0x01 前言
演示APK: 计算器(cale.apk)
测试平台: Win7 64
反编译工具: APK改之理3.5
对新手来说，这个APK改之理还是不错了，都是一键搞定，虽然网上说重新编译会添加一些信息，那可以在找到修改处后用另一种反编译工具修改
0x02 收集信息并定位
- 提示信息：免费版用户 定位到 br.smali
1.jpg - 查看AndroidManifaset.xml文件，得到包名与主活动xwj.calculator.MainActivityFree
0x03 关键函数分析
注释全写在代码中
# instance fields
// SkinsActivity a;
.field final synthetic a:Lxwj/calculator/SkinsActivity;
// 重载方法
# virtual methods
// public void handleMessage(Message msg)
.method public handleMessage(Landroid/os/Message;)V
.locals 4
// v3 = 0
const/4 v3, 0x0
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
// ProgressDialog v0 = SkinsActivity.a(this.a);
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;
move-result-object v0
// if(v0 == 0) {goto cond_0};
if-eqz v0, :cond_0
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
// ProgressDialog v0 = SkinsActivity.a(this.a);
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;
move-result-object v0
// Boolean v0 = v0.isShowing()
invoke-virtual {v0}, Landroid/app/ProgressDialog;->isShowing()Z
move-result v0
// if(v0 == 0) {goto cond_0};
if-eqz v0, :cond_0
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
// ProgressDialog v0 = SkinsActivity.a(this.a);
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;
move-result-object v0
// void v0 = v0.dismiss()
invoke-virtual {v0}, Landroid/app/ProgressDialog;->dismiss()V
/*
以上代码意思:
1. 判断信息框是否存存
2. 存在则再次使用isShowing方法判断是否存在
3. 存在则关闭信息框
*/
:cond_0
// int v0 = msg
iget v0, p1, Landroid/os/Message;->what:I
// if(v0 != 0) {goto cond_1;
// 对于handleMessage函数是Android的消息处理函数，本人暂时没学到，所以不明白这些意思，无法翻译，见谅
if-nez v0, :cond_1
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
// int v0 = SkinsActivity.b(this.a)
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->b(Lxwj/calculator/SkinsActivity;)I
move-result v0
const/16 v1, 0x32
// if(v0 >= 0x32) {goto cond_3}
if-ge v0, v1, :cond_3
// 消息框AlertDialog，看下面的字符串不用多说了，弹出一个消息框
new-instance v0, Landroid/app/AlertDialog$Builder;
iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-direct {v0, v1}, Landroid/app/AlertDialog$Builder;->(Landroid/content/Context;)V
// String v1 = "需要激活"
const-string v1, "\u9700\u8981\u6fc0\u6d3b"
// 我把多余的删了，直观点
......
invoke-virtual {v0}, Landroid/app/AlertDialog$Builder;->show()Landroid/app/AlertDialog;
:cond_1
// 看到goto我就感觉看到了循环
:goto_0
iget v0, p1, Landroid/os/Message;->what:I
const/4 v1, 0x1
// if(msg != 1) {goto cond_5}
if-ne v0, v1, :cond_5
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;
move-result-object v0
// String v0 = SkinsActivity.c(this.a).v0.m()
invoke-virtual {v0}, Lxwj/calculator/s;->m()Ljava/lang/String;
move-result-object v0
if(v0 != null) {goto cond_4}
if-nez v0, :cond_4
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
// s v0 = SkinsActivity.c(this.a)
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;
move-result-object v0
// 创建一个StringBuilder实例，与下面invoke_direct配套
new-instance v1, Ljava/lang/StringBuilder;
iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v2}, Lxwj/calculator/SkinsActivity;->d(Lxwj/calculator/SkinsActivity;)I
move-result v2
invoke-static {v2}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;
move-result-object v2
// StringBuilder v1 = new StringBuilder(String.valueOf(SkinsActivity.d(this.a)))
invoke-direct {v1, v2}, Ljava/lang/StringBuilder;->(Ljava/lang/String;)V
String v1 = v1.toString();
invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v1
// v0.b(v1)
invoke-virtual {v0, v1}, Lxwj/calculator/s;->b(Ljava/lang/String;)V
:goto_1
// 激活成功，下面不再解释了
new-instance v0, Lxwj/calculator/ce;
invoke-direct {v0}, Lxwj/calculator/ce;->()V
iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v2}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;
move-result-object v2
invoke-virtual {v0, v1, v2}, Lxwj/calculator/ce;->a(Landroid/app/Activity;Lxwj/calculator/s;)V
new-instance v0, Landroid/app/AlertDialog$Builder;
iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-direct {v0, v1}, Landroid/app/AlertDialog$Builder;->(Landroid/content/Context;)V
// String v1 = "您已成功激活本皮肤。感谢您的支持！"
const-string v1, "\u60a8\u5df2\u6210\u529f\u6fc0\u6d3b\u672c\u76ae\u80a4\u3002\u611f\u8c22\u60a8\u7684\u652f\u6301\uff01"
invoke-virtual {v0, v1}, Landroid/app/AlertDialog$Builder;->setMessage(Ljava/lang/CharSequence;)Landroid/app/AlertDialog$Builder;
move-result-object v0
const-string v1, "\u597d\u7684"
invoke-virtual {v0, v1, v3}, Landroid/app/AlertDialog$Builder;->setPositiveButton(Ljava/lang/CharSequence;Landroid/content/DialogInterface$OnClickListener;)Landroid/app/AlertDialog$Builder;
move-result-object v0
invoke-virtual {v0}, Landroid/app/AlertDialog$Builder;->show()Landroid/app/AlertDialog;
:cond_2
:goto_2
return-void
:cond_3
......
goto/16 :goto_0
:cond_4
......
goto/16 :goto_1
:cond_5
......
goto/16 :goto_2
.end method
修改方法:
- 把不要的代码全删除，仅保留 消息框的判断语句 与 成功语句
- 把cond_4中的代码提升到cond_0下面，这样就变成了流水线，不再跳来跳去
# virtual methods
.method public handleMessage(Landroid/os/Message;)V
.locals 4
const/4 v3, 0x0
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;
move-result-object v0
if-eqz v0, :cond_0
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;
move-result-object v0
invoke-virtual {v0}, Landroid/app/ProgressDialog;->isShowing()Z
move-result v0
if-eqz v0, :cond_0
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;
move-result-object v0
invoke-virtual {v0}, Landroid/app/ProgressDialog;->dismiss()V
:cond_0
iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v0}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;
move-result-object v0
new-instance v1, Ljava/lang/StringBuilder;
iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v2}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;
move-result-object v2
invoke-virtual {v2}, Lxwj/calculator/s;->m()Ljava/lang/String;
move-result-object v2
invoke-static {v2}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;
move-result-object v2
invoke-direct {v1, v2}, Ljava/lang/StringBuilder;->(Ljava/lang/String;)V
const-string v2, ","
invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v1
iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v2}, Lxwj/calculator/SkinsActivity;->d(Lxwj/calculator/SkinsActivity;)I
move-result v2
invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;
move-result-object v1
invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v1
invoke-virtual {v0, v1}, Lxwj/calculator/s;->b(Ljava/lang/String;)V
new-instance v0, Lxwj/calculator/ce;
invoke-direct {v0}, Lxwj/calculator/ce;->()V
iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-static {v2}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;
move-result-object v2
invoke-virtual {v0, v1, v2}, Lxwj/calculator/ce;->a(Landroid/app/Activity;Lxwj/calculator/s;)V
new-instance v0, Landroid/app/AlertDialog$Builder;
iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;
invoke-direct {v0, v1}, Landroid/app/AlertDialog$Builder;->(Landroid/content/Context;)V
const-string v1, "\u60a8\u5df2\u6210\u529f\u6fc0\u6d3b\u672c\u76ae\u80a4\u3002\u611f\u8c22\u60a8\u7684\u652f\u6301\uff01"
invoke-virtual {v0, v1}, Landroid/app/AlertDialog$Builder;->setMessage(Ljava/lang/CharSequence;)Landroid/app/AlertDialog$Builder;
move-result-object v0
const-string v1, "\u597d\u7684"
invoke-virtual {v0, v1, v3}, Landroid/app/AlertDialog$Builder;->setPositiveButton(Ljava/lang/CharSequence;Landroid/content/DialogInterface$OnClickListener;)Landroid/app/AlertDialog$Builder;
move-result-object v0
invoke-virtual {v0}, Landroid/app/AlertDialog$Builder;->show()Landroid/app/AlertDialog;
return-void
.end method
0x04 使用工具查看源代码
当0x03章smali分析完后，大体源代码可以浮现出来了
当对smali有一定了解后，就可以使用现成工具直接查看源代码，如JD-GUI
2.png