切水果安卓APP逆向过程报告----安卓逆向入门

一、准备工作

下载切水果大战原版.apk.
链接：https://pan.baidu.com/s/18N_Lg8C4O5D1J7cbt99W6Q?pwd=p625
提取码：p625
开始游戏
找找有什么比游戏还好玩的东西
看到有个礼包，点进去
果不其然让你掏钱
点购买，弹出确认支付

不能充值？？！！

直接把这个apk拖到android killer进行逆向

二、开始整活

打开android killer，运行切水果大战.apk
因为刚才出现了“支付失败，请稍后重试”，所以我们选择搜索“失败”试试
输入失败后，点击Aa，选择将文本转化为Unicode选项，就会出现“\u5931\u8d25”

有几个感觉像是支付的东西，我这里瞅mymmpay就像，打开

android killer就是厉害，能直接查看源码

点击就会转化为java源码，我们看看有什么
找到一个关于支付的

可以看出 payResultFalse应该就是我们要找的
上面还有一个payResultCancel。下面还有payResultSuccess，越来越有趣了

再回到初始界面，打开字符串，发现有“购买失败”“购买成功”几个方法
双击进入，找到左面相应的代码

.method public payResultCancel()V.locals 2.prologue.line 1407iget-object v0, p0, Lcom/mydefinemmpay/tool/MymmPay;->psif:Lcom/mydefinemmpay/mypay/PaySuccessInterface;sget v1, Lcom/mydefinemmpay/tool/MymmPay;->payId:Iinvoke-interface {v0, v1}, Lcom/mydefinemmpay/mypay/PaySuccessInterface;->doPayCancel(I)V.line 1408const-string v0, "\u8d2d\u4e70\u53d6\u6d88"invoke-virtual {p0, v0}, Lcom/mydefinemmpay/tool/MymmPay;->showDebug(Ljava/lang/String;)V.line 1411return-void
.end method
-------------------------------------取消购买的代码-----------------------------------------------------

.method public payResultFalse()V.locals 3.prologueconst/4 v2, 0x2.line 1378iget-object v0, p0, Lcom/mydefinemmpay/tool/MymmPay;->psif:Lcom/mydefinemmpay/mypay/PaySuccessInterface;sget v1, Lcom/mydefinemmpay/tool/MymmPay;->payId:Iinvoke-interface {v0, v1}, Lcom/mydefinemmpay/mypay/PaySuccessInterface;->doPayFalse(I)V.line 1379const/4 v0, 0x0iput-boolean v0, p0, Lcom/mydefinemmpay/tool/MymmPay;->paysuss:Z.line 1380const-string v0, "zhifu false"invoke-virtual {p0, v0}, Lcom/mydefinemmpay/tool/MymmPay;->Printlog(Ljava/lang/String;)V.line 1381iget v0, p0, Lcom/mydefinemmpay/tool/MymmPay;->falseTime:Iadd-int/lit8 v0, v0, 0x1iput v0, p0, Lcom/mydefinemmpay/tool/MymmPay;->falseTime:I.line 1384const-string v0, "\u8d2d\u4e70\u5931\u8d25"invoke-virtual {p0, v0}, Lcom/mydefinemmpay/tool/MymmPay;->showDebug(Ljava/lang/String;)V.line 1385iget v0, p0, Lcom/mydefinemmpay/tool/MymmPay;->falseTime:Iif-ne v0, v2, :cond_0.line 1386invoke-static {}, Lcom/mydefinemmpay/tool/MessageUtil;->getInstance()Lcom/mydefinemmpay/tool/MessageUtil;move-result-object v0iget v0, v0, Lcom/mydefinemmpay/tool/MessageUtil;->ADOpen:Iif-ne v0, v2, :cond_0.line 1387sget-object v0, Lcom/mydefinemmpay/tool/MymmPay;->adf:Lcom/mydefinemmpay/mypay/UUADSDKPayInterface;if-eqz v0, :cond_0.line 1388sget-object v0, Lcom/mydefinemmpay/tool/MymmPay;->adf:Lcom/mydefinemmpay/mypay/UUADSDKPayInterface;iget-object v1, p0, Lcom/mydefinemmpay/tool/MymmPay;->context:Landroid/content/Context;invoke-interface {v0, v1, p0}, Lcom/mydefinemmpay/mypay/UUADSDKPayInterface;->init(Landroid/content/Context;Lcom/mydefinemmpay/mypay/MymmPayInterFace;)V.line 1389const-string v0, "\u8d2d\u4e70\u5931\u8d25\u4e24\u6b21\u5f00\u542f\u5e7f\u544a"invoke-virtual {p0, v0}, Lcom/mydefinemmpay/tool/MymmPay;->showDebug(Ljava/lang/String;)V.line 1396:cond_0invoke-virtual {p0}, Lcom/mydefinemmpay/tool/MymmPay;->getLibKind()Imove-result v0const/4 v1, 0x1if-ne v0, v1, :cond_1.line 1397invoke-static {}, Lcom/mydefinemmpay/tool/MessageUtil;->getInstance()Lcom/mydefinemmpay/tool/MessageUtil;move-result-object v0iget-object v0, v0, Lcom/mydefinemmpay/tool/MessageUtil;->sdkKind:Ljava/lang/String;const-string v1, "0"invoke-virtual {v0, v1}, Ljava/lang/String;->equals(Ljava/lang/Object;)Zmove-result v0if-eqz v0, :cond_1.line 1398invoke-virtual {p0}, Lcom/mydefinemmpay/tool/MymmPay;->getPayT()Imove-result v0if-nez v0, :cond_1.line 1399sget-object v0, Lcom/mydefinemmpay/tool/MymmPay;->osif:Lcom/mydefinemmpay/mypay/OtherSDKPayInterface;invoke-interface {v0}, Lcom/mydefinemmpay/mypay/OtherSDKPayInterface;->pay()V.line 1404:cond_1return-void
.end method
-------------------------------------------购买失败的代码-----------------------------------------------

.method public payResultSuccess()V.locals 8.prologueconst/4 v7, 0x1const/4 v6, 0x0.line 1344invoke-static {}, Lcom/mydefinemmpay/tool/RecordOpreate;->getInstance()Lcom/mydefinemmpay/tool/RecordOpreate;move-result-object v3.line 1345sget-object v4, Lcom/mydefinemmpay/tool/RecordOpreate;->totalMoey:Ljava/lang/String;.line 1344invoke-virtual {v3, v4}, Lcom/mydefinemmpay/tool/RecordOpreate;->getData(Ljava/lang/String;)Ljava/lang/String;move-result-object v3invoke-static {v3}, Ljava/lang/Float;->valueOf(Ljava/lang/String;)Ljava/lang/Float;move-result-object v3invoke-virtual {v3}, Ljava/lang/Float;->floatValue()Fmove-result v2.line 1346.local v2, "totalMoney":Finvoke-static {}, Lcom/mydefinemmpay/tool/MessageUtil;->getInstance()Lcom/mydefinemmpay/tool/MessageUtil;move-result-object v3iget v3, v3, Lcom/mydefinemmpay/tool/MessageUtil;->limitMoney:Fcmpg-float v3, v2, v3if-gez v3, :cond_0iget v3, p0, Lcom/mydefinemmpay/tool/MymmPay;->payCodeMoney:Fadd-float/2addr v3, v2invoke-static {}, Lcom/mydefinemmpay/tool/MessageUtil;->getInstance()Lcom/mydefinemmpay/tool/MessageUtil;move-result-object v4iget v4, v4, Lcom/mydefinemmpay/tool/MessageUtil;->limitMoney:Fcmpl-float v3, v3, v4if-ltz v3, :cond_0.line 1347const-string v3, "\u606d\u559c\u60a8\u8fbe\u5230\u6d88\u8d39\u4e0a\u9650\uff0c\u81ea\u52a8\u5f00\u901a\u5c0a\u4eabVIP\uff0c\u60a8\u53ef\u4ee5\u514d\u8d39\u8d2d\u4e70\u4efb\u4f55\u9053\u5177"invoke-virtual {p0, v3}, Lcom/mydefinemmpay/tool/MymmPay;->toastShow(Ljava/lang/String;)V.line 1350:cond_0iget v3, p0, Lcom/mydefinemmpay/tool/MymmPay;->payCodeMoney:Fadd-float/2addr v2, v3.line 1351invoke-static {}, Lcom/mydefinemmpay/tool/RecordOpreate;->getInstance()Lcom/mydefinemmpay/tool/RecordOpreate;move-result-object v3sget-object v4, Lcom/mydefinemmpay/tool/RecordOpreate;->totalMoey:Ljava/lang/String;.line 1352new-instance v5, Ljava/lang/StringBuilder;invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()Vinvoke-virtual {v5, v2}, Ljava/lang/StringBuilder;->append(F)Ljava/lang/StringBuilder;move-result-object v5invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;move-result-object v5.line 1351invoke-virtual {v3, v4, v5}, Lcom/mydefinemmpay/tool/RecordOpreate;->saveData(Ljava/lang/String;Ljava/lang/String;)V.line 1353iget-object v3, p0, Lcom/mydefinemmpay/tool/MymmPay;->psif:Lcom/mydefinemmpay/mypay/PaySuccessInterface;sget v4, Lcom/mydefinemmpay/tool/MymmPay;->payId:Iinvoke-interface {v3, v4}, Lcom/mydefinemmpay/mypay/PaySuccessInterface;->doPaySuccess(I)V.line 1354iput-boolean v7, p0, Lcom/mydefinemmpay/tool/MymmPay;->paysuss:Z.line 1355invoke-static {}, Ljava/lang/System;->currentTimeMillis()Jmove-result-wide v4iput-wide v4, p0, Lcom/mydefinemmpay/tool/MymmPay;->statPtime:J.line 1356sget-object v3, Ljava/lang/System;->out:Ljava/io/PrintStream;new-instance v4, Ljava/lang/StringBuilder;const-string v5, "dpv111111111"invoke-direct {v4, v5}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)Viget-object v5, p0, Lcom/mydefinemmpay/tool/MymmPay;->dpv:Ljava/util/Vector;invoke-virtual {v5}, Ljava/util/Vector;->size()Imove-result v5invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;move-result-object v4invoke-virtual {v4}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;move-result-object v4invoke-virtual {v3, v4}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V.line 1357const/4 v1, 0x0.local v1, "i":I:goto_0iget-object v3, p0, Lcom/mydefinemmpay/tool/MymmPay;->dpv:Ljava/util/Vector;invoke-virtual {v3}, Ljava/util/Vector;->size()Imove-result v3if-lt v1, v3, :cond_2.line 1363sget-object v3, Ljava/lang/System;->out:Ljava/io/PrintStream;new-instance v4, Ljava/lang/StringBuilder;const-string v5, "dpv2222222222222"invoke-direct {v4, v5}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)Viget-object v5, p0, Lcom/mydefinemmpay/tool/MymmPay;->dpv:Ljava/util/Vector;invoke-virtual {v5}, Ljava/util/Vector;->size()Imove-result v5invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;move-result-object v4invoke-virtual {v4}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;move-result-object v4invoke-virtual {v3, v4}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V.line 1364iput v6, p0, Lcom/mydefinemmpay/tool/MymmPay;->falseTime:I.line 1365invoke-virtual {p0}, Lcom/mydefinemmpay/tool/MymmPay;->getLibKind()Imove-result v3if-ne v3, v7, :cond_1.line 1366invoke-static {}, Lcom/mydefinemmpay/tool/MessageUtil;->getInstance()Lcom/mydefinemmpay/tool/MessageUtil;move-result-object v3iget-object v3, v3, Lcom/mydefinemmpay/tool/MessageUtil;->sdkKind:Ljava/lang/String;const-string v4, "0"invoke-virtual {v3, v4}, Ljava/lang/String;->equals(Ljava/lang/Object;)Zmove-result v3if-eqz v3, :cond_1.line 1367iput v6, p0, Lcom/mydefinemmpay/tool/MymmPay;->migfalseTime:I.line 1372:cond_1const-string v3, "\u8d2d\u4e70\u6210\u529f"invoke-virtual {p0, v3}, Lcom/mydefinemmpay/tool/MymmPay;->showDebug(Ljava/lang/String;)V.line 1373return-void.line 1358:cond_2iget-object v3, p0, Lcom/mydefinemmpay/tool/MymmPay;->dpv:Ljava/util/Vector;invoke-virtual {v3, v1}, Ljava/util/Vector;->get(I)Ljava/lang/Object;move-result-object v0check-cast v0, Lcom/mydefinemmpay/tool/DialogPay;.line 1359.local v0, "dp":Lcom/mydefinemmpay/tool/DialogPay;invoke-virtual {v0}, Lcom/mydefinemmpay/tool/DialogPay;->dismiss()V.line 1360iget-object v3, p0, Lcom/mydefinemmpay/tool/MymmPay;->dpv:Ljava/util/Vector;invoke-virtual {v3, v0}, Ljava/util/Vector;->remove(Ljava/lang/Object;)Z.line 1357add-int/lit8 v1, v1, 0x1goto :goto_0
.end method
-----------------------------------------------购买成功的代码-------------------------------------------

然后把购买成功的代码复制到购买失败的代码里。简单粗暴！
保存再看看右面字符串的内容，发现之前的取消，失败，成功都变成了成功，成功，成功
再最后删除可能会产生费用的危险权限:
在AndroidManifest.xml里搜索（或者可以直接搜索下面的这个）
android.permission.SEND_SMS
删掉 <uses-permission android:name="android.permission.SEND_SMS"/>

然后打包编译

再次运行

三、结语

这次安卓逆向原理简单粗暴，但也算是自己入门的第一次破解了，有纪念意义。以后常玩切水果！

切水果安卓APP逆向过程报告----安卓逆向入门相关推荐

开发安卓app游戏_「安卓APP开发流程」安卓APP如何开发的？
21世纪,智能手机走进了人们的生活,现在的智能手机的操作系统基本分为两种,一种是IOS系统(苹果系统).安卓系统,其中,安卓系统是开源的,所以很多品牌商会讲安卓包装成自己的系统,但核心还是一样的,都是 ...
安卓app开发方案_「安卓APP开发流程」安卓APP如何开发的？
21世纪,智能手机走进了人们的生活,现在的智能手机的操作系统基本分为两种,一种是IOS系统(苹果系统).安卓系统,其中,安卓系统是开源的,所以很多品牌商会讲安卓包装成自己的系统,但核心还是一样的,都是 ...
记录一下开发选择文本朗读的安卓App的过程
开发缘起近年来年齿渐衰,老眼昏花,看网页已颇感吃力.不得已把字体放大再放大,但长时观看仍感眼睛疲劳.因此想找一个可以随时朗读手机上看到的文字的App.网上找了一圈没有找到适用的.满意的.找到过程中发 ...
Android:安卓APP启动过程简介
你打开一个安卓系统它的界面是Launcher 进程,它不断的检测用户的触摸落在哪个APP上面,如果你的触摸落在空白它不做处理,你要滑动他就给你滑动当用户触摸这个app的时候, 他会进行下面的流程 ...
win11怎么安装安卓app win11上安装安卓app的步骤教程
微软win11最为亮眼的就是windows系统终于可以兼容原生安卓app了,但是很多安装了win11的朋友发现安装不了安卓app,今天小编来跟大家说说win11安装安卓app的步骤教程吧,更多win1 ...
HTML一键打包APK工具_安卓app封装_H5打包安卓APP
随着目前苹果Appstore审核越来越严格,每天平均上架1000个,下架3000个应用,想要上架苹果应用商店已经越来越困难了,反复修改审核上架,短则1-2周,长则几个月,并且游戏类应用上架目前极其困难 ...
Android APP开机启动，安卓APP开发自启动，安卓启动后APP自动启动 Android让程序开机自动运行APP
让APP在安卓系统启动自动运行可以带来以下几个好处: 用户方便:当用户打开设备时,自动启动所需的APP可以让用户更方便地使用设备,不必手动打开APP. 提高用户黏性:自动启动APP可以让用户更快地开始 ...
安卓APP（3）——安卓布局控件
嵌入式之路,贵在日常点滴 ---阿杰在线送代码目录一.布局的种类二.布局和页面的关系三.显示一张美女图控件的宽度和高度四.布局背景颜色,背景图,显示两个美女关于控件ID 五.常用布局之相 ...
idea buildConfig_idea打包安卓app
idea打包安卓app zxnjfh idea打包安卓app 文件验证通过,获取该文件内的用户证书,再通过设备上的公钥验证该证书的完整性和安全性.为了弥补这个遗憾,也有大神竟然选择了修改的双摄像头的, ...

切水果安卓APP逆向过程报告----安卓逆向入门

一、准备工作

二、开始整活

三、结语

切水果安卓APP逆向过程报告----安卓逆向入门相关推荐

最新文章

热门文章