第一篇已经通过xposed插件实现了获取刺探小游戏结果的功能。
第一篇传送门:https://blog.csdn.net/u013170888/article/details/89706546
上一篇也说过了这个也是可以通过修改代码实现的,因为已经用xposed实现了,另外改smali代码也比较麻烦,就没去弄。
xposed实现毕竟有一定的局限性,一般人自己用的手机都不会去装xposed,所以想着还是改代码实现一下让普通的安卓设备都能用。
实现思路:
就是把上一篇实现的代码插到应用里面,java代码是没办法直接改的,必须是改smali代码,就是先把应用的dex拖出来反编译,返回找到代码插入位置插入我们需要加入的smali代码,然后重新编译成dex签名打包即可。
一、代码插入位置
根据上一篇的分析我们知道show的参数就是服务器返回的刺探小游戏的数据,前文的hook实现也是hook的这个show拿到参数然后处理的。
拿我们的代码插入位置肯定是要拿到这个参数的,看一下调用链access$5这里调用的show并传入了参数,那我们可以再它下面加个方法实现。这里就是比较好的插入代码的位置。
这里插入代码就能拿到参数了,照着调用show的代码,加个调用我们写的hookres
二、插入的smali代码
能力强的能手写smali代码的这段可以忽略,对smali不熟悉的还是先写java代码然后转成smali代码。
java代码和上一篇hook实现代码一致。这里可以写一个android demo,然后导出apk,拿到dex后反编译就拿到的对应的smali代码。
java代码:
private void hookres(String[] a) {
//获取需要点击的顺序
int A = Integer.parseInt(a[5]);
int B = Integer.parseInt(a[6]);
int C = Integer.parseInt(a[7]);
//顺序对应的数字
int resultA = Integer.parseInt(a[A - 1]);
int resultB = Integer.parseInt(a[B - 1]);
int resultC = Integer.parseInt(a[C - 1]);
int b[] = {resultA, resultB, resultC};//放到数组
//遍历数组将数字转换成对应的汉字字符
String x = null;
String res[]=new String[3];
for (int i = 0; i < b.length; i++) {
if (b[i] == 1) {
x = "金";
} else if (b[i] == 2) {
x = "木";
} else if (b[i] == 3) {
x = "水";
} else if (b[i] == 4) {
x = "火";
} else if (b[i] == 5) {
x = "土";
}
res[i]=x;
}
Toast.makeText(getApplicationContext(), res[0]+res[1]+res[2], Toast.LENGTH_LONG).show();
}
在smali代码里找到hookres方法的代码段:
.method private hookres([Ljava/lang/String;)V
.registers 17
.parameter "a"
.line 20
const/4 v0, 0x5
aget-object v1, p1, v0
invoke-static {v1}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I
move-result v1
.line 21
.local v1, A:I
const/4 v2, 0x6
aget-object v2, p1, v2
invoke-static {v2}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I
move-result v2
.line 22
.local v2, B:I
const/4 v3, 0x7
aget-object v3, p1, v3
invoke-static {v3}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I
move-result v3
.line 25
.local v3, C:I
add-int/lit8 v4, v1, -0x1
aget-object v4, p1, v4
invoke-static {v4}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I
move-result v4
.line 26
.local v4, resultA:I
add-int/lit8 v5, v2, -0x1
aget-object v5, p1, v5
invoke-static {v5}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I
move-result v5
.line 27
.local v5, resultB:I
add-int/lit8 v6, v3, -0x1
aget-object v6, p1, v6
invoke-static {v6}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I
move-result v6
.line 29
.local v6, resultC:I
const/4 v7, 0x3
new-array v8, v7, [I
const/4 v9, 0x0
aput v4, v8, v9
const/4 v10, 0x1
aput v5, v8, v10
const/4 v11, 0x2
aput v6, v8, v11
.line 32
.local v8, b:[I
const/4 v12, 0x0
.line 33
.local v12, x:Ljava/lang/String;
new-array v13, v7, [Ljava/lang/String;
.line 34
.local v13, res:[Ljava/lang/String;
move-object v14, v12
const/4 v12, 0x0
.local v12, i:I
.local v14, x:Ljava/lang/String;
:goto_3e
array-length v9, v8
if-ge v12, v9, :cond_6e
.line 36
aget v9, v8, v12
if-ne v9, v10, :cond_49
.line 38
const-string v9, "\u91d1"
.line 52
:goto_47
move-object v14, v9
goto :goto_67
.line 39
:cond_49
aget v9, v8, v12
if-ne v9, v11, :cond_50
.line 41
const-string v9, "\u6728"
goto :goto_47
.line 42
:cond_50
aget v9, v8, v12
if-ne v9, v7, :cond_57
.line 44
const-string v9, "\u6c34"
goto :goto_47
.line 45
:cond_57
aget v9, v8, v12
const/4 v7, 0x4
if-ne v9, v7, :cond_60
.line 47
const-string v7, "\u706b"
.line 52
:goto_5e
move-object v14, v7
goto :goto_67
.line 48
:cond_60
aget v7, v8, v12
if-ne v7, v0, :cond_67
.line 50
const-string v7, "\u571f"
goto :goto_5e
.line 52
:cond_67
:goto_67
aput-object v14, v13, v12
.line 34
add-int/lit8 v12, v12, 0x1
const/4 v7, 0x3
const/4 v9, 0x0
goto :goto_3e
.line 56
.end local v12 #i:I
:cond_6e
invoke-virtual {p0}, Ldemo/com/myapplication/MainActivity;->getApplicationContext()Landroid/content/Context;
move-result-object v0
new-instance v7, Ljava/lang/StringBuilder;
invoke-direct {v7}, Ljava/lang/StringBuilder;-><init>()V
const/4 v9, 0x0
aget-object v9, v13, v9
invoke-virtual {v7, v9}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
aget-object v9, v13, v10
invoke-virtual {v7, v9}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
aget-object v9, v13, v11
invoke-virtual {v7, v9}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v7}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v7
invoke-static {v0, v7, v10}, Landroid/widget/Toast;->makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;
move-result-object v0
invoke-virtual {v0}, Landroid/widget/Toast;->show()V
.line 58
return-void
.end method
这里要注意打印toast这里要获取Context,我们demo里面的类名要改成应用的类名。
184行这里的demo/com/myapplication/MainActivity要改成com/woniu/mobile9yin/app/CiTanItemActivity
三、插入代码成功之后就编译生成dex文件,替换原始的dex文件然后重新签名打包就行了。
免责声明:
本文的意图只是通过分析app学习安卓逆向技术,如果有人利用本文知识和技术进行非法操作进行牟利,带来的任何法律责任都将由操作者本人承担,和本文作者无任何关系。