[Android 逆向]frida 破解 切水果大战原版.apk
1. 手机安装该apk，运行，点击右上角礼物
提示 支付失败，请稍后重试
2. apk拖入到jadx中，待加载完毕后，搜素失败，找到疑似目标类MymmPay的关键方法payResultFalse
4. adb logcat 或者androidstudio 查看该进程的日志，发现以下日志
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: getStringPayid7
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: ----------------------payid-----------------:7
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: ----------------------change-----------------:false
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/System.out: ----------------------paycodebefore-----------------:008
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/System.out: ----------------------paycodeafter-----------------:02
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: ----------------------paycode-----------------:008
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: ----------------------MessageUtil.getInstance().Um_Number-----------------:1
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/System.out: ----------------------strdialog0-----------------:0
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: -------totalMoney--------68.1
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: -------MessageUtil.getInstance().limitMoney--------9999.0
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/System.out: tianlibaotrue
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: paysuss-----false
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: theymoney-----20.0
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: 智能设备唯一编号为空,检查手机卡是否安装
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: bill_______________---30216141904687
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: mPaycode_____008
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei E/GameSDK: doCMCCBilling
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei V/Network: network ["ChinaNet-2qUX"] is connected.
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei V/Network: network ["ChinaNet-2qUX"] is connected.
SurfaceFlinger: duplicate layer name: changing com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei/org.cocos2dx.cpp.AppActivity to com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei/org.cocos2dx.cpp.AppActivity#1
com.mf.xxyzgame.wpp.game.hlqsgdzz.huawei I/print: onResultfailedbillingIndex008resultCode2
ps 一句，打日志还是要小心噢
从日志可以判断出，调用的地方是当前类的public void payOrder(String paramString)
public void payOrder(String paramString) {
getPayId(paramString);
Printlog("----------------------payid-----------------:" + payId);
this.mPaycode = getBillingIndexStr1(paramString);
Printlog("----------------------change-----------------:" + XmlTran.getInstance().isChange());
System.out.println("----------------------paycodebefore-----------------:" + this.mPaycode);
if (XmlTran.getInstance().isChange()) {
this.mPaycode = getBillingIndex(XmlTran.getInstance().getTranId(payId + 1));
}
System.out.println("----------------------paycodeafter-----------------:0" + XmlTran.getInstance().getTranId(payId + 1));
Printlog("----------------------paycode-----------------:" + this.mPaycode);
Printlog("----------------------MessageUtil.getInstance().Um_Number-----------------:" + MessageUtil.getInstance().Um_Number);
if (this.payType.equals("0")) {
pay();
} else if (this.payType.equals("1")) {
((Activity) this.context).runOnUiThread(new Runnable() { // from class: com.mydefinemmpay.tool.MymmPay.5
@Override // java.lang.Runnable
public void run() {
MymmPay.this.pay();
}
});
}
}
public void pay() {
if (XmlTran.getInstance().getAddDialog(payId + 1).equals("0")) {
System.out.println("----------------------strdialog0-----------------:" + XmlTran.getInstance().getAddDialog(payId + 1));
doBilling();
return;
}
......
}
public void doBilling() {
float totalMoney = Float.valueOf(RecordOpreate.getInstance().getData(RecordOpreate.totalMoey)).floatValue();
Printlog("-------totalMoney--------" + totalMoney);
Printlog("-------MessageUtil.getInstance().limitMoney--------" + MessageUtil.getInstance().limitMoney);
WinPayResult.getInstance();
this.payCodeMoney = WinPayResult.Tmone[payId - WinPayResult.addPayCode];
showDebug("开始支付：;\n已经消费：" + totalMoney + ";\n支付上限：" + MessageUtil.getInstance().limitMoney + ";\n商品金额：" + WinPayResult.Tmone[payId - WinPayResult.addPayCode] + ";\n支付代码：" + this.mPaycode + ";\n");
if (totalMoney >= MessageUtil.getInstance().limitMoney) {
((Activity) this.context).runOnUiThread(new Runnable() { // from class: com.mydefinemmpay.tool.MymmPay.9
@Override // java.lang.Runnable
public void run() {
MymmPay.this.payResultSuccess();
}
});
} else if (this.onlineNumName.equals("EMPTY")) {
payResultSuccess();
} else {
System.out.println("tianlibao" + tanLibao());
if (!tanLibao()) {
payResultFalse();
} else if (MessageUtil.getInstance().free.equals("1")) {
payResultSuccess();
} else {
Printlog("paysuss-----" + this.paysuss);
Printlog("theymoney-----" + WinPayResult.Tmone[payId - WinPayResult.addPayCode]);
String sdkKind = MessageUtil.getInstance().sdkKind;
if (sdkKind.equals("0")) {
if (mgif == null) {
showDebug("错误：咪咕sdk为空");
} else if (getLibKind() == 0) {
mgif.pay();
} else if (getLibKind() == 1) {
......
从日志上看，最终是走到了doBilling 的最后一个else；那么我们想办法把MessageUtil.getInstance().free的值搞成1是不是就ok了呢，
5. 编写frida脚本验证猜想
// lesson02.js
function main() {
Java.perform(function () {
var MessageUtilHandler = Java.use('com.mydefinemmpay.tool.MessageUtil')
if (MessageUtilHandler != undefined) {
//静态函数主动调用
var instance = MessageUtilHandler.getInstance();
console.log("===== " + JSON.stringify(instance))
//成员变量主动修改
instance.free.value = "1"
}
})
}
setTimeout(main)
6. 执行frida -UF hfdcxy.com.myapplication -l lesson02.js
执行成功，购买所有商品道具全部成功可以使用
