Android Unity3D 逆向截取交互事件（二） 之逆向修改dll并加入Java的接口

有需求是在完整的apk中截取Android Unity3D并暴露Java的接口。这次文章就是这方面实现的一个小例子。

首先反编译apk，把asserts/bin/manager 文件下的UnityEngine 中的getkey 方法加入调用Android代码的调用：

AndroidJNI.AttachCurrentThread();
    AndroidJNI.PushLocalFrame(0);
    try
    {
        Debug.Log("kyx_keyevent run");
        using (AndroidJavaClass class2 = new AndroidJavaClass("com.kuaiyouxi.keyevent.KYXUnityKeyEvent"))
        {
            object[] args = new object[] { key };
            key = (KeyCode) class2.CallStatic<object>("kyxKeyEvent", args);
        }
    }
    catch (Exception)
    {
        Debug.LogError("kyx_keyevent run");
    }
    finally
    {
        AndroidJNI.PopLocalFrame(IntPtr.Zero);
    }
return GetKeyString(name);

Debug.Log("kyx_keyevent "+(int)key);

用Reflector 

package com.kuaiyouxi.keyevent;

import android.util.Log;

public class KYXUnityKeyEvent {
	public static int kyxKeyEvent(int obj){
		Log.e("kyx_keyevent", "run in kyx_keyevent"+obj);
		if(obj == 97 || obj == 100 || obj == 96 || obj == 23){
			obj = 0;
		}
		return obj;
	}
	
	public static String kyxKeyEventString(String obj){
		Log.e("kyx_keyevent", "run in kyx_keyevent"+obj);
		return obj;
	}
	
	public static int kyxKeyDownEvent(int obj){
		Log.e("kyx_keyDownevent", "run in kyx_keyDownevent"+obj);
		if(obj == 97 || obj == 100 || obj == 96 || obj == 23){
			obj = 0;
		}
		return obj;
	}
	
	public static String kyxKeyDownEventString(String obj){
		Log.e("kyx_keyDownevent", "run in kyx_keyDownevent"+obj);
		return obj;
	}
	
	public static int kyxKeyUpEvent(int obj){
		Log.e("kyx_keyUpevent", "run in kyx_keyUpevent"+obj);
		if(obj == 97 || obj == 100 || obj == 96 || obj == 23){
			obj = 0;
		}
		return obj;
	}
	
	public static String kyxKeyUpEventString(String obj){
		Log.e("kyx_keyUpevent", "run in kyx_keyUpevent"+obj);
		return obj;
	}
	
	
	
}

把这个程序编译打包成apk。然后反编译，把上诉代码的smali放进unity3d apk中，打包签名。就可以跑起来了。是不是很简单~