According to the ghost Brother so change, four, the example of the first chapter

Following the Ghost Columbia Science so changes, four. Example of the first chapter

Drawings/culture Listen to the ghost brother to tell the story

---------------------------------------------Cutting Line--------------------------------------------

This article is an article of the previous period, the recent so analysis of this series just can be as an example tutorial. So the supplement is taken back.

The first three articles did not see. Please continue to follow the blog, read the previous three articles.

When the strike is over and the analysis of so is deepened, the article is supplemented

In addition, this article needs to have a certain basis for the reverse of Android anti-compilation. Simply understand the role of so. There is no doubt about it. Can go to the Group and forum or self-Google search solution.

The article was invited by www.pd521.com Webmaster. Starting in its forum, we can focus on the past, very much basic information. Easy for beginners to learn.

Please do your own exercises!

！！

！！

！。！

。。。！。。！。！！

！。！

！！

！

！！

！。！。！

。

---------------------------------------------Cutting Line--------------------------------------------

Today we are to analyze the small yellow people run, the image of the small yellow people from the film has been good. Now we've got the second one, so we found this game for analysis.

First-level analysis:

To get the game, first we have to install to see where it is worth cracking.

Through observation. We found that the basic consumption in the game on bananas and coins above, in this case, then we first look at whether the payment above can directly crack inside the purchase. Buy For example with what you see:

And game to pay the way, then query related information, such as once my tutorial on the onpayfailed method changes , the onbillingfinish method Changes, here may be the mobile payment has been upgraded, You can't do that directly. Now that's it. So let 's look at the Logcatand see if there's any valuable information.

Through multiple tests. We now have this line of output when we click into the game to pay, so we follow this line of code, and this line of code is definitely the code that starts the payment process.

For students who are unfamiliar with Smali code. open the jar file directly using Jd-gui , for example:

The search found the feature characters we found, such as the following:

The search found the feature characters we found, such as the following:

we can find that thedobilling method, according to the name to think, we also feel that is used when the purchase. So we chase it. Full-Text search dobilling effect is not ideal, so we can directly find gameinterface This class of related call way.

All right. To this class, depending on the interface name, we can guess, this is the callback function of the payment. The meaning of the callback function, that is, to infer whether to pay, and then return the relevant data, by other algorithms to add the number of bananas or coins.

Game.nativebillingdone, see this native method. We need to parse the so file, we find the Game class and see which so file is called . Search system.loadlibrary:

Know the name of so. Then we'll hang Ida. It is definitely export- derived functions that Java can invoke directly . So we search for Nativebillingdone in export :

Then see this method:

B is the meaning of the call method, here calls the addcash method, so we are more clear. This is the addition of gold coins. The name is so easy to understand, and can not guess the author of the Sorry.

Let's take a glance at what the method does:

Well, after the first paragraph of the code is roughly understood. Let's turn it upside down:

watermark/2/text/ahr0cdovl2jsb2cuy3nkbi5uzxqvz3vpz3v6atexmta=/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/ Dissolve/70/gravity/center ">

Through the text in the picture. We can simply make it clear that what we need to do is to test it first. Setting the Addcash (int) method to 8 will not add gold. So when we go back to the initial analysis, look here:

Through the text in the picture. We can also simply be clear about what we need to do. is to test first, the Addcash (int) method to set the number of incoming parameters to 8 , is not added gold. So when we go back to the initial analysis, look here:

Amen, thank the author, see this line of output. This is generated when we click the return button of the payment interface. The game sounds are paused due to the payment process. That's why the situation is so easy for developers to observe data.

up, we are able to find other places by ourselves in the main class Game.smali . the ability to see log is just more convenient for our analysis, and we can manually find the code. So no log was found . Just spend more on time. Other effects are small. good. So we'll just find a place to print this line of log, and call the nativebillingdone method on it:

First line, setv1=8, the second line, calling my own method of printingintdata to see whether the assignment is successful, students can ignore it, the third line callsNatvebillingdoneMethod.

then compile back. To pack and test ......... ..... Discover initialize gold coins really for 18888, then click on Store, Pay page, press back key:

All right. Here, our first level of purpose is complete.

What needs to be explained is. IDA the use of the students to check their own information, ARM syntax. Self-check information can be, online has a lot of tutorials, hands-on, master more in-depth.



Second Level analysis:

After the first level analysis is completed. We know the position has been analyzed. So The algorithm in the file has been found right, then. We initialize more coins to add a little more good, so we continue to start analyzing

watermark/2/text/ahr0cdovl2jsb2cuy3nkbi5uzxqvz3vpz3v6atexmta=/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/ Dissolve/70/gravity/center ">

The key is in the Addcash method of this line on the R1 Copy of the code above, we open the system to take a look at:

There are only four bytes, through which 4a byte implementation will18888assign a value tor1,4The maximum number of bytes is0xFFFF, to see that the function receives unsigned. It's still a signed type.Int16, the maximum value today is probably0xFFFFthe corresponding conversion to decimal is65535。

OK, so let's see how we can change the data, right now, and we'll be able to manipulate the bytes directly.

C8 E3 . This line of code originally for MOV R1, #0x49C8 about command commands I'm not too familiar with. So just slowly try to change it.

Because of that own immediate number, through observation found that the original instruction just in turn for E3 C8, then contrast 0x49c8. I changed directly to what I saw:

watermark/2/text/ahr0cdovl2jsb2cuy3nkbi5uzxqvz3vpz3v6atexmta=/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/ Dissolve/70/gravity/center ">

found that the direct changes have been successful, well, this is more to the force. We use 010Editor or UEdirectly. Manipulating so files

The blue part of the front is the memory address, we use the CTRL + G command to jump the address, directly corresponding to change the four byte code can be. And then you pack it up again and test it.

。

As a result you can see. Everything is fine. Initialize 65535. Payment page, return. Add gold coins ...

we tested the way bananas are added, so there are coins added Oh, this is left to interested students to try. Hands-on, a lot of practice ~ ~ ~ This article is for communication only, do not do other commercial use.
The layout looks uncomfortable. Just look at the document and you can. Relevant attachment address:

Link: Http://pan.baidu.com/s/1eQILJkI password:7kyr

In fact, there are many ways to hack this game. Here is just about one or two kinds of it, we can add it to your own ~

Reprint please specify the source ~~~~~~~~~~

According to the ghost Brother so change, four, the example of the first chapter