1.首先将crackme0502 拖入模拟器。打开应用,随意输出字符串
![image](https://img2022.cnblogs.com/blog/1267154/202203/1267154-20220318151810296-1100953731.png)
2. 将APK 拖入AndroidKiller 反编译
3.先查看androidmanifest.xml
<?xml version="1.0" encoding="utf-8" standalone="no"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.droider.crackme0502">
<application android:debuggable="true" android:icon="@drawable/ic_launcher" android:label="@string/app_name" android:name=".MyApp" android:theme="@style/AppTheme">
<activity android:label="@string/title_activity_main" android:name=".MainActivity">
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.LAUNCHER"/>
</intent-filter>
</activity>
</application>
</manifest>
4. 直接定位到主页面的MainActivity,查看MainActivity.smali代码,发现有这样一行代码
.line 40
iget-object v0, p0, Lcom/droider/crackme0502/MainActivity;->btnCheckSN:Landroid/widget/Button;
new-instance v1, Lcom/droider/crackme0502/MainActivity$2;
invoke-direct {v1, p0}, Lcom/droider/crackme0502/MainActivity$2;-><init>(Lcom/droider/crackme0502/MainActivity;)V
invoke-virtual {v0, v1}, Landroid/widget/Button;->setOnClickListener(Landroid/view/View$OnClickListener;)V
这里创建了一个MainActivity$2
的对象,并作为参数传入给了Button;->setOnClickListener
,所以这是一个点击的监听内部类,进去看看它的onclick
方法
5. 搜索toast弹出的字符串: “注册码错误” ;首先要将其转换成Unicode格式
![image](https://img2022.cnblogs.com/blog/1267154/202203/1267154-20220318152655831-153739471.png)
6. 通过该Unicode定位
.line 45
.local v0, "checker":Lcom/droider/crackme0502/MainActivity$SNChecker;
invoke-virtual {v0}, Lcom/droider/crackme0502/MainActivity$SNChecker;->isRegistered()Z
move-result v2
if-eqz v2, :cond_0
const-string v1, "\u6ce8\u518c\u7801\u6b63\u786e" # 这里是: “注册码正确”
7. 确认是if-eqz v2, :cond_0
在控制跳转,先暴力一点,直接改为 if-nez v2, :cond_0
,重新打包签名,放入虚拟机运行,ok
![image](https://img2022.cnblogs.com/blog/1267154/202203/1267154-20220318153026188-44708586.png)