逆向破解学习-雷电星海战歌

apk

雷电星海战歌
https://download.csdn.net/download/AdrianAndroid/88200826

安装apk，并试玩

在这里插入图片描述 # 通过关键字搜索jad

在这里插入图片描述找到统一支付接口
找到匿名内部类的名称

Hook代码

public class HookComAstPlane extends HookImpl {@Overridepublic String packageName() {return "com.ast.plane";}@Overridepublic String appName() {return "雷电星海战歌";}@Overridepublic void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {String className = "com.ast.plane.PayUnity$1";ClassLoader classLoader = lpparam.classLoader;String methodNamePaySuccess = "paySuccess";String methodNamePayFailed = "payFailed";String methodNamePayCancel = "payCancel";final XC_MethodReplacement xc_replacementToPaySuccess = new XC_MethodReplacement() {@Overrideprotected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {// 获取商品的index参数Map<String, String> map = (Map<String, String>) methodHookParam.args[0];Object index = map.get("toolsAlias");XposedBridge.log("HookComAstPlane methodl index=" + index);// Hook 购买成功的方法//UnityPlayer.UnitySendMessage("Payback", "Callback", index);final String callClassName = "com.unity3d.player.UnityPlayer";final String callMethodName = "UnitySendMessage";final Object[] args = {"Payback", "Callback", index};Class<?> clazz = XposedHelpers.findClass(callClassName, lpparam.classLoader);Object result = XposedHelpers.callStaticMethod(clazz, callMethodName, args);XposedBridge.log("HookComAstPlane paySuccess index=" + index + ", result=" + result);return null;}};// 替换paySuccess, 因为新版本的Android不能在子线程ToastXposedHelpers.findAndHookMethod(className,lpparam.classLoader,methodNamePaySuccess,Map.class,xc_replacementToPaySuccess);// 替换payFailedXposedHelpers.findAndHookMethod(className,lpparam.classLoader,methodNamePayFailed,Map.class,int.class,xc_replacementToPaySuccess);// 替换payCancelXposedHelpers.findAndHookMethod(className,lpparam.classLoader,methodNamePayCancel,Map.class,xc_replacementToPaySuccess);}
}