安卓游戏破解问题 - yoyo斗地主(单机版)

liouxin · 发表于 2014-8-5 00:03

本帖最后由 liouxin 于 2014-8-5 11:47 编辑

唉，说来话长啊，我、尽量长话短说吧

按照安卓逆向教程准备自己动手操作一下，结果就遇到了难题

首先我准备破解的是一款移动的单击游戏(为了防止破解不当造成扣费···)

游戏我还是给一下链接：“超链接”
http://download.cmgame.com:8513/entry?C=0300000001&ContentID=600716013326&F=1431888_1431889&T=86c097e318b845b49f3b636691ee6ec2&D=0&Y=2&H=12064000&M=0&P=1&G=0&U=0&E=6118&R=DL&A=600716013326&W=760000003931&CFM=1&GCT=0&FN=%5Bg.10086.cn%5DyoyoDDZDJB.apk&S=4b54753450b75c03ce96ed2de26131c8
——————————————————————————————

游戏购买金币取消时有个提示信息“购买取消”
于是IDE加载该游戏搜索到字符串后来带smali代码(下图)
“为了方便好看，我把字符串转换成了ASCII”

QQ截图20140804235806.png

下面是smali源码

[Java] 纯文本查看 复制代码

.class Lcom/yoyo/poker/MM/GamePokerActivity$3;
.super Ljava/lang/Object;
.source "GamePokerActivity.java"

# interfaces
.implements Lcn/cmgame/billing/api/GameInterface$IPayCallback;


# annotations
.annotation system Ldalvik/annotation/EnclosingMethod;
    value = Lcom/yoyo/poker/MM/GamePokerActivity;->doBilling_YD(Ljava/lang/String;)V
.end annotation

.annotation system Ldalvik/annotation/InnerClass;
    accessFlags = 0x0
    name = null
.end annotation


# instance fields
.field final synthetic this$0:Lcom/yoyo/poker/MM/GamePokerActivity;


# direct methods
.method constructor <init>(Lcom/yoyo/poker/MM/GamePokerActivity;)V
    .locals 0

    .prologue
    .line 1
    iput-object p1, p0, Lcom/yoyo/poker/MM/GamePokerActivity$3;->this$0:Lcom/yoyo/poker/MM/GamePokerActivity;

    .line 202
    invoke-direct {p0}, Ljava/lang/Object;-><init>()V

    return-void
.end method


# virtual methods
.method public onResult(ILjava/lang/String;Ljava/lang/Object;)V
    .locals 8
    .param p1, "resultCode"    # I
    .param p2, "billingIndex"    # Ljava/lang/String;
    .param p3, "obj"    # Ljava/lang/Object;

    .prologue
    const/4 v7, 0x1

    const/4 v6, 0x0

    .line 205
    const-string v2, ""

    .line 206
    .local v2, "result":Ljava/lang/String;
    packed-switch p1, :pswitch_data_0

    .line 230
    const-string v2, "购买取消！"

    .line 231
    iget-object v3, p0, Lcom/yoyo/poker/MM/GamePokerActivity$3;->this$0:Lcom/yoyo/poker/MM/GamePokerActivity;

    invoke-virtual {v3, v6}, Lcom/yoyo/poker/MM/GamePokerActivity;->customsPass(Z)V

    .line 232
    invoke-static {p2, v6}, Lcn/cmgame/billing/api/GameInterface;->setActivateFlag(Ljava/lang/String;Z)V

    .line 235
    :goto_0
    iget-object v3, p0, Lcom/yoyo/poker/MM/GamePokerActivity$3;->this$0:Lcom/yoyo/poker/MM/GamePokerActivity;

    invoke-static {v3, v2, v6}, Landroid/widget/Toast;->makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;

    move-result-object v3

    invoke-virtual {v3}, Landroid/widget/Toast;->show()V

    .line 237
    return-void

    .line 208
    :pswitch_0
    invoke-static {p2, v7}, Lcn/cmgame/billing/api/GameInterface;->setActivateFlag(Ljava/lang/String;Z)V

    .line 209
    invoke-static {}, Lcom/yoyo/poker/MM/ddz;->getInstence()Lcom/yoyo/poker/MM/ddz;

    move-result-object v3

    iput-boolean v7, v3, Lcom/yoyo/poker/MM/ddz;->MMCode0:Z

    .line 210
    const/4 v0, 0x0

    .local v0, "i":I
    :goto_1
    invoke-static {}, Lcom/yoyo/poker/MM/ddz;->getInstence()Lcom/yoyo/poker/MM/ddz;

    move-result-object v3

    iget-object v3, v3, Lcom/yoyo/poker/MM/ddz;->MMCode_:[Ljava/lang/String;

    array-length v3, v3

    if-lt v0, v3, :cond_0

    .line 222
    const-string v2, "购买成功，请稍后！"

    .line 223
    goto :goto_0

    .line 212
    :cond_0
    invoke-static {}, Lcom/yoyo/poker/MM/ddz;->getInstence()Lcom/yoyo/poker/MM/ddz;

    move-result-object v3

    iget-object v3, v3, Lcom/yoyo/poker/MM/ddz;->MMCode_:[Ljava/lang/String;

    aget-object v3, v3, v0

    const-string v4, ","

    invoke-virtual {v3, v4}, Ljava/lang/String;->split(Ljava/lang/String;)[Ljava/lang/String;

    move-result-object v1

    .line 213
    .local v1, "q":[Ljava/lang/String;
    iget-object v3, p0, Lcom/yoyo/poker/MM/GamePokerActivity$3;->this$0:Lcom/yoyo/poker/MM/GamePokerActivity;

    iget-object v3, v3, Lcom/yoyo/poker/MM/GamePokerActivity;->billId_:Ljava/lang/String;

    if-eqz v3, :cond_2

    .line 215
    iget-object v3, p0, Lcom/yoyo/poker/MM/GamePokerActivity$3;->this$0:Lcom/yoyo/poker/MM/GamePokerActivity;

    iget-object v3, v3, Lcom/yoyo/poker/MM/GamePokerActivity;->billId_:Ljava/lang/String;

    aget-object v4, v1, v6

    invoke-virtual {v3, v4}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v3

    if-eqz v3, :cond_2

    .line 217
    iget-object v3, p0, Lcom/yoyo/poker/MM/GamePokerActivity$3;->this$0:Lcom/yoyo/poker/MM/GamePokerActivity;

    iget-object v3, v3, Lcom/yoyo/poker/MM/GamePokerActivity;->billId_:Ljava/lang/String;

    const-string v4, "007"

    invoke-virtual {v3, v4}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v3

    if-eqz v3, :cond_1

    iget-object v3, p0, Lcom/yoyo/poker/MM/GamePokerActivity$3;->this$0:Lcom/yoyo/poker/MM/GamePokerActivity;

    invoke-virtual {v3, v7}, Lcom/yoyo/poker/MM/GamePokerActivity;->customsPass(Z)V

    .line 218
    :cond_1
    invoke-static {}, Lcom/yoyo/poker/MM/GameView;->getInstance()Lcom/yoyo/poker/MM/GameView;

    move-result-object v3

    new-instance v4, Ljava/lang/StringBuilder;

    const-string v5, "d JB"

    invoke-direct {v4, v5}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    const/4 v5, 0x2

    aget-object v5, v1, v5

    invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v4

    invoke-virtual {v4}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v4

    invoke-virtual {v3, v4}, Lcom/yoyo/poker/MM/GameView;->SND(Ljava/lang/String;)V

    .line 210
    :cond_2
    add-int/lit8 v0, v0, 0x1

    goto :goto_1

    .line 225
    .end local v0    # "i":I
    .end local v1    # "q":[Ljava/lang/String;
    :pswitch_1
    const-string v2, "购买失败！"

    .line 226
    iget-object v3, p0, Lcom/yoyo/poker/MM/GamePokerActivity$3;->this$0:Lcom/yoyo/poker/MM/GamePokerActivity;

    invoke-virtual {v3, v6}, Lcom/yoyo/poker/MM/GamePokerActivity;->customsPass(Z)V

    .line 227
    invoke-static {p2, v6}, Lcn/cmgame/billing/api/GameInterface;->setActivateFlag(Ljava/lang/String;Z)V

    goto :goto_0

    .line 206
    nop

    :pswitch_data_0
    .packed-switch 0x1
        :pswitch_0
        :pswitch_1
    .end packed-switch
.end method

SO、之后，我把取消的那段代码全部替换成成功的代码后结果安装运行没问题

但是，单击购买金币那里就显示“程序意外停止”

所以前来吾爱寻求大牛指导哪里出错了，在下感激不尽啊

liouxin · 发表于 2014-8-5 11:35

ruoxin 发表于 2014-8-5 00:41
还以为是安卓游戏可下载玩呢汗

安卓逆向又不是一两天的事了，否者那些破解版的游戏哪里来的？

liouxin · 发表于 2014-8-5 11:50

索马里的海贼发表于 2014-8-5 01:21
建议直接把失败的cond_?改成成功的cond_?

代码里面根本就没有成功失败的cond_?

⺌哆哩咪 · 发表于 2014-8-5 00:16

你是不是改掉签名了？

ruoxin · 发表于 2014-8-5 00:41

还以为是安卓游戏可下载玩呢汗

索马里的海贼 · 发表于 2014-8-5 01:21

建议直接把失败的cond_?改成成功的cond_?

sos521qqq · 发表于 2014-8-5 10:01

提示: 作者被禁止或删除内容自动屏蔽

liouxin · 发表于 2014-8-5 11:34

⺌哆哩咪发表于 2014-8-5 00:16
你是不是改掉签名了？

跟签名没关系吧，游戏可以正常运行

liouxin · 发表于 2014-8-5 11:48

sos521qqq 发表于 2014-8-5 10:01
是不是没有留返回

整段代码替换的，怎么可能没有留返回

索马里的海贼 · 发表于 2014-8-5 11:59

liouxin 发表于 2014-8-5 11:50
代码里面根本就没有成功失败的cond_?

最下面的不是失败的????

帐号		自动登录	找回密码
密码			注册[Register]

sos521qqq sos521qqq 当前离线好友阅读权限 0 听众最后登录 1970-1-1 头像被屏蔽	sos521qqq 发表于 2014-8-5 10:01 提示: 作者被禁止或删除内容自动屏蔽

	回复支持举报

[Android 分享] 安卓游戏破解问题 - yoyo斗地主(单机版)