御剑 发表于 2014-4-28 17:03

去除安卓程序自动发短信权限 与天天跑你妹的另类破解

本帖最后由 御剑 于 2014-4-28 17:08 编辑

【文章标题】: 去除安卓程序自动发短信权限 与天天跑你妹的另类破解
【文章作者】: 御剑
【作者邮箱】: 408885352@qq.com
【作者主页】: 无
【作者QQ号】: 无
【软件名称】: 天天跑你妹
【下载地址】: http://pan.baidu.com/s/1gdmnaU3为方便新手研究我就把这个版本上传百度网盘吧
【加壳方式】: 无
【编写语言】: JAVA
【使用工具】: ApkIDE
【软件介绍】: 【安卓游戏】没什么好介绍的...
【作者声明】: 只是技术交流，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】

经过上次的破解后我们已经可以免费购买游戏中的道具与钻石（地址：http://www.52pojie.cn/thread-254443-1-1.html）
但我们发现购买多次道具或钻石后再次购买的话会提示“支付失败，请稍后再试(30003)”

现在我们就先来解决下这个问题吧！
首先用 ApkIDE 打开 天天跑你妹 然后搜索“支付失败”（记得先转换为Unicode）

很明显第一条就是我们所要的 ,我们双击进去
.method public final a(ILjava/lang/String;)V
    .locals 3

    const-string v0, "uucunpay"

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "onError arg0="

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v1, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, ", arg1="

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1, p2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v0, v1}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I

    iget-object v0, p0, Lcom/luyougame/pay/a/b;->a:Lcom/luyougame/pay/a/a;

    invoke-static {v0, p2}, Lcom/luyougame/pay/a/a;->a(Lcom/luyougame/pay/a/a;Ljava/lang/String;)V

    if-eqz p2, :cond_0

    invoke-virtual {p2}, Ljava/lang/String;->length()I

    move-result v0

    const/4 v1, 0x1

    if-gt v0, v1, :cond_1

    :cond_0
    iget-object v0, p0, Lcom/luyougame/pay/a/b;->a:Lcom/luyougame/pay/a/a;

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "\u652f\u4ed8\u5931\u8d25\uff0c\u8bf7\u7a0d\u540e\u518d\u8bd5("

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v1, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, ")"

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v0, v1}, Lcom/luyougame/pay/a/a;->a(Lcom/luyougame/pay/a/a;Ljava/lang/String;)V

    :cond_1
    new-instance v0, Lcom/luyougame/pay/a/c;

    invoke-direct {v0, p0}, Lcom/luyougame/pay/a/c;-><init>(Lcom/luyougame/pay/a/b;)V

    invoke-static {}, Lcom/luyougame/uucun_meizhirun/MZRun;->a()Lcom/luyougame/uucun_meizhirun/MZRun;

    move-result-object v1

    invoke-virtual {v1, v0}, Lcom/luyougame/uucun_meizhirun/MZRun;->a(Ljava/lang/Runnable;)V

    const/4 v0, 0x0

    invoke-static {v0, p1}, Lcom/luyougame/jni/GameJniTools;->CallGamePayBilling(ZI)V

    invoke-static {}, Lcom/luyougame/uucun_meizhirun/MZRun;->a()Lcom/luyougame/uucun_meizhirun/MZRun;

    move-result-object v0

    const/16 v1, 0x3ea

    invoke-virtual {v0, v1}, Lcom/luyougame/uucun_meizhirun/MZRun;->a(I)V

    return-void
.end method
下面我们大概的分析下
.method public final a(ILjava/lang/String;)V
    .locals 3

    const-string v0, "uucunpay"

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "onError arg0=" //arg0的错误信息 =

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v1, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, ", arg1="//arg1 =

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1, p2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v0, v1}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I

    iget-object v0, p0, Lcom/luyougame/pay/a/b;->a:Lcom/luyougame/pay/a/a;

    invoke-static {v0, p2}, Lcom/luyougame/pay/a/a;->a(Lcom/luyougame/pay/a/a;Ljava/lang/String;)V

    if-eqz p2, :cond_0//判断是否跳转到:cond_0

    invoke-virtual {p2}, Ljava/lang/String;->length()I

    move-result v0

    const/4 v1, 0x1

    if-gt v0, v1, :cond_1 //判断是否跳转到:cond_1

    :cond_0//跳转到这里则提示“支付失败，请稍后再试”
    iget-object v0, p0, Lcom/luyougame/pay/a/b;->a:Lcom/luyougame/pay/a/a;

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "\u652f\u4ed8\u5931\u8d25\uff0c\u8bf7\u7a0d\u540e\u518d\u8bd5("

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    invoke-virtual {v1, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, ")"

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v0, v1}, Lcom/luyougame/pay/a/a;->a(Lcom/luyougame/pay/a/a;Ljava/lang/String;)V

    :cond_1//跳转到这里则重启程序
    new-instance v0, Lcom/luyougame/pay/a/c;

    invoke-direct {v0, p0}, Lcom/luyougame/pay/a/c;-><init>(Lcom/luyougame/pay/a/b;)V

    invoke-static {}, Lcom/luyougame/uucun_meizhirun/MZRun;->a()Lcom/luyougame/uucun_meizhirun/MZRun;

    move-result-object v1

    invoke-virtual {v1, v0}, Lcom/luyougame/uucun_meizhirun/MZRun;->a(Ljava/lang/Runnable;)V

    const/4 v0, 0x0

    invoke-static {v0, p1}, Lcom/luyougame/jni/GameJniTools;->CallGamePayBilling(ZI)V

    invoke-static {}, Lcom/luyougame/uucun_meizhirun/MZRun;->a()Lcom/luyougame/uucun_meizhirun/MZRun;

    move-result-object v0

    const/16 v1, 0x3ea

    invoke-virtual {v0, v1}, Lcom/luyougame/uucun_meizhirun/MZRun;->a(I)V

    return-void
.end method
经过分析我们知道这只是一个错误提示的函数。
我们搜索下函数头 (a(ILjava/lang/String;)V) 来看看是哪个位置调用了这个函数

搜索到了很多...但我们不知道具体是哪个才是我们所需要的.所以我们只能慢慢分析。
双击第一条找到的信息
# virtual methods
.method public abstract a()V
.end method

.method public abstract a(ILjava/lang/String;)V
.end method

.method public abstract b()V
.end method

.method public abstract b(ILjava/lang/String;)V
.end method
很明显这并不是我们所需要的，继续查看下一条
.method public onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z
    .locals 3

    const/4 v0, 0x1

    sparse-switch p1, :sswitch_data_0

    invoke-super {p0, p1, p2, p3, p4}, Landroid/os/Binder;->onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z

    move-result v0

    :goto_0
    return v0

    :sswitch_0
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p3, v1}, Landroid/os/Parcel;->writeString(Ljava/lang/String;)V

    goto :goto_0

    :sswitch_1
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->a()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_2
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->b()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_3
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->a(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_4
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->b(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    nop

    :sswitch_data_0
    .sparse-switch
      0x1 -> :sswitch_1
      0x2 -> :sswitch_2
      0x3 -> :sswitch_3
      0x4 -> :sswitch_4
      0x5f4e5446 -> :sswitch_0
    .end sparse-switch
.end method

这条看起来就比较可疑了...
那么我们来进行分析下
.method public onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z
    .locals 3

    const/4 v0, 0x1
      
    sparse-switch p1, :sswitch_data_0 进行分支选择

    invoke-super {p0, p1, p2, p3, p4}, Landroid/os/Binder;->onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z

    move-result v0

    :goto_0
    return v0

    :sswitch_0//重启程序
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p3, v1}, Landroid/os/Parcel;->writeString(Ljava/lang/String;)V

    goto :goto_0

    :sswitch_1//进行安全检测
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->a()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_2//进入支付验证
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->b()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_3//支付失败，请稍后再试
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->a(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_4//进行安全检测后返回
    const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->b(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    nop

    :sswitch_data_0
    .sparse-switch
      0x1 -> :sswitch_1
      0x2 -> :sswitch_2
      0x3 -> :sswitch_3
      0x4 -> :sswitch_4
      0x5f4e5446 -> :sswitch_0
    .end sparse-switch
.end method
经过上面的分析后相信大家都知道接下来该怎么做了吧...
我们的目标是让它进入支付验证..至于怎么让它进入支付验证嘛...
方法有很多...其中最简单的就是直接用我们之前常用goto语句了...直接在switch语句前goto 到:sswitch_2 就能实现我们所需达到的目标了
.method public onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z
    .locals 3

    const/4 v0, 0x1
goto :sswitch_2//我们就在执行switch分支选择语句前直接用goto语句跳转到 :sswitch_2 这样就可以直接进入支付验证了
    sparse-switch p1, :sswitch_data_0 //进行分支选择

    invoke-super {p0, p1, p2, p3, p4}, Landroid/os/Binder;->onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z

    move-result v0

    :goto_0
    return v0

    :sswitch_0//重启程序
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p3, v1}, Landroid/os/Parcel;->writeString(Ljava/lang/String;)V

    goto :goto_0

    :sswitch_1//进行安全检测
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->a()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_2//进入支付验证
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->b()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_3//支付失败，请稍后再试
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->a(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_4//进行安全检测后返回
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p2}, Landroid/os/Parcel;->readInt()I

    move-result v1

    invoke-virtual {p2}, Landroid/os/Parcel;->readString()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {p0, v1, v2}, Lcom/a/a/a/b;->b(ILjava/lang/String;)V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    nop

    :sswitch_data_0
    .sparse-switch
      0x1 -> :sswitch_1
      0x2 -> :sswitch_2
      0x3 -> :sswitch_3
      0x4 -> :sswitch_4
      0x5f4e5446 -> :sswitch_0
    .end sparse-switch
.end method
OK 现在基本已完美破解了...
还有经过测试我们发现了一个意外惊喜!
那就是我们只需要在执行switch分支选择语句前直接用goto语句跳转到 :sswitch_2就可以直接达到破解的效果了...



不过会先提示支付失败的信息然后再提示充值成功...而且钻石神马依然会购买成功的！
至于提示失败的解决方法请参考天天跑你妹的破解教程（地址：http://www.52pojie.cn/thread-254443-1-1.html）


接下来就是去除游戏自动发送短信的权限...以避免某些不必要的麻烦...
其实去除安卓程序自动发送短信的权限很简单，只需要把“安卓程序注册发送短信权限”的语句删除即可

Android注册发送短信权限： <uses-permission android:name="android.permission.SEND_SMS" />
Android注册写短信权限：<uses-permission android:name="android.permission.WRITE_SMS" />
或者把“安卓程序注册写短信权限”的语句删除也一样可以达到效果

现在我来演示下吧
我们搜索<uses-permission android:name="android.permission.SEND_SMS" />

双击打开搜索到的结果
<?xml version="1.0" encoding="utf-8"?>
<manifest android:versionCode="3" android:versionName="1.2.0" package="com.luyougame.uucun_meizhirun"
xmlns:android="http://schemas.android.com/apk/res/android">
    <supports-screens android:anyDensity="true" android:smallScreens="true" android:normalScreens="true" android:largeScreens="true" android:resizeable="true" />
    <uses-feature android:glEsVersion="0x20000" />
    <uses-permission android:name="android.permission.RUN_INSTRUMENTATION" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.READ_PHONE_STATE" />
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.WRITE_SETTINGS" />
    <uses-permission android:name="android.permission.RECEIVE_SMS" />
    <uses-permission android:name="android.permission.RECEIVE_MMS" />
    <uses-permission android:name="android.permission.SEND_SMS" /> //Android注册发送短信权限
    <uses-permission android:name="android.permission.READ_SMS" />//Android注册接收短信权限
    <uses-permission android:name="android.permission.WRITE_SMS" />//Android注册写短信权限
    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
    <uses-permission android:name="android.permission.GET_TASKS" />
    <uses-permission android:name="android.permission.READ_LOGS" />
    <uses-permission android:name="android.permission.RESTART_PACKAGES" />
    <uses-permission android:name="android.permission.RECEIVE_WAP_PUSH" />
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
    <uses-permission android:name="android.permission.WAKE_LOCK" />
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
    <application android:label="@string/app_name" android:icon="@drawable/icon" android:debuggable="true">
      <activity android:theme="@android:style/Theme.NoTitleBar.Fullscreen" android:label="@string/app_name" android:name="com.luyougame.uucun_meizhirun.MZRun" android:screenOrientation="landscape" android:configChanges="orientation">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
      </activity>
      <receiver android:name="com.uucun.smspay.receiver.BootReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <category android:name="android.intent.category.HOME" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.SIM_STATE_CHANGED" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.intent.action.TIME_SET" />
            </intent-filter>
      </receiver>
      <receiver android:name="com.uucun.smspay.receiver.ShutdownReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
            </intent-filter>
      </receiver>
      <receiver android:name="com.uucun.smspay.receiver.SMSReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.USER_PRESENT" />
                <action android:name="android.intent.action.ACTION_POWER_CONNECTED" />
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.provider.Telephony.SMS_RECEIVED" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
            <intent-filter>
                <action android:name="android.provider.Telephony.WAP_PUSH_RECEIVED" />
                <data android:mimeType="application/vnd.wap.mms-message" />
            </intent-filter>
            <intent-filter>
                <action android:name="com.android.mms.transaction.MESSAGE_SENT" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <data android:scheme="package" />
            </intent-filter>
      </receiver>
      <receiver android:name="com.uucun.smspay.receiver.NetworkChangeReceiver">
            <intent-filter>
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            </intent-filter>
      </receiver>
      <service android:name="com.uucun.smspay.service.DataService" />
      <service android:name="com.uucun.smspay.aidl.PayService" android:exported="true" />
      <activity android:theme="@style/payment_uucun_NoTitleDialog" android:name="com.uucun.smspay.activity.UpdateDialogActivity" android:excludeFromRecents="true" />
      <activity android:theme="@style/payment_uucun_NoTitleDialog" android:name="com.uucun.smspay.activity.NetworkActivity" android:excludeFromRecents="true" />
      <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.SplashActivity" android:excludeFromRecents="true" android:configChanges="keyboardHidden|orientation" />
      <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.SMSPayActivity" android:configChanges="keyboardHidden|orientation" />
      <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.LocalSMSPayActivity" android:configChanges="keyboardHidden|orientation" />
      <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.PayResultActivity" android:configChanges="keyboardHidden|orientation" />
      <meta-data android:name="TDGA_APP_ID" android:value="19397EF50B38A0E678C78C494B3CCED2" />
      <meta-data android:name="TDGA_CHANNEL_ID" android:value="108_3" />
    </application>
    <supports-screens android:anyDensity="true" android:smallScreens="true" android:normalScreens="true" android:largeScreens="true" />
</manifest>
我们把<uses-permission android:name="android.permission.SEND_SMS" /> //Android注册发送短信权限 删除
<?xml version="1.0" encoding="utf-8"?>
<manifest android:versionCode="3" android:versionName="1.2.0" package="com.luyougame.uucun_meizhirun"
xmlns:android="http://schemas.android.com/apk/res/android">
    <supports-screens android:anyDensity="true" android:smallScreens="true" android:normalScreens="true" android:largeScreens="true" android:resizeable="true" />
    <uses-feature android:glEsVersion="0x20000" />
    <uses-permission android:name="android.permission.RUN_INSTRUMENTATION" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.READ_PHONE_STATE" />
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.WRITE_SETTINGS" />
    <uses-permission android:name="android.permission.RECEIVE_SMS" />
    <uses-permission android:name="android.permission.RECEIVE_MMS" />

    <uses-permission android:name="android.permission.READ_SMS" />//Android注册接收短信权限
<uses-permission android:name="android.permission.WRITE_SMS" />//Android注册写短信权限
<uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
    <uses-permission android:name="android.permission.GET_TASKS" />
    <uses-permission android:name="android.permission.READ_LOGS" />
    <uses-permission android:name="android.permission.RESTART_PACKAGES" />
    <uses-permission android:name="android.permission.RECEIVE_WAP_PUSH" />
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
    <uses-permission android:name="android.permission.WAKE_LOCK" />
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
    <application android:label="@string/app_name" android:icon="@drawable/icon" android:debuggable="true">
      <activity android:theme="@android:style/Theme.NoTitleBar.Fullscreen" android:label="@string/app_name" android:name="com.luyougame.uucun_meizhirun.MZRun" android:screenOrientation="landscape" android:configChanges="orientation">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
      </activity>
      <receiver android:name="com.uucun.smspay.receiver.BootReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <category android:name="android.intent.category.HOME" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.SIM_STATE_CHANGED" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.intent.action.TIME_SET" />
            </intent-filter>
      </receiver>
      <receiver android:name="com.uucun.smspay.receiver.ShutdownReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
            </intent-filter>
      </receiver>
      <receiver android:name="com.uucun.smspay.receiver.SMSReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.USER_PRESENT" />
                <action android:name="android.intent.action.ACTION_POWER_CONNECTED" />
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.provider.Telephony.SMS_RECEIVED" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
            <intent-filter>
                <action android:name="android.provider.Telephony.WAP_PUSH_RECEIVED" />
                <data android:mimeType="application/vnd.wap.mms-message" />
            </intent-filter>
            <intent-filter>
                <action android:name="com.android.mms.transaction.MESSAGE_SENT" />
            </intent-filter>
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <data android:scheme="package" />
            </intent-filter>
      </receiver>
      <receiver android:name="com.uucun.smspay.receiver.NetworkChangeReceiver">
            <intent-filter>
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            </intent-filter>
      </receiver>
      <service android:name="com.uucun.smspay.service.DataService" />
      <service android:name="com.uucun.smspay.aidl.PayService" android:exported="true" />
      <activity android:theme="@style/payment_uucun_NoTitleDialog" android:name="com.uucun.smspay.activity.UpdateDialogActivity" android:excludeFromRecents="true" />
      <activity android:theme="@style/payment_uucun_NoTitleDialog" android:name="com.uucun.smspay.activity.NetworkActivity" android:excludeFromRecents="true" />
      <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.SplashActivity" android:excludeFromRecents="true" android:configChanges="keyboardHidden|orientation" />
      <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.SMSPayActivity" android:configChanges="keyboardHidden|orientation" />
      <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.LocalSMSPayActivity" android:configChanges="keyboardHidden|orientation" />
      <activity android:theme="@style/payment_uucun_theme_FullScreen_translucent" android:name="com.uucun.smspay.activity.PayResultActivity" android:configChanges="keyboardHidden|orientation" />
      <meta-data android:name="TDGA_APP_ID" android:value="19397EF50B38A0E678C78C494B3CCED2" />
      <meta-data android:name="TDGA_CHANNEL_ID" android:value="108_3" />
    </application>
    <supports-screens android:anyDensity="true" android:smallScreens="true" android:normalScreens="true" android:largeScreens="true" />
</manifest>
OK 修改完毕...记得修改保存，重新编译，签名！


周卫国 发表于 2014-4-28 17:47

请教楼主,以下两段代码并无区别,GOTO语句的意义是什么?

:sswitch_1//进行安全检测
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->a()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

    :sswitch_2//进入支付验证
const-string v1, "com.uucun.smspay.aidl.IPayCallBack"

    invoke-virtual {p2, v1}, Landroid/os/Parcel;->enforceInterface(Ljava/lang/String;)V

    invoke-virtual {p0}, Lcom/a/a/a/b;->b()V

    invoke-virtual {p3}, Landroid/os/Parcel;->writeNoException()V

    goto :goto_0

御剑 发表于 2014-4-28 18:10

本帖最后由 御剑 于 2014-4-28 20:30 编辑

周卫国 发表于 2014-4-28 17:47
请教楼主,以下两段代码并无区别,GOTO语句的意义是什么?

:sswitch_1//进行安全检测

:sswitch_1//进行安全检测
invoke-virtual {p0}, Lcom/a/a/a/b;->a()V
:sswitch_2//进入支付验证
invoke-virtual {p0}, Lcom/a/a/a/b;->b()V
goto 语句 = 汇编的JMP   
也就是无条件跳转


djy597060921 发表于 2014-4-28 17:10

前排支持，支持大神{:1_921:}

阿富汗2013 发表于 2014-4-28 17:38

看看不说话{:1_912:}

星期五 发表于 2014-4-28 17:58

谢谢楼主分享哈····

w780628d 发表于 2014-4-28 18:29

zc123 发表于 2014-4-28 18:54

很好的教程

sos521qqq 发表于 2014-4-29 11:25

落草为寇 发表于 2014-4-29 12:00

看了不回复，于心不安，晚上回家试试，谢谢楼主
页: [1] 2
查看完整版本: 去除安卓程序自动发短信权限 与天天跑你妹的另类破解


免责声明：
吾爱破解所发布的一切破解补丁、注册机和注册信息及软件的解密分析文章仅限用于学习和研究目的；不得将上述内容用于商业或者非法用途，否则，一切后果请用户自负。本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑中彻底删除上述内容。如果您喜欢该程序，请支持正版软件，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。

Mail To:Service@52pojie.cn