欢迎使用CSDN-markdown编辑器

火柴人联盟破解记录

0、前言
听说最近markdown很流行，哈哈，蛮试试用它来写一个记录吧！

1、基本信息
包名：com.DBGame.DiabloLOL.anzhi
主入口activity：com.DBGame.DiabloLOL.SplashActivity

2、去签名校验
2.1 在反编译的项目中搜索signatures
2.2 将返回值设置为空即可。

3、内购破解

3.1用ddms locat查看支付特征

3.2 电信支付
Egame支付成功
Egame支付Cancel
破解思路：用成功方法替换失败方法，因为在支付失败的时候，程序
会调用失败的函数，我们只要将失败的函数体替换成功的即可支付成功

.method public payFailed(Ljava/util/Map;I)V
        .locals 2
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "(",
            "Ljava/util/Map",
            "<",
            "Ljava/lang/String;",
            "Ljava/lang/String;",
            ">;)V"
        }
    .end annotation

    .prologue
    .line 804
    .local p1, "arg0":Ljava/util/Map;, "Ljava/util/Map<Ljava/lang/String;Ljava/lang/String;>;"
    iget-object v0, p0, Lcom/DBGame/DiabloLOL/DiabloLOL$7;->this$0:Lcom/DBGame/DiabloLOL/DiabloLOL;

    # invokes: Lcom/DBGame/DiabloLOL/DiabloLOL;->setPayment()V
    invoke-static {v0}, Lcom/DBGame/DiabloLOL/DiabloLOL;->access$600(Lcom/DBGame/DiabloLOL/DiabloLOL;)V

    .line 805
    iget-object v0, p0, Lcom/DBGame/DiabloLOL/DiabloLOL$7;->this$0:Lcom/DBGame/DiabloLOL/DiabloLOL;

    iget-object v0, v0, Lcom/DBGame/DiabloLOL/DiabloLOL;->PRO_ID_Str:[Ljava/lang/String;

    iget-object v1, p0, Lcom/DBGame/DiabloLOL/DiabloLOL$7;->this$0:Lcom/DBGame/DiabloLOL/DiabloLOL;

    iget v1, v1, Lcom/DBGame/DiabloLOL/DiabloLOL;->mPayIndex:I

    aget-object v0, v0, v1

    const/4 v1, 0x1

    invoke-static {v0, v1}, Lcom/DBGame/Common/BLHelper;->purchaseComplete(Ljava/lang/String;I)V

    .line 807
    invoke-static {}, Lcom/DBGame/Common/BLHelper;->closeShieldLayer()V

    .line 808
    const-string v0, "qq"

    const-string v1, "Egame\u652f\u4ed8\u6210\u529f"

    invoke-static {v0, v1}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

    .line 810
    return-void
.end method

3.3 联通支付
Unicom支付成功
Unicom支付cancel
破解思路：联通支付这里用了switch来判断，只要用成功的分支覆盖失败的分支就可以了

.method public PayResult(Ljava/lang/String;IILjava/lang/String;)V
    #略去部分代码
    :pswitch_0
    iget-object v0, p0, Lcom/DBGame/DiabloLOL/DiabloLOL$5;->this$0:Lcom/DBGame/DiabloLOL/DiabloLOL;

    # invokes: Lcom/DBGame/DiabloLOL/DiabloLOL;->setPayment()V
    invoke-static {v0}, Lcom/DBGame/DiabloLOL/DiabloLOL;->access$600(Lcom/DBGame/DiabloLOL/DiabloLOL;)V

    .line 698
    iget-object v0, p0, Lcom/DBGame/DiabloLOL/DiabloLOL$5;->this$0:Lcom/DBGame/DiabloLOL/DiabloLOL;

    iget-object v0, v0, Lcom/DBGame/DiabloLOL/DiabloLOL;->PRO_ID_Str:[Ljava/lang/String;

    iget-object v1, p0, Lcom/DBGame/DiabloLOL/DiabloLOL$5;->this$0:Lcom/DBGame/DiabloLOL/DiabloLOL;

    iget v1, v1, Lcom/DBGame/DiabloLOL/DiabloLOL;->mPayIndex:I

    aget-object v0, v0, v1

    const/4 v1, 0x1

    invoke-static {v0, v1}, Lcom/DBGame/Common/BLHelper;->purchaseComplete(Ljava/lang/String;I)V

    .line 700
    invoke-static {}, Lcom/DBGame/Common/BLHelper;->closeShieldLayer()V

    .line 702
    const-string v0, "qq"

    const-string v1, "Unicom\u652f\u4ed8\u6210\u529f"

    invoke-static {v0, v1}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

    goto :goto_0

    .line 709
    :pswitch_1
    #同switch0
    :pswitch_2
    nop

    :pswitch_data_0
    .packed-switch 0x1
        :pswitch_0    #成功
        :pswitch_1    #失败
        :pswitch_2    #取消
    .end packed-switch
.end method

3.4 移动支付
购买道具：[
] 成功！

] 失败！

破解思路：也是用了switch判断，破解方式和联通的差不多。

3.5 统一接口破解
DiabloLOL.smali文件中

.method getSimType()I
    .locals 6

    .prologue
    .line 215
    const/4 v3, 0x0

    .line 216
    .local v3, "type":I
    const-string v5, "phone"

    .line 217
    invoke-virtual {p0, v5}, Lcom/DBGame/DiabloLOL/DiabloLOL;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;

    move-result-object v2

    check-cast v2, Landroid/telephony/TelephonyManager;

    .line 218
    .local v2, "tm":Landroid/telephony/TelephonyManager;
    invoke-virtual {v2}, Landroid/telephony/TelephonyManager;->getSimOperator()Ljava/lang/String;

    move-result-object v1

    .line 219
    .local v1, "sOperator":Ljava/lang/String;
    if-eqz v1, :cond_0

    const-string v5, ""

    invoke-virtual {v1, v5}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v5

    if-eqz v5, :cond_1

    :cond_0
    move v4, v3

    .line 244
    .end local v3    # "type":I
    .local v4, "type":I
    :goto_0
    const/4 v4,0x1
    return v4   #change  type to  0x1

    .line 222
    .end local v4    # "type":I
    .restart local v3    # "type":I
    :cond_1
    invoke-static {v1}, Ljava/lang/Integer;->valueOf(Ljava/lang/String;)Ljava/lang/Integer;

    move-result-object v5

    invoke-virtual {v5}, Ljava/lang/Integer;->intValue()I

    move-result v0

    .line 223
    .local v0, "sCode":I
    sparse-switch v0, :sswitch_data_0

    :goto_1
    move v4, v3

    .line 244
    .end local v3    # "type":I
    .restart local v4    # "type":I
    goto :goto_0

    .line 228
    .end local v4    # "type":I
    .restart local v3    # "type":I
    :sswitch_0
    const/4 v3, 0x0

    .line 229
    goto :goto_1

    .line 232
    :sswitch_1
    const/4 v3, 0x2

    .line 233
    goto :goto_1

    .line 238
    :sswitch_2
    const/4 v3, 0x1

    .line 239
    goto :goto_1

    .line 223
    :sswitch_data_0
    .sparse-switch
        0x4fb4 -> :sswitch_2
        0xb3b0 -> :sswitch_0
        0xb3b1 -> :sswitch_1
        0xb3b2 -> :sswitch_0
        0xb3b3 -> :sswitch_2
        0xb3b5 -> :sswitch_2
        0xb3b6 -> :sswitch_1
        0xb3b7 -> :sswitch_0
        0xb3bb -> :sswitch_2
        0xb3c4 -> :sswitch_0
    .end sparse-switch
.end method

上面这个函数有点长我们截取关键部位进行分析

.line 244
    .end local v3    # "type":I
    .local v4, "type":I
    :goto_0
    const/4 v4,0x1
    return v4   #change  type to  0x1

我们看一看到这里返回了v4,这里是选择支付方式的，其他地方怎么定义怎么搞，到最后还是要到这里进行return的，那么我们直接在这里设定v4=1不就得了？语法是

const/4 v4,0x1

最后附上一张效果图