-result-object v0
check-cast v0 Ljava/lang/String;
invoke-virtual {v1,v2,v3,v0} Lcom/qihoo/gamecenter/sdk/pay/a$a;->a(Lcom/qihoo/gamecenter/sdk/pay/a$b;Ljava/lang/String;Ljava/lang/String;)V
goto/16 :label_9
label_385:
const-string v2 "8000"
invoke-virtual {v1,v2} Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v1
if-eqz v1 :label_430
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Lcom/qihoo/gamecenter/sdk/pay/a$a;
move-result-object v0
if-eqz v0 :label_9
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Lcom/qihoo/gamecenter/sdk/pay/a$a;
move-result-object v1
sget-object v2 Lcom/qihoo/gamecenter/sdk/pay/a$b;->d:Lcom/qihoo/gamecenter/sdk/pay/a$b;
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
iget-object v3 v0 Lcom/qihoo/gamecenter/sdk/pay/b/b;->b:Ljava/lang/String;
invoke-static {} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a()Ljava/util/Map;
move-result-object v0
const-string v4 "8000"
invoke-interface {v0,v4} Ljava/util/Map;->get(Ljava/lang/Object;)Ljava/lang/Object;
move-result-object v0
check-cast v0 Ljava/lang/String;
invoke-virtual {v1,v2,v3,v0} Lcom/qihoo/gamecenter/sdk/pay/a$a;->a(Lcom/qihoo/gamecenter/sdk/pay/a$b;Ljava/lang/String;Ljava/lang/String;)V
goto/16 :label_9
label_430:
const-string v1 "memo={"
invoke-virtual {v0,v1} Ljava/lang/String;->indexOf(Ljava/lang/String;)I
move-result v2
if-le v2 v8 :label_534
invoke-virtual {v1} Ljava/lang/String;->length()I
move-result v1
add-int/2addr v1 v2
const-string v2 "};"
invoke-virtual {v0,v2,v1} Ljava/lang/String;->indexOf(Ljava/lang/String;I)I
move-result v2
invoke-virtual {v0,v1,v2} Ljava/lang/String;->substring(II)Ljava/lang/String;
move-result-object v0
const-string v1 "QiHooPayAlipay"
new-array v2 v7 [Ljava/lang/Object;
new-instance v3 Ljava/lang/StringBuilder;
invoke-direct {v3} Ljava/lang/StringBuilder;-><init>()V
const-string v4 "支付宝支付接口通知failReason:"
invoke-virtual {v3,v4} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v3
invoke-virtual {v3,v0} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v3
invoke-virtual {v3} Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v3
aput-object v3 v2 v6
invoke-static {v1,v2} Lcom/qihoo/gamecenter/sdk/pay/k/c;->a(Ljava/lang/String;[Ljava/lang/Object;)V
label_481:
const-string v1 "360sdk_alipay_fail"
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/common/i/c;->a(Ljava/lang/String;)Ljava/util/Map;
move-result-object v2
invoke-static {v1,v2} Lcom/qihoo/stat/QHStatDo;->event(Ljava/lang/String;Ljava/util/Map;)V
iget-object v1 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v1} Lcom/qihoo/gamecenter/sdk/pay/b/b;->b(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Landroid/app/Activity;
move-result-object v1
const-string v2 "360sdk_pay_alipay_fail"
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/common/i/a;->a(Ljava/lang/String;)Ljava/util/HashMap;
move-result-object v0
invoke-static {v1,v2,v0} Lcom/qihoo/gamecenter/sdk/common/i/a;->a(Landroid/content/Context;Ljava/lang/String;Ljava/util/HashMap;)V
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Lcom/qihoo/gamecenter/sdk/pay/a$a;
move-result-object v0
if-eqz v0 :label_9
iget-object v0 v10 Lcom/qihoo/gamecenter/sdk/pay/b/b$2;->a:Lcom/qihoo/gamecenter/sdk/pay/b/b;
invoke-static {v0} Lcom/qihoo/gamecenter/sdk/pay/b/b;->a(Lcom/qihoo/gamecenter/sdk/pay/b/b;)Lcom/qihoo/gamecenter/sdk/pay/a$a;
move-result-object v0
sget-object v1 Lcom/qihoo/gamecenter/sdk/pay/a$b;->b:Lcom/qihoo/gamecenter/sdk/pay/a$b;
const-string v2 ""
sget-object v3 Lcom/qihoo/gamecenter/sdk/common/e/a$a;->q:Lcom/qihoo/gamecenter/sdk/common/e/a$a;
invoke-static {v3} Lcom/qihoo/gamecenter/sdk/common/e/a;->a(Lcom/qihoo/gamecenter/sdk/common/e/a$a;)Ljava/lang/String;
move-result-object v3
invoke-virtual {v0,v1,v2,v3} Lcom/qihoo/gamecenter/sdk/pay/a$a;->a(Lcom/qihoo/gamecenter/sdk/pay/a$b;Ljava/lang/String;Ljava/lang/String;)V
goto/16 :label_9
label_534:
move-object v0 v1
goto :label_481
label_536:
move-object v0 v1
goto/16 :label_301
label_540:
.pswitch_data 1
    1 : switch_10
    2 : switch_22
.end pswitch_data
能帮我看看这段代码吗？求助

笑对VS人生

1187112183 发表于 2016-12-30 16:58
const/4 v9 2
const/4 v8 -1
const/4 v7 1

注意：公布的方法只适合本地购买验证，如果服务器上验证或者账号类充值是没有用的。

什么软件？

xiangfengyucn

很有帮助.

打扰了

看看看看

365online

陈cici 发表于 2017-8-13 11:03
你有吾爱破解安卓客户端？能给个链接吗？

论坛搜得到  1.0版的就是

a820922716

已经不行了？好久更新下

wuweide

谢谢分享！！！

陈cici

365online 发表于 2017-7-30 20:20
挺好的，希望多出点这样的教程

你有吾爱破解安卓客户端？能给个链接吗？

xqczxyzwy

多出这样教程教一下新手

jfa2008

楼主你好，我也是一个逆向爱好者，请问可以加个QQ吗？81681140，想请教个问题。谢谢！

ql2234

其它游戏按照这个方法可以修改吗？