看电视最烦躁的就是垃圾广告了，电视猫前几天天天提示升级，3.17网上未找到去广告的版本，只能自己动手丰衣足食了。言归正传
1、下载最新电视猫3.17拖入gda和android killer 为啥拖入这两个里面呢，gda分析快修改不方便，android killer，修改方便分析相当慢，（也可能是我电脑太挫）
gda，秒开电视猫后先搜一下方法ad
是不是发现有两个比较有意思呢showAd和loadAd
先看一下showAd
是一些smali，看着太乱
[Asm] 纯文本查看 复制代码 4a0f50-0000e6: private AdView->showAd()V
[method@ad5a]:showAd
| .regsize : [5]
| .insnsSize : [107] 16-bit
| registers: v0 v1 v2 v3 v4
4a0f60: 13030800 |0000: const/16 v3, #int 8 // #8
4a0f64: 1212 |0002: const/4 v2, #int 1 // #1
4a0f66: 1a005110 |0003: const-string v0, string@1051 // "AdView"
4a0f6a: 1a01d1a7 |0005: const-string v1, string@a7d1 // "show ad"
4a0f6e: 712001e61000 |0007: invoke-static {v0, v1}, method@e601 // Lcom/tencent/tads/main/SLog;->d(Ljava/lang/String;Ljava/lang/String;)V
4a0f74: 55402155 |000a: iget-boolean v0, v4, field[url=home.php?mod=space&uid=321369]@5521[/url] // Lcom/tencent/ads/view/AdView;->mIsTVApp:Z
4a0f78: 38000600 |000c: if-eqz v0, 0012 // +0006
4a0f7c: 1200 |000e: const/4 v0, #int 0 // #0
4a0f7e: 6e2053ad0400 |000f: invoke-virtual {v4, v0}, method@ad53 // Lcom/tencent/ads/view/AdView;->setFocusable(Z)V
4a0f84: 52400555 |0012: iget v0, v4, field@5505 // Lcom/tencent/ads/view/AdView;->mAdType:I
4a0f88: 32200c00 |0014: if-eq v0, v2, 0020 // +000c
4a0f8c: 52400555 |0016: iget v0, v4, field@5505 // Lcom/tencent/ads/view/AdView;->mAdType:I
4a0f90: 1231 |0018: const/4 v1, #int 3 // #3
4a0f92: 32100700 |0019: if-eq v0, v1, 0020 // +0007
4a0f96: 52400555 |001b: iget v0, v4, field@5505 // Lcom/tencent/ads/view/AdView;->mAdType:I
4a0f9a: 1241 |001d: const/4 v1, #int 4 // #4
4a0f9c: 33101500 |001e: if-ne v0, v1, 0033 // +0015
4a0fa0: 7010b9ac0400 |0020: invoke-direct {v4}, method@acb9 // Lcom/tencent/ads/view/AdView;->addNormalAd()V
4a0fa6: 55401e55 |0023: iget-boolean v0, v4, field@551e // Lcom/tencent/ads/view/AdView;->mIsMiniView:Z
4a0faa: 39000600 |0025: if-nez v0, 002b // +0006
4a0fae: 1200 |0027: const/4 v0, #int 0 // #0
用gda的另一个原因是他有类似IDA的f5,你懂得
右键tojava 或者f5键
[Java] 纯文本查看 复制代码 import com.tencent.tads.main.SLog;
import java.lang.String;
import com.tencent.ads.view.AdView;
import com.tencent.ads.service.f;
import java.lang.Throwable;
import com.tencent.ads.service.AppAdConfig;
private void AdView.showAd() //method@ad5a
{
const int v3 = 8;
const byte v2 = 1;
try{
SLog.d("AdView", "show ad");
if (this.mIsTVApp) {
this.setFocusable(0);
}
if ((this.mAdType == v2)||(this.mAdType == 3)) {
label_0020:
this.addNormalAd();
}
else {
if (this.mAdType != 4) {
if (this.mAdType != 2) {
if (!((this.mAdType == 5)||(this.mAdType == 6))) {
if (this.mAdType != v3) {
if (this.mAdType != 9) {
label_0023:
if (!this.mIsMiniView) {
this.setVisibility(0);
}
SLog.d("AdView", "finish show ad");
return;
}
else {
this.addSuperCornerAd();
goto label_0023;
}
}
}
if (this.mAdType == v3) {
AppAdConfig.getInstance().setIsPlayingAd(1);
}
this.addIvbAd();
goto label_0023;
}
else {
this.addPauseAd();
goto label_0023;
}
}
else {
goto label_0020;
}
}
}catch(java.lang.Exception v0){
f.a(v0, "AdView showAd");
return;
}
}
里面有好多关于ad的函数应该是一个关键了
再看一下哪里引用这个showad方法了
进去看一下
[Asm] 纯文本查看 复制代码 49c4f4-000018: static AdView->access$15(Lcom/tencent/ads/view/AdView;)V
[method@ac7e]:access$15
| .regsize : [1]
| .insnsSize : [4] 16-bit
| registers: v0
49c504: 70105aad0000 |0000: invoke-direct {v0}, method@ad5a // Lcom/tencent/ads/view/AdView;->showAd()V
49c50a: 0e00 |0003: return-void
其对应的java代码
[Java] 纯文本查看 复制代码 import com.tencent.ads.view.AdView;
static void AdView.access$15(AdView p0) //method@ac7e
{
p0.showAd();
return;
}
关键就是p0.showAd();了直接把对应的smali语句invoke-direct {v0}, method@ad5a // Lcom/tencent/ads/view/AdView;->showAd()V在android killer中删除就好了
如何找到对应位置呢看这个smali头部AdView->access$15(Lcom/tencent/ads/view/AdView;)V
com/tencent/ads/view/AdView就是它所在的位置或者直接在android killer中查看方法引用
双击定位到 invoke-direct {p0}, Lcom/tencent/ads/view/AdView;->showAd()V 删除此行。
接下来看一下loadad，根据搜索ad的结果可以看出这个方法也在adview这个类中
再看一下这个函数内容
[Java] 纯文本查看 复制代码 public void AdView.loadAd(AdRequest p0) //method@ad22
{
const int v8 = 9;
const byte v7 = 3;
const byte v6 = 1;
const byte v5 = 2;
const byte v4 = 0;
StringBuilder v1 = new StringBuilder("loadAd: ");
SLog.d("AdView", v1.append(p0).toString());
AppAdConfig.getInstance().setIsPlayingAd(v4);
if ((!p0)||(p0.getAdType() != v5)) {
label_0030:
this.initCommonParams(p0);
this.setClickable(v4);
if (!(p0)&&(!TextUtils.isEmpty(p0.getVid()))) {
StringBuilder v1 = new StringBuilder("needAd: ");
SLog.d("AdView", v1.append(p0.getNeedAdFlag()).toString());
if (p0.getNeedAdFlag()) {
this.mAdType = p0.getAdType();
this.mAdMonitor.a(this.mAdType, v4);
this.mAdMonitor.h(p0.getTpid());
this.keyStrategies = AdStrategyManager.a().a(v4, this.mAdType, this.mAdRequest.getVid(), this.mAdRequest.getCid());
if (!this.mIsMiniView) {
if (!((!this.mIsTVApp)||(a.a().w() != v7))) {
p0.setDtype("3");
}
if (!((AdSetting.getApp() != AdSetting$APP.f)||(p0.getPu() != v5))) {
ErrorCode v0 = new ErrorCode(200, "User is vip.");
this.mErrorCode = v0;
this.fireFailedEvent();
return;
}
this.mErrorCode = AdService.getInstance().checkPlayModeForAd(p0);
if (!((this.mAdType == v6)||(this.mAdType == v7))) {
if (this.mAdType != 4) {
if (this.mAdType != v5) {
if (this.mAdType != v8) {
if (!((this.mAdType == 5)||(this.mAdType == 6))) {
if (this.mAdType != 8) {
ErrorCode v0 = new ErrorCode(101, "no ad for this vid.");
this.mErrorCode = v0;
this.fireFailedEvent();
return;
}
}
if (this.mErrorCode) {
this.fireFailedEvent();
return;
}
else {
if (!Utils.isH5Supported()) {
label_002f:
return;
}
else {
this.loadOtherAd(p0, v4);
return;
}
}
}
else {
if (!AdStrategyManager.a().a(v8, v6)) {
ErrorCode v0 = new ErrorCode(128, "no ad due to silver config");
this.mErrorCode = v0;
}
if (Build$VERSION.SDK_INT < 14) {
ErrorCode v0 = new ErrorCode(128, "no ad due to silver config");
this.mErrorCode = v0;
}
if (this.mErrorCode) {
this.fireFailedEvent();
return;
}
else {
if (!this.superCornerManager) {
b v0 = new b(this, this.adVideoPlayerFactory);
this.superCornerManager = v0;
}
this.superCornerManager.a(p0);
return;
}
}
}
else {
if (this.mErrorCode) {
this.fireFailedEvent();
return;
}
else {
this.loadOtherAd(p0, v6);
return;
}
}
}
}
if (!((this.mErrorCode)||(this.cIsTestUser))) {
if (!m.a().j()) {
this.mErrorCode = AdService.getInstance().preCheckAppConfig();
}
}
if (this.mErrorCode) {
this.fireFailedEvent();
return;
}
else {
this.loadNormalAd(p0);
return;
}
}
else {
ErrorCode v0 = new ErrorCode(121, "no ad due to mini view.");
this.mErrorCode = v0;
this.fireFailedEvent();
return;
}
}
else {
ErrorCode v0 = new ErrorCode(116, "no ad due to operating closed.");
this.mErrorCode = v0;
this.fireFailedEvent();
return;
}
}
ErrorCode v0 = new ErrorCode(113, "request is null or vid is null or vid is empty.");
this.mErrorCode = v0;
this.fireFailedEvent();
return;
}
else {
if (this.getScreenOrientation() != v5) {
return;
}
}
}
明显也是一个广告关键位置。
在android killer中查找方法引用居然未找到
用gda试试
找到了几个大家跟进去对应删除
这里就不赘述，刚才我们看到这两个关键广告函数都在adview类中，我们再翻翻这个累还有其他东东不
isQQSportsVip、isVip、isHollyWoodVip，这三个是不是也比较有特点呢，vip判断是否加载广告的，我们也别看哪里引用了，直接让它返回真好了，这里就只以isVip为例介绍一下，那两个也差不多
[Asm] 纯文本查看 复制代码 .method private isVip()Z
.locals 2
.prologue
.line 1867
iget-object v0, p0, Lcom/tencent/ads/view/AdView;->mAdResponse:Lcom/tencent/ads/service/i;
if-eqz v0, :cond_0
.line 1868
iget-object v0, p0, Lcom/tencent/ads/view/AdView;->mAdResponse:Lcom/tencent/ads/service/i;
invoke-virtual {v0}, Lcom/tencent/ads/service/i;->k()Ljava/lang/String;
move-result-object v0
.line 1869
const-string v1, "1"
invoke-virtual {v1, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
move-result v0
if-eqz v0, :cond_0
.line 1870
const/4 v0, 0x1
.line 1873
:goto_0
return v0
:cond_0
const/4 v0, 0x0
goto :goto_0.end method
直接吧没用的都删了只留下
.line 1870
const/4 v0, 0x1
.line 1873
:goto_0
return v0
就好了
继续看adview这个类
init初始化的，进去看一下
[Java] 纯文本查看 复制代码 public void AdView.<init>(Context p0) //method@ac76
{
const long v6 = -1;
const byte v4 = -1;
const byte v3 = 0;
const byte v2 = 0;
super(p0);
this.mIsTVApp = v2;
this.mIsNewsApp = v2;
this.mIsMiniView = v2;
this.playSuccess = v2;
this.mAnchor = v3;
this.mSkipCause = v3;
this.isAdLoadingFinished = v2;
this.tipImage = v3;
this.mIsAppBackground = v2;
this.mAdType = v4;
this.mSubType = AdView$SubType.normal;
this.mStartLoadTime = 0;
this.isInitReceive = 1;
this.mAdPage = v3;
this.mErrorCode = v3;
this.hasMonitorPinged = v2;
this.mIsPausing = v2;
this.mCornerAdResumeTime = v6;
this.mCornerAdRemainderTime = 15000;
this.isPinged = v2;
this.keyEventInfos = v3;
this.lastKeyEventTime = v6;
this.adSecretView = v3;
this.mSkipped = v2;
this.keyStrategies = v3;
this.lastUpdateIndex = v4;
AdView$1 v0 = new AdView$1(this, Looper.getMainLooper());
this.mHandler = v0;
this.mContext = p0;
this.initialize();
StringBuilder v0 = new StringBuilder("new AdView:");
SLog.d(v0.append(p0).toString());
return;
}
this.mCornerAdRemainderTime = 15000;应该是视频开始前的默认15秒广告
const byte v2 = 0;
this.mSkipped = v2;是否跳过
其对应smali
[Asm] 纯文本查看 复制代码 const-wide/16 v0, 0x3a98
iput-wide v0, p0, Lcom/tencent/ads/view/AdView;->mCornerAdRemainderTime:J
[Asm] 纯文本查看 复制代码 iput-boolean v2, p0, Lcom/tencent/ads/view/AdView;->mSkipped:Z
我们把它改为
[Asm] 纯文本查看 复制代码 const-wide/16 v0, 0x0
iput-wide v0, p0, Lcom/tencent/ads/view/AdView;->mCornerAdRemainderTime:J
[Asm] 纯文本查看 复制代码 const/4 v0, 0x1
iput-boolean v0, p0, Lcom/tencent/ads/view/AdView;->mSkipped:Z
然后保存编译装到盒子或电视上试试吧，我测试了两天，看电视剧的时候无广告了，谁如果有免登陆破VIP的经验请指教，争取搞一个无广告VIP版本，去广告成品就不在这里发了，偶的博客可能会有
| 
[复制链接]
发表于 2017-12-13 12:02
发表于 2017-12-14 18:27
