安卓移动游戏确定发短信秒破！

Enet

看了满城风雨 的秒破移动所有android游,想怎么让他直接点确定而不会发送,在直接购买成功呢,其实很简单！
首先反编译你要破解的移动游戏这里拿割绳子-中国版测试
教程所用工具：apktool，Notepad++，Signapk签名工具
所有工具请看http://www.52pojie.cn/thread-225309-1-1.html

打开反编译的文件目录


打开res\values\strings.xml找到付费失败的提示

可以看到,您的付费操作失败了，请稍后重试！对应的是gc_billing_fail所以在smali文件中搜索gc_billing_fail

搜到在smali\cn\emagsoftware\gamebilling\view\a$1.smali中

a$1.smali中有三个函数



把onBillingSuccess函数中内容全部复制,把onUserOperCancel内容删掉然后粘贴,再把onBillingFail函数中内容删掉然后再粘贴这样就好了,退出也购买成功,直接点确定发送也成功,其实把onBillingFail函数的内容全删掉就剩return-void也行,不过不会马上提示成功会等几秒,好了保存。

还有一步,以防万一把他的发短信权限去除！打开AndroidManifest.xml

找到<uses-permission android:name="android.permission.SEND_SMS" />把它删除就行了！

好了,接下来就打包签名安装！






还有手机端破解方法也是一样！
工具：dalvik字节码

打开要破解的游戏点击classes.dex进入

然后选择搜索字符串

搜索：gc_billing_fail

搜到3个点击进入cn\emagsoftware\gamebilling\view\a$1选择Methods


和电脑上一样有3个,把onBillingSuccess函数中内容全部复制,把onUserOperCancel内容删掉然后粘贴,再把onBillingFail函数中内容删掉然后再粘贴这样就好了,退出也买成功,直接点确定发送也成功,其实把onBillingFail函数的内容全删掉就剩return-void也行,不过不会马上提示成功会等几秒！





好了然后保存。
还有一部！保存classes.dex后,在打开AndroidManifest.xml把发短信权限去除,删除这句话

然后就是保存安裝！
反编译加签名工具：http://pan.baidu.com/s/1o6JMxVO
密码：sg87
未破解:http://pan.baidu.com/s/1i3uUh5z
密码:4ky5

吞吞421734914

iget v0 v7 Landroid/os/Message;->what:I
packed-switch v0 :label_246
label_5:
return-void
switch_6:
new-instance v2 Lcom/bx/a/a/f;
iget-object v0 v7 Landroid/os/Message;->obj:Ljava/lang/Object;
check-cast v0 Ljava/lang/String;
invoke-direct {v2,v0} Lcom/bx/a/a/f;-><init>(Ljava/lang/String;)V
const-string v0 "9000"
iget-object v1 v2 Lcom/bx/a/a/f;->a:Ljava/lang/String;
invoke-virtual {v0,v1} Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v0
if-eqz v0 :label_130
const-string v1 "success"
const-string v0 "支付成功！"
label_29:
new-instance v2 Ljava/util/HashMap;
invoke-direct {v2} Ljava/util/HashMap;-><init>()V
const-string v3 "result"
invoke-interface {v2,v3,v1} Ljava/util/Map;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
const-string v1 "logCode"
iget-object v3 v6 Lcom/bx/a/a/b;->a:Lcom/bx/a/a/a;
invoke-static {v3} Lcom/bx/a/a/a;->a(Lcom/bx/a/a/a;)Ljava/lang/String;
move-result-object v3
invoke-interface {v2,v1,v3} Ljava/util/Map;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
const-string v1 "method"
const-string v3 "result"
invoke-interface {v2,v1,v3} Ljava/util/Map;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
const-string v1 "payCode"
iget-object v3 v6 Lcom/bx/a/a/b;->a:Lcom/bx/a/a/a;
invoke-static {v3} Lcom/bx/a/a/a;->b(Lcom/bx/a/a/a;)Ljava/lang/String;
move-result-object v3
invoke-interface {v2,v1,v3} Ljava/util/Map;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
const-string v1 "price"
iget-object v3 v6 Lcom/bx/a/a/b;->a:Lcom/bx/a/a/a;
invoke-static {v3} Lcom/bx/a/a/a;->c(Lcom/bx/a/a/a;)Ljava/lang/String;
move-result-object v3
invoke-interface {v2,v1,v3} Ljava/util/Map;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
const-string v1 "payType"
const-string v3 "alipay"
invoke-interface {v2,v1,v3} Ljava/util/Map;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
const-string v1 "resultMsg"
invoke-interface {v2,v1,v0} Ljava/util/Map;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
new-instance v3 Lcom/bx/pay/BXPay;
sget-object v4 Lcom/bx/pay/a/c;->a:Landroid/content/Context;
sget-object v0 Lcom/bx/pay/a/d;->x:Ljava/util/HashMap;
const-string v1 "appId"
invoke-virtual {v0,v1} Ljava/util/HashMap;->get(Ljava/lang/Object;)Ljava/lang/Object;
move-result-object v0
check-cast v0 Ljava/lang/String;
sget-object v1 Lcom/bx/pay/a/d;->x:Ljava/util/HashMap;
const-string v5 "channelCode"
invoke-virtual {v1,v5} Ljava/util/HashMap;->get(Ljava/lang/Object;)Ljava/lang/Object;
move-result-object v1
check-cast v1 Ljava/lang/String;
invoke-direct {v3,v4,v0,v1} Lcom/bx/pay/BXPay;-><init>(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V
iget-object v0 v6 Lcom/bx/a/a/b;->a:Lcom/bx/a/a/a;
invoke-static {v0} Lcom/bx/a/a/a;->d(Lcom/bx/a/a/a;)Landroid/content/Context;
move-result-object v0
sget-object v1 Lcom/bx/a/a/a;->a:Lcom/bx/pay/backinf/PayCallback;
invoke-virtual {v3,v2,v0,v1} Lcom/bx/pay/BXPay;->a(Ljava/util/Map;Landroid/content/Context;Lcom/bx/pay/backinf/PayCallback;)V
goto :label_5
label_130:
const-string v0 "4000"
iget-object v1 v2 Lcom/bx/a/a/f;->a:Ljava/lang/String;
invoke-virtual {v0,v1} Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v0
if-eqz v0 :label_161
const-string v1 "fail"
new-instance v0 Ljava/lang/StringBuilder;
const-string v3 "支付失败！"
invoke-direct {v0,v3} Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
iget-object v2 v2 Lcom/bx/a/a/f;->a:Ljava/lang/String;
invoke-virtual {v0,v2} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v0
invoke-virtual {v0} Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v0
goto/16 :label_29
label_161:
const-string v0 "8000"
iget-object v1 v2 Lcom/bx/a/a/f;->a:Ljava/lang/String;
invoke-virtual {v0,v1} Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v0
if-eqz v0 :label_192
const-string v1 "fail"
new-instance v0 Ljava/lang/StringBuilder;
const-string v3 "支付失败！"
invoke-direct {v0,v3} Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
iget-object v2 v2 Lcom/bx/a/a/f;->a:Ljava/lang/String;
invoke-virtual {v0,v2} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v0
invoke-virtual {v0} Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v0
goto/16 :label_29
label_192:
const-string v0 "6001"
iget-object v1 v2 Lcom/bx/a/a/f;->a:Ljava/lang/String;
invoke-virtual {v0,v1} Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v0
if-eqz v0 :label_208
const-string v1 "cancel"
const-string v0 "取消支付！"
goto/16 :label_29
label_208:
const-string v0 "6002"
iget-object v1 v2 Lcom/bx/a/a/f;->a:Ljava/lang/String;
invoke-virtual {v0,v1} Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v0
if-eqz v0 :label_239
const-string v1 "fail"
new-instance v0 Ljava/lang/StringBuilder;
const-string v3 "支付失败！"
invoke-direct {v0,v3} Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V
iget-object v2 v2 Lcom/bx/a/a/f;->a:Ljava/lang/String;
invoke-virtual {v0,v2} Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v0
invoke-virtual {v0} Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v0
goto/16 :label_29
label_239:
const-string v1 "fail"
const-string v0 "其它异常!alipayData"
goto/16 :label_29
label_246:
.pswitch_data 1
    1 : switch_6
.end pswitch_data
谢谢了

高丽丽

楼主  你也靠谱点吧 手机破解  说的没说清楚呀  麻烦指点指点呀  工具运行了  我怎么着你到你说的那个文件呀

yancie

谢谢楼主。其实只要用lbe就可以拦截的。。

xiao234380508

沙发是我的嚒·
  这个也可以算是个教程吧··哈哈·！！

转角处丶接吻

看不懂我 联通的，

644134574

大神的技术贴，  完全不懂啊。

Enet

yancie 发表于 2014-1-19 12:47
谢谢楼主。其实只要用lbe就可以拦截的。。

拦截多没劲。

Enet

xiao234380508 发表于 2014-1-19 12:49
沙发是我的嚒·
  这个也可以算是个教程吧··哈哈·！！

哈哈

小试锋芒

鼓励加精，期待更多更好的教程！

九零-鑫鑫

这个可以有 谢谢楼主分享  _(:з」∠)_

Bds1r

很到位，里程碑~ 起到了抛砖引玉的作用！~