1、叉叉加速器分析

2、叉叉加速器为全局通用，只要打开了加速器效果的游戏，无论用哪种方式启动，加速悬浮窗始终会显示。

在叉叉助手的“更多”-“叉叉加速器”里设置：

float_window_small.xml：

<?xml version="1.0" encoding="utf-8"?> 
<LinearLayout android:orientation="vertical" android:background="#00ffffff" android:layout_width="48.0dip" android:layout_height="48.0dip" 
  xmlns:android="http://schemas.android.com/apk/res/android"> 
    <LinearLayout android:orientation="vertical" android:id="@id/small_window_layout" android:background="@drawable/gamespeed_bg_float_window_normal" android:layout_width="48.0dip" android:layout_height="48.0dip" /> 
</LinearLayout>

gamespeed_bg_float_window.xml：

<?xml version="1.0" encoding="utf-8"?> 
<selector 
  xmlns:android="http://schemas.android.com/apk/res/android"> 
    <item android:state_pressed="false" android:drawable="@drawable/gamespeed_bg_float_window_normal" /> 
    <item android:state_pressed="true" android:drawable="@drawable/gamespeed_bg_float_window_press" /> 
</selector>

float_window_big.xml：

<?xml version="1.0" encoding="utf-8"?> 
<LinearLayout android:gravity="bottom" android:layout_gravity="center" android:orientation="vertical" android:background="#00ffffff" android:layout_width="fill_parent" android:layout_height="fill_parent" 
  xmlns:android="http://schemas.android.com/apk/res/android"> 
    <LinearLayout android:layout_gravity="center" android:orientation="vertical" android:id="@id/big_window_layout" android:background="#00ffffff" android:layout_width="fill_parent" android:layout_height="fill_parent" /> 
    <ImageView android:id="@id/setting_close" android:background="@drawable/gamespeed_bg_close" android:clickable="true" android:layout_width="fill_parent" android:layout_height="20.0dip" /> 
    <RelativeLayout android:layout_gravity="center" android:orientation="vertical" android:id="@id/big_window_layout_content" android:background="@drawable/gamespeed_bg_setting" android:layout_width="fill_parent" android:layout_height="60.0dip"> 
        <ImageView android:id="@id/setting_edit_params_bg" android:background="@drawable/gamespeed_bt_params" android:clickable="true" android:layout_width="90.0dip" android:layout_height="37.0dip" android:layout_centerInParent="true" /> bc 
<TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="." android:layout_centerInParent="true" /> 
        <TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params_left" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="0" android:layout_toLeftOf="@id/setting_edit_params" android:layout_centerInParent="true" /> 
        <TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params_right" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="0" android:layout_toRightOf="@id/setting_edit_params" android:layout_centerInParent="true" /> 
        <ImageView android:id="@id/setting_sub_params" android:background="@drawable/gamespeed_bt_sub_params" android:clickable="true" android:layout_width="35.0dip" android:layout_height="35.0dip" android:layout_marginRight="10.0dip" android:layout_toLeftOf="@id/setting_edit_params_bg" android:layout_centerVertical="true" /> 
        <ImageView android:id="@id/setting_add_params" android:background="@drawable/gamespeed_bt_add_params" android:clickable="true" android:layout_width="35.0dip" android:layout_height="35.0dip" android:layout_marginLeft="10.0dip" android:layout_toRightOf="@id/setting_edit_params_bg" android:layout_centerVertical="true" /> 
        <ImageView android:id="@id/setting_byte_params" android:background="@drawable/gamespeed_bg_params_left" android:clickable="true" android:layout_width="145.0dip" android:layout_height="7.0dip" android:layout_marginRight="10.0dip" android:layout_below="@id/setting_edit_params_bg" android:layout_centerHorizontal="true" android:layout_centerVertical="true" />
        <ImageView android:id="@id/exit_button" android:background="@drawable/gamespeed_bt_exit" android:clickable="true" android:layout_width="50.0dip" android:layout_height="30.0dip" android:layout_marginLeft="10.0dip" android:layout_centerVertical="true" /> 
        <ImageView android:id="@id/setting_switch" android:background="@drawable/gamespeed_bt_switch_start" android:clickable="true" android:layout_width="50.0dip" android:layout_height="30.0dip" android:layout_marginRight="10.0dip" android:layout_alignParentRight="true" android:layout_centerVertical="true" />
        <ImageView android:id="@id/setting_byte_tip_center" android:layout_width="1.0dip" android:layout_height="10.0dip" android:layout_marginBottom="13.0dip" android:layout_alignParentBottom="true" android:layout_centerInParent="true" android:layout_centerVertical="true" /> 
        <ImageView android:id="@id/setting_byte_tip_left" android:background="@drawable/gamespeed_bg_byte_tip" android:clickable="true" android:layout_width="10.0dip" android:layout_height="10.0dip" android:layout_alignRight="@id/setting_edit_params_left" android:layout_alignBottom="@id/setting_add_params" /> 
        <ImageView android:id="@id/setting_byte_tip_right" android:background="@drawable/gamespeed_bg_byte_tip" android:visibility="invisible" android:clickable="true" android:layout_width="10.0dip" android:layout_height="10.0dip" android:layout_alignLeft="@id/setting_edit_params_right" android:layout_alignTop="@id/setting_byte_tip_left" /> 
    </RelativeLayout> 
</LinearLayout>

gamespeed_bt_switch_start.xml：

<?xml version="1.0" encoding="utf-8"?> 
<selector 
  xmlns:android="http://schemas.android.com/apk/res/android"> 
    <item android:state_pressed="false" android:drawable="@drawable/gamespeed_bt_setting_switch_start_normal" /> 
    <item android:state_pressed="true" android:drawable="@drawable/gamespeed_bt_setting_switch_start_press" /> 
</selector>

    <public type="layout" name="float_window_big" id="0x7f030017" /> 
    <public type="layout" name="float_window_small" id="0x7f030018" />

package com.xxAssistant.GameSpeed; 

import android.content.Context; 
import android.content.res.Resources; 
import android.view.LayoutInflater; 
import android.view.ViewGroup.LayoutParams; 
import android.view.WindowManager; 
import android.view.WindowManager.LayoutParams; 
import android.widget.LinearLayout; 
import java.lang.reflect.Field; 

public class FloatWindowSmallView extends LinearLayout 
{ 
  public static int a; 
  public static int b; 
  private static int d; 
  public LinearLayout c; 
  private WindowManager e; 
  private WindowManager.LayoutParams f; 

  public FloatWindowSmallView(Context paramContext) 
  { 
    super(paramContext); 
    this.e = ((WindowManager)paramContext.getSystemService("window")); 
    LayoutInflater.from(paramContext).inflate(2130903064, this); 
    this.c = ((LinearLayout)findViewById(2131427400)); 
    a = this.c.getLayoutParams().width; 
    b = this.c.getLayoutParams().height; 
  } 

  private int getStatusBarHeight() 
  { 
    if (d == 0); 
    try 
    { 
      Class localClass = Class.forName("com.android.internal.R$dimen"); 
      Object localObject = localClass.newInstance(); 
      int i = ((Integer)localClass.getField("status_bar_height").get(localObject)).intValue(); 
      d = getResources().getDimensionPixelSize(i); 
      return d; 
    } 
    catch (Exception localException) 
    { 
      while (true) 
        localException.printStackTrace(); 
    } 
  } 

  public void setParams(WindowManager.LayoutParams paramLayoutParams) 
  { 
    this.f = paramLayoutParams; 
  } 
}

其中：2130903064 = 0x7F030018

<public type="id" name="setting_switch" id="0x7f0b0044" />

2131427396

package com.xxAssistant.GameSpeed; 

import android.view.View; 
import android.view.View.OnClickListener; 
import android.widget.ImageView; 

class FloatWindowBigView$1 
  implements View.OnClickListener 
{ 
  public void onClick(View paramView) 
  { 
    if (FloatWindowBigView.f == 0) 
    { 
      this.a.setTimeScale(FloatWindowBigView.h); 
      FloatWindowBigView.e.setBackgroundResource(2130837574); 
      FloatWindowBigView.f = 1; 
      return; 
    } 
    this.a.setTimeScale(0.0F); 
    FloatWindowBigView.e.setBackgroundResource(2130837573); 
    FloatWindowBigView.f = 0; 
  } 
}

FloatWindowBigView.java：

  static 
  { 
    g = false; 
    System.loadLibrary("xxspeedmanager"); 
    h = 0.0F; 
    i = 0; 
  }

  public void setTimeScale(float paramFloat) 
  { 
    int i1 = (int)Arith.c(paramFloat, 10.0F); 
    if (i1 >= 0); 
    for (int i2 = 1000 + i1 * 100; ; i2 = 10000 / (10 + -i1)) 
    { 
      setTimeScale(i2); 
      return; 
    } 
  } 

  public native void setTimeScale(int paramInt);

打开libxxspeedmanager.so分析：

Java_com_xxAssistant_GameSpeed_FloatWindowBigView_setTimeScale 00001778     

xx_clock_gettime

xx_clock_gettime      000012CC P 
xx_clock_gettime_ptr  00004F88  
xx_gettimeofday       000014C4 P 
xx_gettimeofday_ptr   00004F80  
xx_speed_manager_init 000015F0 P

MSHookFunction_ptr 00004FDC 
MSHookFunction     000010DC 

XXJavaHookClassLoad        000010D0 
XXJavaHookClassLoad_ptr    00004FD8 
XXJavaHookMethod           0000107C 
XXJavaHookMethod_ptr       00004FBC 
XXSuperPathClassLoader     00001088 
XXSuperPathClassLoader_ptr 00004FC0 

/data/data/com.xxAssistant/xx-filter/assistant.json 
/data/data/com.xxAssistant/xx-filter/speed.conf 
/data/data/com.xxAssistant/xx-filter/speedm.json

assistant.json打开有加密

speed.conf：

/data/app/com.xxAssistant-1.apk

speedm.json打开有加密

/data/app/com.xxAssistant-1.apk

MSHookFunction比较可疑，搜索一下发现：MobileSubstrate

MobileSubstrate是一个公共库，可以用来动态替换内存中的代码、数据等。

库文件存在：

com.xxAssistant\lib\armeabi\libsubstrate.so

package com.xxAssistant.GameSpeed; import android.app.Activity; import android.content.Context; import android.content.pm.PackageManager.NameNotFoundException; importandroid.content.res.Resources; import android.util.DisplayMetrics; import android.view.Display; import android.view.ViewGroup; import android.view.WindowManager; importandroid.widget.AbsoluteLayout; import android.widget.AbsoluteLayout.LayoutParams; import android.widget.FrameLayout.LayoutParams; import java.lang.reflect.Field; publicclass GameSpeedView { public static ViewGroup a; public static Activity b; public static Activity c; public static Context d; public static Context e; public static int f = 0; public static int g = 0; public static int h; public static int i; public static int j; public static int k; public static float m; public static FloatWindowSmallView n; public static FloatWindowBigView o; public static GameSpeedView p; private static int s = 0; private static int t = 0; int l = 0; private int q = 0; private int r = 0;private boolean u = false; public GameSpeedView(Context paramContext) { DisplayMetrics localDisplayMetrics = new DisplayMetrics(); c.getWindowManager().getDefaultDisplay().getMetrics(localDisplayMetrics); f = c.getWindowManager().getDefaultDisplay().getWidth(); g = c.getWindowManager().getDefaultDisplay().getHeight(); c.getWindowManager().getDefaultDisplay().getMetrics(localDisplayMetrics); m = localDisplayMetrics.density; } privatevoid c() { if (a == null) { a = new AbsoluteLayout(c); a.isClickable(); FrameLayout.LayoutParams localLayoutParams = new FrameLayout.LayoutParams(-1, -1); c.addContentView(a, localLayoutParams); d(); } } private void d() { int i3; int i4; label79: AbsoluteLayout.LayoutParams localLayoutParams1; if ((n == null) && (o ==null)) { n = new FloatWindowSmallView(e); o = new FloatWindowBigView(e); int i1 = (int)(48.0F * m * m); int i2 = (int)(48.0F * m); if (j == 0) break label208; i3 = j; if(k == 0) break label223; i4 = k; localLayoutParams1 = new AbsoluteLayout.LayoutParams(i1, i2, i3, i4); if (f >= 360.0F * m) break label233; } label208: label223: label233:for (int i5 = f; ; i5 = (int)(360.0F * m)) { AbsoluteLayout.LayoutParams localLayoutParams2 = new AbsoluteLayout.LayoutParams(i5, (int)(80.0F * m), f / 2 - i5 / 2, g - (int)(80.0F * m)); n.setLayoutParams(localLayoutParams1); o.setLayoutParams(localLayoutParams2); o.setVisibility(8); a.addView(n); a.addView(o); a.setOnTouchListener(newGameSpeedView.1(this)); return; i3 = f - (int)(48.0F * m); break; i4 = g / 2; break label79; } } private int e() { if (this.l == 0); try { Class localClass = Class.forName("com.android.internal.R$dimen"); Object localObject = localClass.newInstance(); int i1 = ((Integer)localClass.getField("status_bar_height").get(localObject)).intValue(); this.l = e.getResources().getDimensionPixelSize(i1); return this.l; } catch (Exception localException) { while (true) localException.printStackTrace(); } } public static void init(Activity paramActivity) { if (paramActivity.isChild()) return; if (e == null);try { e = paramActivity.createPackageContext("com.xxAssistant", 3); d = paramActivity.getApplicationContext(); c = paramActivity; if (paramActivity != b) { if (a != null) { a.removeAllViews(); a = null; } b = paramActivity; } if (p == null) { localGameSpeedView = new GameSpeedView(d); p = localGameSpeedView; p.c(); return; } } catch(PackageManager.NameNotFoundException localNameNotFoundException) { while (true) { localNameNotFoundException.printStackTrace(); continue; GameSpeedView localGameSpeedView = p; } } } }

adb pull /data/data/com.xxAssistant/shared_prefs/gameSpeedSetting.xml e:\

<?xml version='1.0' encoding='utf-8' standalone='yes' ?><map><boolean name="gamespeed_com.babeltime.fknsango_360" value="true" /><booleanname="gamespeed_com.DefiantDev.SkiSafari" value="true" /></map>