章鱼奶爸(Octodad Dadliest Catch)
去除google play未安装弹窗
GooglePlayServicesUtil.getErrorDialog方法的返回值修改为null;这个游戏是在so里面通过反射方式调用了这个方法
// package com.google.android.gms.common.GooglePlayServicesUtil
@Deprecated public static Dialog getErrorDialog(int arg1, Activity arg2, int arg3) {
return GooglePlayServicesUtil.getErrorDialog(arg1, arg2, arg3, null);
}
@Deprecated public static Dialog getErrorDialog(int arg1, Activity arg2, int arg3, DialogInterface$OnCancelListener arg4) {
return GooglePlayServicesUtil.zza(arg1, arg2, null, arg3, arg4);
}
Fabulous(美妙的生活)
- \Fabulous_307\smali\co\thefabulous\app\ui\activity\OnBoardingActivity.java
- \Fabulous_307\smali\com\google\android\gms\common ErrorDialogFragment.smali 和 SupportErrorDialogFragment.smali里面的show方法注释掉
代码中的英文
翻译成中文后进行Unicode编码复制过去
Quantum Revenge(量子复仇)
签名校验
搜索获取签名的代码(packageinfo、signature)找到smali中关键代码段,然后定位到了com.realtechvr.v3x.AppActivity
的onCreate
方法:
protected void onCreate(Bundle arg11) {
PackageInfo v0_3;
int v9 = 3;
int v0 = 0;
String v1 = null;
Logger.v("AppActivity", "onCreate");
AppActivity.o = this;
this.I = this.getWindow().getDecorView();
super.onCreate(arg11);
if(this.getExternalFilesDir(v1) == null) {
this.u();
return;
}
try {
PackageInfo v2 = AppActivity.o.getPackageManager().getPackageInfo(AppActivity.o.getPackageName(), 64);
this.x = v2.packageName;
this.y = v2.versionName;
Signature[] v2_1 = v2.signatures;
int v3 = v2_1.length;
while(v0 < v3) {
Signature v4 = v2_1[v0];
MessageDigest v5 = MessageDigest.getInstance("SHA");
v5.update(v4.toByteArray());
Base64.encodeToString(v5.digest(), 0).trim();
this.w = "TRW/yoB9UfkS/HQQMNANSB01Cf4=";
Logger.v("AppActivity", "| SHA-1 (base64): " + this.w);
v5 = MessageDigest.getInstance("MD5");
v5.update(v4.toByteArray());
Logger.v("AppActivity", "| MD5 Signature: " + this.a(v5.digest()));
v5 = MessageDigest.getInstance("SHA-256");
v5.update(v4.toByteArray());
Logger.v("AppActivity", "| SHA-256 Signature: " + this.a(v5.digest()));
++v0;
}
AppActivity.native_onCreate(this.x, this.y, this.w);
}
catch(NoSuchAlgorithmException v0_1) {
}
catch(PackageManager$NameNotFoundException v0_2) {
}
发现是smali中计算好了签名值传入到so中去校验了,这种好办,我们用原包签名写入传入就可以了。
Error弹窗移除
搜索代码位置
F:\游戏原包\Quantum Revenge\zongjian\outdir\smali\com\realtechvr\v3x\iab\google\b$1.smali:
58: const-string v2, "Problem setting up in-app billing: "
从代码上看就是修改一下判断值,走下面那个语块就可以了
憨豆先生
============== App的基本信息 =================
|| 包名 packageName = com.mrbean.around
|| 版本名称 appVersion = 5.2
|| 版本号 appVersionCode = 35
==========================================
破解路径:F:\游戏原包\憨豆先生\outdir\smali\org\godotengine\godot\GodotPaymentV3.smali
破解前
.method public get_premium()V
.locals 6
const/4 v5, 0x0
iget-object v1, p0, Lorg/godotengine/godot/GodotPaymentV3;->activity:Lorg/godotengine/godot/Godot;
invoke-virtual {v1, v5}, Lorg/godotengine/godot/Godot;->getPreferences(I)Landroid/content/SharedPreferences;
move-result-object v0
iget-object v1, p0, Lorg/godotengine/godot/GodotPaymentV3;->purchaseCallbackId:Ljava/lang/Integer;
invoke-virtual {v1}, Ljava/lang/Integer;->intValue()I
move-result v1
const-string v2, "set_premium"
const/4 v3, 0x1
new-array v3, v3, [Ljava/lang/Object;
const-string v4, "unlock_all"
invoke-interface {v0, v4, v5}, Landroid/content/SharedPreferences;->getBoolean(Ljava/lang/String;Z)Z
move-result v4
invoke-static {v4}, Ljava/lang/Boolean;->valueOf(Z)Ljava/lang/Boolean;
move-result-object v4
aput-object v4, v3, v5
invoke-static {v1, v2, v3}, Lorg/godotengine/godot/GodotLib;->calldeferred(ILjava/lang/String;[Ljava/lang/Object;)V
return-void
.end method
.method public request_products(Ljava/lang/String;)V
.locals 2
iget-object v0, p0, Lorg/godotengine/godot/GodotPaymentV3;->activity:Lorg/godotengine/godot/Godot;
invoke-virtual {v0}, Lorg/godotengine/godot/Godot;->getPaymentsManager()Lorg/godotengine/godot/payments/PaymentsManager;
move-result-object v0
invoke-virtual {v0, p0}, Lorg/godotengine/godot/payments/PaymentsManager;->setBaseSingleton(Lorg/godotengine/godot/GodotPaymentV3;)V
iget-object v0, p0, Lorg/godotengine/godot/GodotPaymentV3;->activity:Lorg/godotengine/godot/Godot;
new-instance v1, Lorg/godotengine/godot/GodotPaymentV3$2;
invoke-direct {v1, p0, p1}, Lorg/godotengine/godot/GodotPaymentV3$2;-><init>(Lorg/godotengine/godot/GodotPaymentV3;Ljava/lang/String;)V
invoke-virtual {v0, v1}, Lorg/godotengine/godot/Godot;->runOnUiThread(Ljava/lang/Runnable;)V
return-void
.end method
破解后
.method public get_premium()V
.locals 6
const/4 v5, 0x0
iget-object v1, p0, Lorg/godotengine/godot/GodotPaymentV3;->activity:Lorg/godotengine/godot/Godot;
invoke-virtual {v1, v5}, Lorg/godotengine/godot/Godot;->getPreferences(I)Landroid/content/SharedPreferences;
move-result-object v0
iget-object v1, p0, Lorg/godotengine/godot/GodotPaymentV3;->purchaseCallbackId:Ljava/lang/Integer;
invoke-virtual {v1}, Ljava/lang/Integer;->intValue()I
move-result v1
const-string v2, "set_premium"
const/4 v3, 0x1
new-array v3, v3, [Ljava/lang/Object;
const-string v4, "unlock_all"
invoke-interface {v0, v4, v5}, Landroid/content/SharedPreferences;->getBoolean(Ljava/lang/String;Z)Z
move-result v4
const/4 v4, 0x1
invoke-static {v4}, Ljava/lang/Boolean;->valueOf(Z)Ljava/lang/Boolean;
move-result-object v4
aput-object v4, v3, v5
invoke-static {v1, v2, v3}, Lorg/godotengine/godot/GodotLib;->calldeferred(ILjava/lang/String;[Ljava/lang/Object;)V
return-void
.end method
.method public request_products(Ljava/lang/String;)V
.locals 2
/** 这里全删了 **/
return-void
.end method
异域镇魂曲
Planescape Torment Enhanced Edition v3.0.3.1
游戏在非原手机上提示网络连接有问题
其实并不是网络连接有问题,而是游戏验证没过,根据提示往上查代码
.method public onDownloadStateChanged(I)V
.locals 9
.param p1, "newState" # I
.prologue
const p1, 0x5
const-string v3, "joyce_Engine_onDownloadStateChanged"
new-instance v4, Ljava/lang/StringBuilder;
invoke-direct {v4}, Ljava/lang/StringBuilder;-><init>()V
invoke-virtual {v4, p1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
move-result-object v4
invoke-virtual {v4}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v4
invoke-static {v3, v4}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
const/16 v7, 0x8
const/4 v6, 0x0
.line 796
invoke-direct {p0, p1}, Lcom/beamdog/infinity/Engine;->setState(I)V
.line 797
const/4 v5, 0x1
.line 798
.local v5, "showDashboard":Z
const/4 v4, 0x0
.line 801
.local v4, "showCellMessage":Z
packed-switch p1, :pswitch_data_0
.line 854
:pswitch_0
const/4 v3, 0x1
.line 855
.local v3, "paused":Z
const/4 v1, 0x1
.line 856
.local v1, "indeterminate":Z
const/4 v5, 0x1
.line 858
:goto_0
if-eqz v5, :cond_2
move v2, v6
.line 859
.local v2, "newDashboardVisibility":I
:goto_1
iget-object v8, p0, Lcom/beamdog/infinity/Engine;->mDashboard:Landroid/view/View;
invoke-virtual {v8}, Landroid/view/View;->getVisibility()I
move-result v8
if-eq v8, v2, :cond_0
.line 860
iget-object v8, p0, Lcom/beamdog/infinity/Engine;->mDashboard:Landroid/view/View;
invoke-virtual {v8, v2}, Landroid/view/View;->setVisibility(I)V
.line 862
:cond_0
if-eqz v4, :cond_3
move v0, v6
.line 863
.local v0, "cellMessageVisibility":I
:goto_2
iget-object v6, p0, Lcom/beamdog/infinity/Engine;->mCellMessage:Landroid/view/View;
invoke-virtual {v6}, Landroid/view/View;->getVisibility()I
move-result v6
if-eq v6, v0, :cond_1
.line 864
iget-object v6, p0, Lcom/beamdog/infinity/Engine;->mCellMessage:Landroid/view/View;
invoke-virtual {v6, v0}, Landroid/view/View;->setVisibility(I)V
.line 867
:cond_1
iget-object v6, p0, Lcom/beamdog/infinity/Engine;->mPB:Landroid/widget/ProgressBar;
invoke-virtual {v6, v1}, Landroid/widget/ProgressBar;->setIndeterminate(Z)V
.line 868
invoke-direct {p0, v3}, Lcom/beamdog/infinity/Engine;->setButtonPausedState(Z)V
.line 869
.end local v0 # "cellMessageVisibility":I
.end local v2 # "newDashboardVisibility":I
:goto_3
return-void
.line 805
.end local v1 # "indeterminate":Z
.end local v3 # "paused":Z
:pswitch_1
const/4 v3, 0x0
.line 806
.restart local v3 # "paused":Z
const/4 v1, 0x1
.line 807
.restart local v1 # "indeterminate":Z
goto :goto_0
.line 810
.end local v1 # "indeterminate":Z
.end local v3 # "paused":Z
:pswitch_2
const/4 v5, 0x1
.line 811
const/4 v3, 0x0
.line 812
.restart local v3 # "paused":Z
const/4 v1, 0x1
.line 813
.restart local v1 # "indeterminate":Z
goto :goto_0
.line 815
.end local v1 # "indeterminate":Z
.end local v3 # "paused":Z
:pswitch_3
const/4 v3, 0x0
.line 816
.restart local v3 # "paused":Z
const/4 v5, 0x1
.line 817
const/4 v1, 0x0
.line 818
.restart local v1 # "indeterminate":Z
goto :goto_0
.line 824
.end local v1 # "indeterminate":Z
.end local v3 # "paused":Z
:pswitch_4
const/4 v3, 0x1
.line 825
.restart local v3 # "paused":Z
const/4 v5, 0x0
.line 826
const/4 v1, 0x0
.line 827
.restart local v1 # "indeterminate":Z
goto :goto_0
.line 830
.end local v1 # "indeterminate":Z
.end local v3 # "paused":Z
:pswitch_5
const/4 v5, 0x0
.line 831
const/4 v3, 0x1
.line 832
.restart local v3 # "paused":Z
const/4 v1, 0x0
.line 833
.restart local v1 # "indeterminate":Z
const/4 v4, 0x1
.line 834
goto :goto_0
.line 837
.end local v1 # "indeterminate":Z
.end local v3 # "paused":Z
:pswitch_6
const/4 v3, 0x1
.line 838
.restart local v3 # "paused":Z
const/4 v1, 0x0
.line 839
.restart local v1 # "indeterminate":Z
goto :goto_0
.line 842
.end local v1 # "indeterminate":Z
.end local v3 # "paused":Z
:pswitch_7
const/4 v3, 0x1
.line 843
.restart local v3 # "paused":Z
const/4 v1, 0x0
.line 844
.restart local v1 # "indeterminate":Z
goto :goto_0
.line 846
.end local v1 # "indeterminate":Z
.end local v3 # "paused":Z
:pswitch_8
const/4 v5, 0x0
.line 847
const/4 v3, 0x0
.line 850
.restart local v3 # "paused":Z
const/4 v1, 0x1
.line 851
.restart local v1 # "indeterminate":Z
sget-object v6, Lcom/beamdog/infinity/Engine;->mLayout:Landroid/view/ViewGroup;
invoke-virtual {p0, v6}, Lcom/beamdog/infinity/Engine;->setContentView(Landroid/view/View;)V
goto :goto_3
:cond_2
move v2, v7
.line 858
goto :goto_1
.restart local v2 # "newDashboardVisibility":I
:cond_3
move v0, v7
.line 862
goto :goto_2
.line 801
:pswitch_data_0
.packed-switch 0x1
:pswitch_1
:pswitch_2
:pswitch_2
:pswitch_3
:pswitch_8
:pswitch_0
:pswitch_6
:pswitch_5
:pswitch_5
:pswitch_0
:pswitch_0
:pswitch_7
:pswitch_0
:pswitch_7
:pswitch_4
:pswitch_4
:pswitch_0
:pswitch_4
:pswitch_4
.end packed-switch
.end method
直接写死传入的值为5,然后返回
在获取游戏obb资源时还会报错
找到关键代码
.method public static getAPKPath(I)Ljava/lang/String;
.locals 6
.param p0, "index" # I
.prologue
.line 523
const/4 v4, -0x2
if-ne p0, v4, :cond_1
.line 524
invoke-static {}, Lcom/beamdog/infinity/Engine;->getContext()Landroid/content/Context;
move-result-object v4
invoke-virtual {v4}, Landroid/content/Context;->getPackageCodePath()Ljava/lang/String;
move-result-object v3
.line 542
:cond_0
:goto_0
return-object v3
.line 527
:cond_1
new-instance v4, Ljava/lang/StringBuilder;
invoke-direct {v4}, Ljava/lang/StringBuilder;-><init>()V
invoke-static {}, Landroid/os/Environment;->getExternalStorageDirectory()Ljava/io/File;
move-result-object v5
invoke-virtual {v5}, Ljava/io/File;->toString()Ljava/lang/String;
move-result-object v5
invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
const-string v5, "/Android/obb/"
invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
invoke-static {}, Lcom/beamdog/infinity/Engine;->getContext()Landroid/content/Context;
move-result-object v5
invoke-virtual {v5}, Landroid/content/Context;->getPackageName()Ljava/lang/String;
move-result-object v5
invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
const-string v5, "/"
invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
const-string v5, "main.496.com.beamdog.pstee.obb"
invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
invoke-virtual {v4}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v3
const-string v4, "joyce_Engine_getAPKPath"
invoke-static {v4, v3}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
.line 529
.local v3, "str":Ljava/lang/String;
const/4 v4, -0x1
const/4 p0, -0x1
if-eq p0, v4, :cond_0
.line 533
invoke-static {}, Lcom/beamdog/infinity/Engine;->getContext()Landroid/content/Context;
move-result-object v4
invoke-static {v4}, Lcom/google/android/vending/expansion/downloader/impl/DownloadsDB;->getDB(Landroid/content/Context;)Lcom/google/android/vending/expansion/downloader/impl/DownloadsDB;
move-result-object v0
.line 534
.local v0, "db":Lcom/google/android/vending/expansion/downloader/impl/DownloadsDB;
invoke-virtual {v0}, Lcom/google/android/vending/expansion/downloader/impl/DownloadsDB;->getDownloads()[Lcom/google/android/vending/expansion/downloader/impl/DownloadInfo;
move-result-object v2
.line 535
.local v2, "dis":[Lcom/google/android/vending/expansion/downloader/impl/DownloadInfo;
if-ltz p0, :cond_2
array-length v4, v2
if-ge p0, v4, :cond_2
.line 536
aget-object v1, v2, p0
.line 537
.local v1, "di":Lcom/google/android/vending/expansion/downloader/impl/DownloadInfo;
new-instance v4, Ljava/lang/StringBuilder;
invoke-direct {v4}, Ljava/lang/StringBuilder;-><init>()V
invoke-virtual {v4, v3}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
iget-object v5, v1, Lcom/google/android/vending/expansion/downloader/impl/DownloadInfo;->mFileName:Ljava/lang/String;
invoke-virtual {v4, v5}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v4
invoke-virtual {v4}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v3
.line 538
goto :goto_0
.line 539
.end local v1 # "di":Lcom/google/android/vending/expansion/downloader/impl/DownloadInfo;
:cond_2
const-string v3, ""
goto :goto_0
.end method
只需要根据真实本地obb文件名称写死返回就可以正常玩游戏了