IM-A820L运营商短信修改教程（供其他泛泰机型参考）

想要恢复运营商短信自然要先了解短信发送流程，这里推荐看 Android平台 短信发送流程剖析(含编码) 这篇，

这里附上里面的流程图

既然A820L的正常中文短信都是都是OK的，那么就可以判断信息的储存取出应该是没有问题的

再看看下一幅流程图，当然A820L的流程图未必跟这个完全一样，但我们可以根据这个来查找

跟拆分短信的关系应该也是不大的，所以主要看sendText这一流程

接下来要做的，就是要看这一流程中泛泰有没有加入一些稀奇古怪的变态代码（如一些运营商判断之类的东东）

将framework转为java查看，最后我们可以发现在com.android.internal.telephony.GsmSMSDispatcher.java中的sendText里加入了这些变态的代码

	protected void sendText(String s, String s1, String s2, PendingIntent pendingintent, PendingIntent pendingintent1, String s3, int i)
	{
		int j = Log.e("GSM", "=== sendText ===!! ");
		String s4;
		com.android.internal.telephony.gsm.SmsMessage.SubmitPdu submitpdu;
		if (SkyMsgConfig.isSKTVendor() || SkyMsgConfig.isLGVendor())
		{
			if (TextUtils.isEmpty(s3))
				s4 = ((TelephonyManager)mContext.getSystemService("CHARSET=UTF-8")).getLine1Number();
			else
				s4 = s3;
		} else
		{
			String s11 = TelephonyManager.getDefault().getLine1Number();
			if (s3 == null)
			{
				s4 = s11;
				int j1;
				if (TextUtils.isEmpty(s4))
					j1 = Log.e("GsmSMSDispatcher", "Can not read MSISDN from SIM");
			} else
			{
				String s12 = s11.replace("+82", "0");
				String s13 = s3;
				String s14 = s12;
				if (s13.equals(s14))
					s4 = s11;
				else
					s4 = s3;
			}
		}
		if (TextUtils.isEmpty(s4))
		{
			int k;
			String s5;
			String s6;
			String s7;
			boolean flag;
			GsmSMSDispatcher gsmsmsdispatcher;
			String s8;
			String s9;
			String s10;
			com.android.internal.telephony.gsm.SmsMessage.SubmitPdu submitpdu1;
			HashMap hashmap;
			CommandsInterface.RadioTechnologyFamily radiotechnologyfamily;
			GsmSMSDispatcher gsmsmsdispatcher1;
			PendingIntent pendingintent2;
			PendingIntent pendingintent3;
			int i1;
			SMSDispatcher.SmsTracker smstracker;
			GsmSMSDispatcher gsmsmsdispatcher2;
			SMSDispatcher.SmsTracker smstracker1;
			if (pendingintent1 != null)
				k = 1;
			else
				k = 0;
			s5 = s1;
			s6 = s;
			s7 = s2;
			flag = k;
			submitpdu = SmsMessage.getSubmitPdu(s5, s6, s7, flag);
		} else
		{
			SmsHeader smsheader = new SmsHeader();
			smsheader.ReplyAddr = s4;
			byte abyte0[] = SmsHeader.toByteArray(smsheader);
			int l;
			String s15;
			String s16;
			String s17;
			boolean flag1;
			byte abyte1[];
			if (pendingintent1 != null)
				l = 1;
			else
				l = 0;
			s15 = s1;
			s16 = s;
			s17 = s2;
			flag1 = l;
			abyte1 = abyte0;
			submitpdu = SmsMessage.getSubmitPdu(s15, s16, s17, flag1, abyte1);
		}
		gsmsmsdispatcher = this;
		s8 = s;
		s9 = s1;
		s10 = s2;
		submitpdu1 = submitpdu;
		hashmap = gsmsmsdispatcher.SmsTrackerMapFactory(s8, s9, s10, submitpdu1);
		radiotechnologyfamily = CommandsInterface.RadioTechnologyFamily.RADIO_TECH_3GPP;
		gsmsmsdispatcher1 = this;
		pendingintent2 = pendingintent;
		pendingintent3 = pendingintent1;
		i1 = i;
		smstracker = gsmsmsdispatcher1.SmsTrackerFactory(hashmap, pendingintent2, pendingintent3, radiotechnologyfamily, i1);
		gsmsmsdispatcher2 = this;
		smstracker1 = smstracker;
		gsmsmsdispatcher2.sendRawPdu(smstracker1);
	}

参考一下https://github.com/CyanogenMod/android_frameworks_base/blob/gb-release-7.2/telephony/java/com/android/internal/telephony/gsm/GsmSMSDispatcher.java

    protected void sendText(String destAddr, String scAddr, String text,
            PendingIntent sentIntent, PendingIntent deliveryIntent) {
        SmsMessage.SubmitPdu pdu = SmsMessage.getSubmitPdu(
                scAddr, destAddr, text, (deliveryIntent != null));
        sendRawPdu(pdu.encodedScAddress, pdu.encodedMessage, sentIntent, deliveryIntent);
    }

可以发现，我们需要的是

submitpdu = SmsMessage.getSubmitPdu(s5, s6, s7, flag);

而不是

submitpdu = SmsMessage.getSubmitPdu(s15, s16, s17, flag1, abyte1);

并且显然

if (SkyMsgConfig.isSKTVendor() || SkyMsgConfig.isLGVendor())
else

的判断加入的s4未必为空，那么加入的s4是什么呢？

根据A820L若不设置本机号码就可发送运营商短信，还有"smsheader.ReplyAddr = s4;"，我们基本可以判断这个s4是本机号码

那么最后的问题就是如何修改才能让设置了本机号码的手机正常发送运营商短信了

我们需要做的就是让它只执行

submitpdu = SmsMessage.getSubmitPdu(s5, s6, s7, flag);

最简单的办法就是修改令s4为空

或修改

submitpdu = SmsMessage.getSubmitPdu(s15, s16, s17, flag1, abyte1);

为

submitpdu = SmsMessage.getSubmitPdu(s5, s6, s7, flag);

当然，也可以进行代码删除，剩下

	protected void sendText(String s, String s1, String s2, PendingIntent pendingintent, PendingIntent pendingintent1, String s3, int i)
	{
		int j = Log.e("GSM", "=== sendText ===!! ");
		String s4;
		com.android.internal.telephony.gsm.SmsMessage.SubmitPdu submitpdu;
			int k;
			String s5;
			String s6;
			String s7;
			boolean flag;
			GsmSMSDispatcher gsmsmsdispatcher;
			String s8;
			String s9;
			String s10;
			com.android.internal.telephony.gsm.SmsMessage.SubmitPdu submitpdu1;
			HashMap hashmap;
			CommandsInterface.RadioTechnologyFamily radiotechnologyfamily;
			GsmSMSDispatcher gsmsmsdispatcher1;
			PendingIntent pendingintent2;
			PendingIntent pendingintent3;
			int i1;
			SMSDispatcher.SmsTracker smstracker;
			GsmSMSDispatcher gsmsmsdispatcher2;
			SMSDispatcher.SmsTracker smstracker1;
			if (pendingintent1 != null)
				k = 1;
			else
				k = 0;
			s5 = s1;
			s6 = s;
			s7 = s2;
			flag = k;
			submitpdu = SmsMessage.getSubmitPdu(s5, s6, s7, flag);
		gsmsmsdispatcher = this;
		s8 = s;
		s9 = s1;
		s10 = s2;
		submitpdu1 = submitpdu;
		hashmap = gsmsmsdispatcher.SmsTrackerMapFactory(s8, s9, s10, submitpdu1);
		radiotechnologyfamily = CommandsInterface.RadioTechnologyFamily.RADIO_TECH_3GPP;
		gsmsmsdispatcher1 = this;
		pendingintent2 = pendingintent;
		pendingintent3 = pendingintent1;
		i1 = i;
		smstracker = gsmsmsdispatcher1.SmsTrackerFactory(hashmap, pendingintent2, pendingintent3, radiotechnologyfamily, i1);
		gsmsmsdispatcher2 = this;
		smstracker1 = smstracker;
		gsmsmsdispatcher2.sendRawPdu(smstracker1);
	}

这里就不提供smali代码了，请自行修改之