Small advertisement removal preliminary trial Note: reverse strong explosion

And make this post as a summary.
APPs usually call third-party sdks to implement the AD function, and clear small ads in reverse ways is similar to APK cracking, we need to understand the dalvik bytecode and use common Debugging techniques and debugging tools.

After this test, there are several key points to use reverse methods to clear advertisements:
1. Run the program to observe program behavior
2. Determine the ad entry point (Method profiling and other dynamic debugging technologies)
3. Clear ad entries and complete subsequent Functions

1. Run the program to observe program behavior
Install APK to start the program experience. First, after loading the program, the program prompts to check the wifi status. Then, it finds that a view appears in the main activity and continues to scroll the advertisement, this is the location to be cleared. Because the ad is a view and the activity is controllable, it may be guessed that the handle will be obtained through findviewbyid and an activity will be created to manage the advertising lifecycle. Guess is the end of speculation, and then start the analysis.

2. Determine the ad entry point (Method profiling and other dynamic debugging technologies)
With the rough guess just now, we need to analyze it carefully. We still use the same old steps to load the APK with VTS, and find that the APK does not exist in so, which is relatively easy to analyze. However, static analysis is still confusing, so dynamic analysis and Method profiling included in DDMS are used. Determine the approximate ad Start entry.
According to the previous thought, after the main activity is displayed, an advertisement view is displayed. Therefore, the onCreate function of WirelessDataCableActivity is analyzed as follows: a com/google/ads/AdView. a function is displayed.

This function has the following relationships:

Based on the results generated by the above Method profiling, We can roughly understand the running process of the program and the scope of the analysis. Our goal is to analyze the functions of these AdView classes, start code analysis:

Code:
 

. Method public onCreate (Landroid/OS/Bundle;) V ...... # IDconst v0, 0x7f090010invoke-virtual {p0, v0}, Lcom/flyfish/WirelessDataCable/WirelessDataCableActivity corresponding to the ad view;-> findViewById (I) Landroid/view/View; move-result-object v0check-cast v0, Lcom/google/ads/AdView; new-instance v1, Lcom/google/ads/c; invoke-direct {v1 }, lcom/google/ads/c;-> <init> () V # ad entry invoke-virtual {v0, v1}, Lcom/google/ads/AdView; -> a (Lcom/google/ads/c;) V ....... End method

The above code comment has found the ad entry. You may wish to go down and enter the ad entry analysis:

Continue to view Lcom/google/ads/u;-> a (Lcom/google/ads/c;) V

.
Code:
 

Method public final declared-synchronized a (Lcom/google/ads/c;) V. locals 8 ...... # Saw the adActvity class, a little close to the guessing process of invoke-static {}, Lcom/google/ads/AdActivity;-> c () Z move-result v1if-eqz v1 ,: cond_2 ...... # The previous judgment mainly focused on ad loading: cond_2: try_start_2 invoke-virtual {p0}, Lcom/google/ads/u;-> d () Landroid/app/Activity; move-result-object v1 # We can see that cond_3 is the branch of the advertisement if-nez v1,: cond_3 const-string v0, "activity is null while trying to load an ad. "invoke-static {v0}, Lcom/google/ads/util/B;-> e (Ljava/lang/String;) V goto: goto_0 # ad start display: cond_3 # obtain the application context invoke-virtual {v1}, Landroid/app/Activity;-> getApplicationContext () Lan Droid/content/Context; move-result-object v2 invoke-static {v2}, Lcom/google/ads/util/AdUtil;-> c (Landroid/content/Context ;) Z move-result v2 if-eqz v2,: cond_0 invoke-virtual {v1}, Landroid/app/Activity;-> getApplicationContext () Landroid/content/Context; move-result-object v2 # process the corresponding configuration file invoke-static {v2}, Lcom/google/ads/util/AdUtil;-> B (Landroid/content/Context ;) Z move-result v2 if-eqz v2,: cond_0 ig Et-object v2, p0, Lcom/google/ads/u;-> p: Landroid/content/SharedPreferences; const-string v3, "GoogleAdMobDoritosLife" const-wide/32 v4, 0xea60 invoke-interface {v2, v3, v4, v5}, Landroid/content/SharedPreferences;-> getLong (Ljava/lang/String; J) J move-result-wide v2 invoke-virtual {v1}, Landroid/app/Activity;-> getApplicationContext () Landroid/content/Context; move-result-object v4 invoke-static {v4 }, Landroid/preference/PreferenceManager;-> getdefasharsharedpreferences (Landroid/content/Context;) Landroid/content/SharedPreferences; move-result-object v4 invoke-static {v1 }, lcom/google/ads/I;-> a (Landroid/content/Context;) Z move-result v5 ...... # Create a Thread and enable the new-instance v0, Ljava/lang/Thread; new-instance v2, Lcom/google/ads/ar; invoke-direct {v2, v1 }, lcom/google/ads/ar;-> <init> (Landroid/app/Activity;) V invoke-direct {v0, v2}, Ljava/lang/Thread; -> <init> (Ljava/lang/Runnable;) V invoke-virtual {v0}, Ljava/lang/Thread;-> start () V ....... End method

In the general process, the rest will not go further. I went back to the top and found the entrance. Here I used comment out, so that the program will not execute the advertisement.

# Invoke-virtual {v0, v1}, Lcom/google/ads/AdView;-> a (Lcom/google/ads/c;) V

3. Clear ad entries and complete subsequent Functions
Repackage and run it to check what needs to be improved:

A red-like word appears, searches for it in each code, and is finally set
AdView. a (Landroid/content/Context; Lcom/google/ads/f; Landroid/util/AttributeSet;) Z

Code:

 

# Check whether the advertisement is successfully created. method private a (Landroid/content/Context; Lcom/google/ads/f; Landroid/util/AttributeSet;) Z. locals 1 invoke-static {p1}, Lcom/google/ads/util/AdUtil;-> c (Landroid/content/Context;) Z move-result v0 # added statement, so that the detection result is always successful const/4 v0, 0x1 if-nez v0,: cond_0 # After the ad entry function is removed, AdView will display the error message const-string v0, "You must have AdActivity declared in AndroidManifest. xml with configChanges. "invoke-direct {p0, p1, v0, p2, p3}, Lcom/google/ads/AdView;-> a (Landroid/content/Context; Ljava/lang/String; lcom/google/ads/f; Landroid/util/AttributeSet;) V const/4 v0, 0x0: goto_0 return v0: cond_0 const/4 v0, 0x1 goto: goto_0.end method

Add const/4 v0, 0x1, and check whether the advertisement runs successfully.
Due to the test on the simulator, there is no wifi function:










So far, this simple and small removal of advertising has come to an end, because of its use of reverse analysis, it is not difficult. Through this note, we aim to experience the role of reverse ad removal. If there are any errors, please correct them.