官方bilibiliWindows破解入门Android逆向入门
【网络诊断修复工具】切换到窄版

吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步，快速开始

吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn»网站 › 【 软件安全 】 › 『移动安全区』 › 仨笨贼1.0 内购破解教程
12345678910... 12下一页
返回列表 发新帖
查看: 50834|回复: 107
收起左侧

[Android 原创] 仨笨贼1.0 内购破解教程

  [复制链接]
小试锋芒
小试锋芒 发表于 2013-12-27 08:52
本帖最后由 小试锋芒 于 2014-9-3 08:27 编辑

1、APK反编译。

2、在AndroidManifest中找到主Activity：com.mm.cm.sbz.ApplicationDemo
截图00.png

3、打开ApplicationDemo.class，可以很容易发现三个关于付费的成员变量：
截图01.png

4、再往下看，可以看到付费失败和 付费成功的成员方法：
截图02.png

在startGame1()方法中可以看到该应用的APPID和APPKEY：
截图03.png

5、我们很容易想到将付费失败方法的内容替换成付费成功的内容，那么这样无论购买成功与否，最终都会执行成功时的动作，因此我们将付费失败的smali代码替换成成功的代码。
修改前的代码：
[AppleScript] 纯文本查看 复制代码
.method private billingFailed(I)V
    .locals 1
    .parameter "sbillingIndex"

    .prologue
    .line 224
    const/4 v0, 0x0

    invoke-static {p1, v0}, Lcom/mm/cm/sbz/ApplicationDemo;->nativeBillingSuccess(II)V

    .line 225
    return-void
.end method


修改后的代码：
[AppleScript] 纯文本查看 复制代码
.method private billingFailed(I)V
    .locals 2
    .parameter "sbillingIndex"

    .prologue
    .line 229
    const/4 v0, 0x1

    invoke-static {p1, v0}, Lcom/mm/cm/sbz/ApplicationDemo;->nativeBillingSuccess(II)V

    .line 231
    packed-switch p1, :pswitch_data_0

    .line 256
    :goto_0
    return-void

    .line 234
    :pswitch_0
    const-string v0, "30000283477701"

    const-string v1, "6"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 237
    :pswitch_1
    const-string v0, "30000283477703"

    const-string v1, "1"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 240
    :pswitch_2
    const-string v0, "30000283477705"

    const-string v1, "1"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 243
    :pswitch_3
    const-string v0, "30000283477702"

    const-string v1, "1"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 246
    :pswitch_4
    const-string v0, "30000283477704"

    const-string v1, "1"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 249
    :pswitch_5
    const-string v0, "30000283477706"

    const-string v1, "2"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 252
    :pswitch_6
    const-string v0, "30000283477707"

    const-string v1, "2"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 231
    :pswitch_data_0
    .packed-switch 0x0
        :pswitch_0
        :pswitch_1
        :pswitch_2
        :pswitch_3
        :pswitch_4
        :pswitch_5
        :pswitch_6
    .end packed-switch
.end method


6、修改保存，重新编译签名，测试发现，当我们点击某个物品购买时，会弹出相应的购买界面，此时我们只要点击返回按钮，购买就成功了！
图4.png

7、到此，已经达到了破解内购的目的，但是不完美，因为会弹出购买界面，我们想要点击购买时，不弹出任何界面就成功购买。继续分析，在  public void addAdvertisement2(int paramInt)方法中发现有“网络连接失败”的字眼，并且有对各个物品购买的监听事件，因此我们在这里面做文章，给它偷天换日。将addAdvertisement2的smali代码替换成付费成功的代码.

图5.png

修改前：
[AppleScript] 纯文本查看 复制代码
.method public addAdvertisement2(I)V
    .locals 5
    .parameter "billingIndex"

    .prologue
    .line 283
    const-string v1, "tag"

    new-instance v2, Ljava/lang/StringBuilder;

    invoke-direct {v2}, Ljava/lang/StringBuilder;-><init>()V

    invoke-virtual {v2, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v2

    invoke-virtual {v2}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v2

    invoke-static {v1, v2}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I

    .line 286
    packed-switch p1, :pswitch_data_0

    .line 318
    :goto_0
    return-void

    .line 289
    :pswitch_0
    :try_start_0
    sget-object v1, Lcom/mm/cm/sbz/ApplicationDemo;->purchase:Lmm/purchasesdk/Purchase;

    sget-object v2, Lcom/mm/cm/sbz/ApplicationDemo;->context:Landroid/content/Context;

    const-string v3, "30000283477701"

    iget-object v4, p0, Lcom/mm/cm/sbz/ApplicationDemo;->mListener:Lcom/mm/cm/sbz/IAPListener;

    invoke-virtual {v1, v2, v3, v4}, Lmm/purchasesdk/Purchase;->order(Landroid/content/Context;Ljava/lang/String;Lmm/purchasesdk/OnPurchaseListener;)Ljava/lang/String;
    :try_end_0
    .catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0

    goto :goto_0

    .line 313
    :catch_0
    move-exception v0

    .line 315
    .local v0, e:Ljava/lang/Exception;
    invoke-virtual {v0}, Ljava/lang/Exception;->printStackTrace()V

    .line 316
    sget-object v1, Lcom/mm/cm/sbz/ApplicationDemo;->context:Landroid/content/Context;

    const-string v2, "\u7f51\u7edc\u8fde\u63a5\u5931\u8d25"

    const/4 v3, 0x0

    invoke-static {v1, v2, v3}, Landroid/widget/Toast;->makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;

    move-result-object v1

    invoke-virtual {v1}, Landroid/widget/Toast;->show()V

    goto :goto_0

    .line 292
    .end local v0           #e:Ljava/lang/Exception;
    :pswitch_1
    :try_start_1
    sget-object v1, Lcom/mm/cm/sbz/ApplicationDemo;->purchase:Lmm/purchasesdk/Purchase;

    sget-object v2, Lcom/mm/cm/sbz/ApplicationDemo;->context:Landroid/content/Context;

    const-string v3, "30000283477703"

    iget-object v4, p0, Lcom/mm/cm/sbz/ApplicationDemo;->mListener:Lcom/mm/cm/sbz/IAPListener;

    invoke-virtual {v1, v2, v3, v4}, Lmm/purchasesdk/Purchase;->order(Landroid/content/Context;Ljava/lang/String;Lmm/purchasesdk/OnPurchaseListener;)Ljava/lang/String;

    goto :goto_0

    .line 295
    :pswitch_2
    sget-object v1, Lcom/mm/cm/sbz/ApplicationDemo;->purchase:Lmm/purchasesdk/Purchase;

    sget-object v2, Lcom/mm/cm/sbz/ApplicationDemo;->context:Landroid/content/Context;

    const-string v3, "30000283477705"

    iget-object v4, p0, Lcom/mm/cm/sbz/ApplicationDemo;->mListener:Lcom/mm/cm/sbz/IAPListener;

    invoke-virtual {v1, v2, v3, v4}, Lmm/purchasesdk/Purchase;->order(Landroid/content/Context;Ljava/lang/String;Lmm/purchasesdk/OnPurchaseListener;)Ljava/lang/String;

    goto :goto_0

    .line 298
    :pswitch_3
    sget-object v1, Lcom/mm/cm/sbz/ApplicationDemo;->purchase:Lmm/purchasesdk/Purchase;

    sget-object v2, Lcom/mm/cm/sbz/ApplicationDemo;->context:Landroid/content/Context;

    const-string v3, "30000283477702"

    iget-object v4, p0, Lcom/mm/cm/sbz/ApplicationDemo;->mListener:Lcom/mm/cm/sbz/IAPListener;

    invoke-virtual {v1, v2, v3, v4}, Lmm/purchasesdk/Purchase;->order(Landroid/content/Context;Ljava/lang/String;Lmm/purchasesdk/OnPurchaseListener;)Ljava/lang/String;

    goto :goto_0

    .line 301
    :pswitch_4
    sget-object v1, Lcom/mm/cm/sbz/ApplicationDemo;->purchase:Lmm/purchasesdk/Purchase;

    sget-object v2, Lcom/mm/cm/sbz/ApplicationDemo;->context:Landroid/content/Context;

    const-string v3, "30000283477704"

    iget-object v4, p0, Lcom/mm/cm/sbz/ApplicationDemo;->mListener:Lcom/mm/cm/sbz/IAPListener;

    invoke-virtual {v1, v2, v3, v4}, Lmm/purchasesdk/Purchase;->order(Landroid/content/Context;Ljava/lang/String;Lmm/purchasesdk/OnPurchaseListener;)Ljava/lang/String;

    goto :goto_0

    .line 304
    :pswitch_5
    sget-object v1, Lcom/mm/cm/sbz/ApplicationDemo;->purchase:Lmm/purchasesdk/Purchase;

    sget-object v2, Lcom/mm/cm/sbz/ApplicationDemo;->context:Landroid/content/Context;

    const-string v3, "30000283477706"

    iget-object v4, p0, Lcom/mm/cm/sbz/ApplicationDemo;->mListener:Lcom/mm/cm/sbz/IAPListener;

    invoke-virtual {v1, v2, v3, v4}, Lmm/purchasesdk/Purchase;->order(Landroid/content/Context;Ljava/lang/String;Lmm/purchasesdk/OnPurchaseListener;)Ljava/lang/String;

    goto :goto_0

    .line 307
    :pswitch_6
    sget-object v1, Lcom/mm/cm/sbz/ApplicationDemo;->purchase:Lmm/purchasesdk/Purchase;

    sget-object v2, Lcom/mm/cm/sbz/ApplicationDemo;->context:Landroid/content/Context;

    const-string v3, "30000283477707"

    iget-object v4, p0, Lcom/mm/cm/sbz/ApplicationDemo;->mListener:Lcom/mm/cm/sbz/IAPListener;

    invoke-virtual {v1, v2, v3, v4}, Lmm/purchasesdk/Purchase;->order(Landroid/content/Context;Ljava/lang/String;Lmm/purchasesdk/OnPurchaseListener;)Ljava/lang/String;
    :try_end_1
    .catch Ljava/lang/Exception; {:try_start_1 .. :try_end_1} :catch_0

    goto :goto_0

    .line 286
    nop

    :pswitch_data_0
    .packed-switch 0x0
        :pswitch_0
        :pswitch_1
        :pswitch_2
        :pswitch_3
        :pswitch_4
        :pswitch_5
        :pswitch_6
    .end packed-switch
.end method


修改后：
[AppleScript] 纯文本查看 复制代码
.method public addAdvertisement2(I)V
    .locals 2
    .parameter "sbillingIndex"

    .prologue
    .line 229
    const/4 v0, 0x1

    invoke-static {p1, v0}, Lcom/mm/cm/sbz/ApplicationDemo;->nativeBillingSuccess(II)V

    .line 231
    packed-switch p1, :pswitch_data_0

    .line 256
    :goto_0
    return-void

    .line 234
    :pswitch_0
    const-string v0, "30000283477701"

    const-string v1, "6"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 237
    :pswitch_1
    const-string v0, "30000283477703"

    const-string v1, "1"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 240
    :pswitch_2
    const-string v0, "30000283477705"

    const-string v1, "1"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 243
    :pswitch_3
    const-string v0, "30000283477702"

    const-string v1, "1"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 246
    :pswitch_4
    const-string v0, "30000283477704"

    const-string v1, "1"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 249
    :pswitch_5
    const-string v0, "30000283477706"

    const-string v1, "2"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 252
    :pswitch_6
    const-string v0, "30000283477707"

    const-string v1, "2"

    invoke-static {p0, v0, v1}, Lcom/cm/tools/Tool;->startGamePay(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V

    goto :goto_0

    .line 231
    :pswitch_data_0
    .packed-switch 0x0
        :pswitch_0
        :pswitch_1
        :pswitch_2
        :pswitch_3
        :pswitch_4
        :pswitch_5
        :pswitch_6
    .end packed-switch
.end method


8、修改保存，重新编译，签名，测试，不再弹出购买界面，直接购买成功。







免费评分

参与人数 6热心值 +6 收起 理由
lsyAndroid + 1 谢谢@Thanks！
死神眯路 + 1 欢迎分析讨论交流，吾爱破解论坛有你更精彩.
YUEN + 1 我很赞同！
疯萧萧 + 1 我很赞同！
淡然出尘 + 1 我很赞同！
无名L + 1 支持原创，谢谢楼主

查看全部评分

本帖被以下淘专辑推荐:

发帖前要善用【论坛搜索】功能，那里可能会有你要找的答案或者已经有人发布过相同内容了，请勿重复发帖。
回复

举报

wangdongdexin
wangdongdexin 发表于 2013-12-27 09:01
看着好有诱惑力呀 楼主给我一个 俺也试试呗
【吾爱破解论坛总版规】 - [让你充分了解吾爱破解论坛行为规则]
回复 支持 1

举报

GGLHY
GGLHY 发表于 2013-12-27 08:58
吾爱破解论坛没有任何官方QQ群，禁止留联系方式，禁止任何商业交易。
围观大婶
求跟随您的脚步~~~
如何升级？如何获得积分？积分对应解释说明！
回复 支持 1

举报

小淫仙
小淫仙 发表于 2013-12-27 09:03
《站点帮助文档》有什么问题来这里看看吧，这里有你想知道的内容！
又学习了安卓方面的知识!
呼吁大家发布原创作品添加吾爱破解论坛标识！
回复 支持

举报

御剑
御剑 发表于 2013-12-27 09:12
学习了...感谢分享
如何快速判断一个文件是否为病毒！
回复 支持

举报

sunset920
sunset920 发表于 2013-12-27 09:21
吼吼。。。安卓破解原来还是挺容易的呢
回复 支持

举报

1354669803
1354669803 发表于 2013-12-27 09:32
我反正是死也看不懂
回复 支持

举报

九零-鑫鑫
九零-鑫鑫 发表于 2013-12-27 09:36
安卓看起来比较简单... 毕竟俺学过Java ... 谢谢楼主分享
回复 支持

举报

xxjgdzz
xxjgdzz 发表于 2013-12-27 09:50
学习了...感谢分享
回复 支持

举报

凌宵
凌宵 发表于 2013-12-27 10:16 来自手机
还有更简单的方法！自己去找度娘
回复 支持

举报

下一页 »
12345678910... 12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告：本版块禁止灌水或回复与主题无关内容，违者重罚！


免责声明：
吾爱破解所发布的一切破解补丁、注册机和注册信息及软件的解密分析文章仅限用于学习和研究目的；不得将上述内容用于商业或者非法用途，否则，一切后果请用户自负。本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑中彻底删除上述内容。如果您喜欢该程序，请支持正版软件，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。

Mail To:Service@52pojie.cn

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2024-5-1 20:35

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表