本帖最后由 cool147852369 于 2021-3-20 11:37 编辑
打开某商店,下了个国际版的日语app
很快啊,打开,哦,汉字部分要钱
0x01 丢到某管理器,编辑dex 搜索only buy once
0x02 进入,重复步骤1
0x03 关键字存在,smali转java
0x04 代码内容
[Java] 纯文本查看 复制代码 public a() {
if (Q.k() == 1) {
xxxxxxxxxxxxxxxxxl.e0.d dVar = new xxxxxxxxxxxxxxxxxl.e0.d("Unlock 2300 kanji", "Learn and practice Kanji from N5 - N1", 2131165495);
xxxxxxxxxxxxxxxxxl.e0.d dVar2 = new xxxxxxxxxxxxxxxxxl.e0.d("10000 words", "Learn and practice 10000 words with native audio", 2131165496);
xxxxxxxxxxxxxxxxxl.e0.d dVar3 = new xxxxxxxxxxxxxxxxxl.e0.d("Remove ads", "Bring the best experience to you", 2131165497);
this.r0.add(dVar);
this.r0.add(dVar2);
this.r0.add(dVar3);
}
if (Q.k() == 0) {
dVar = new xxxxxxxxxxxxxxxxxl.e0.d("M\u1edf kh\u00f3a 2300 ch\u1eef kanji", "H\u1ecdc v\u00e0 luy\u1ec7n ch\u1eef Kanji t\u1eeb N5 - N1", 2131165495);
dVar2 = new xxxxxxxxxxxxxxxxxl.e0.d("10000 t\u1eeb", "H\u1ecdc v\u00e0 luy\u1ec7n 10000 t\u1eeb v\u1edbi \u00e2m thanh b\u1ea3n \u0111\u1ecba", 2131165496);
dVar3 = new xxxxxxxxxxxxxxxxxl.e0.d("X\u00f3a qu\u1ea3ng c\u00e1o", "Mang l\u1ea1i tr\u1ea3i nghi\u1ec7m t\u1ed1t nh\u1ea5t cho b\u1ea1n", 2131165497);
this.r0.add(dVar);
this.r0.add(dVar2);
this.r0.add(dVar3);
}
if (Q.k() == 2) {
dVar = new xxxxxxxxxxxxxxxxxl.e0.d("Buka 2300 kanji", "Pelajari dan latih Kanji dari N5 - N1", 2131165495);
dVar2 = new xxxxxxxxxxxxxxxxxl.e0.d("10.000 kata", "Pelajari dan latih 10.000 kata dengan audio asli", 2131165496);
dVar3 = new xxxxxxxxxxxxxxxxxl.e0.d("Hapus iklan", "Hadirkan pengalaman terbaik untuk Anda", 2131165497);
this.r0.add(dVar);
this.r0.add(dVar2);
this.r0.add(dVar3);
}
}
0x05 跳过 值为1 的部分
也就是去除 if (Q.k() == 1) 的部分
回到smail
追踪const v3
出现已购买字样,变更 条件跳转到购买位
将未付费的条件语句指向付费后的语句部分就可以了
保存退出
根据版规,软件不提供成品和源版下载,歇歇 |