无痛单词_1.10.0 逆向思路

可能呀

4个月前更新

091

一、修改思路

1.1 解锁终生会员

搜索方法名：tech.xiangzi.painless.data.remote.model.UserBean.getPro

点击第一个：

在返回前添加代码：const v0,0x9

修改完成，成品图：

二、分析

hook 代码：

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 Java.perform(function () { //打印堆栈信息的方法 function showStacks() { console.log( Java.use("android.util.Log") .getStackTraceString( Java.use("java.lang.Throwable").$new() ) ); } var Intent = Java.use("android.content.Intent"); Intent.$init.overload('android.content.Context', 'java.lang.Class').implementation = function (context, cls) { console.log("Intent(context, cls) called with context: " + context + " and class: " + cls); showStacks(); return this.$init(context, cls); };

软件里点击“自定义单词本”后跳转到购买会员的界面，同时控制台打印出堆栈信息：

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 java.lang.Throwable at android.content.Intent.<init>(Native Method) at tech.xiangzi.painless.utils.ext.CustomExtKt.toPayPage(Unknown Source:29) at tech.xiangzi.painless.ui.fragment.SettingFragment$showPayDialog$1$1.invoke(Unknown Source:7) at tech.xiangzi.painless.ui.fragment.SettingFragment$showPayDialog$1$1.invoke(Unknown Source:0) at tech.xiangzi.painless.ui.activity.MainActivity.onClickInterceptor(SourceFile:252) at tech.xiangzi.painless.ui.activity.MainActivity.onClickInterceptor$default(Unknown Source:11) at tech.xiangzi.painless.ui.fragment.SettingFragment.showPayDialog(Unknown Source:22) at tech.xiangzi.painless.ui.fragment.SettingFragment.access$showPayDialog(Unknown Source:0) at tech.xiangzi.painless.ui.fragment.SettingFragment$initView$1$4$2.invoke(Unknown Source:85) at tech.xiangzi.painless.ui.fragment.SettingFragment$initView$1$4$2.invoke(Unknown Source:8) at com.drake.brv.BindingAdapter$BindingViewHolder$2.invoke(Unknown Source:40) at com.drake.brv.BindingAdapter$BindingViewHolder$2.invoke(Unknown Source:2) at com.drake.brv.listener.ThrottleClickListener.onClick(Unknown Source:24) at android.view.View.performClick(View.java:7755) at android.view.View.performClickInternal(View.java:7728) at android.view.View.access$3700(View.java:862) at android.view.View$PerformClick.run(View.java:29337) at android.os.Handler.handleCallback(Handler.java:938) at android.os.Handler.dispatchMessage(Handler.java:99) at android.os.Looper.loopOnce(Looper.java:210) at android.os.Looper.loop(Looper.java:299) at android.app.ActivityThread.main(ActivityThread.java:8307) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:577) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1073)

一个个看过去，定位到关键函数：

之所以跳转到购买会员的界面是因为getPro()返回值为0，所以将返回值改成1

又发现这样子还不是终生会员，所以我们查看一下getPro()的用例，定位到一个关键函数：

getPro()的返回值为9才是终生会员(早知道直接搜索关键字“终生会员”了，绕了那么大一圈……)

做个总结吧：hook定位固然好用，但还是动静态分析结合有更高的效率，例如这个案例，如果一开始就用关键词搜索的效率会更高

THE END