目录
分析步骤
脱完壳之后会有很多dex, 这里我就没去找对应的dex,这里我是直接用脚本把所有的dex都 反编译成java代码,然后就sublime看的,这样感觉比较方便(个人喜好 )合并dex脚本
脱完壳后就开始找关键代码了,直接打开app 进入到收红包消息的界面,运行该命令,找到顶层的activety
adb shell dumpsys activity top | grep ACTIVITY
new RedpaperApi().getRedpaper(...) 这个接口
function hookChatRoom() { Java.perform(function(){ var Gson = Java.use("com.google.gson.Gson"); var IMMessage = Java.use("com.netease.nimlib.sdk.msg.model.IMMessage"); var CustomBaseMode = Java.use("com.xxx.xx.module.nim.custom.CustomBaseMode"); var AnchorBean = Java.use("com.xxx.xx.model.AnchorBean"); var UserInfo = Java.use("com.xxx.xx.constant.UserInfo"); var GsonNew = Gson.$new(); var BaseChatRoomActivity = Java.use("com.xxx.xx.module.live.chatroom.BaseChatRoomActivity"); var YRequest = Java.use("com.hzlh.sdk.net.YRequest"); // hook http 请求的返回值 YRequest.handleResult.implementation = function(obj, callBack) { console.log("YRequest.handleResult: ", GsonNew.toJson(obj)); return this.handleResult(obj, callBack); } BaseChatRoomActivity.handleCustomMessage.implementation = function(chatRoomMessage) { var imMessage = Java.cast(chatRoomMessage, IMMessage); var json = GsonNew.toJson(imMessage.getRemoteExtension()); var custMsg = GsonNew.fromJson(json, CustomBaseMode.class); var customBaseMode = Java.cast(custMsg, CustomBaseMode); var dataType = customBaseMode.getDataType(); var userId = UserInfo.getBase().getAppUserId(); if(dataType == 301){ //send("红包来了。。。。。。。。。。。。。。"); console.log("红包来了。。。。。。。。。。。。。。"); var redcontent = customBaseMode.getContent(); console.log("data: ", redcontent) var authorId = Java.cast(GsonNew.fromJson(redcontent, AnchorBean.class), AnchorBean).getAnchorpersonId(); //创建一个线程 收到红包消息就去抢红包 var jRunnable = Java.use('java.lang.Runnable'); var MyRunnable = Java.registerClass({ name: 'com.example.MyRunnable', implements: [jRunnable], methods: { run: function(){ console.log("thread run..."); var ChatRoomEventView = "com.xxx.xx.module.live.chatroom.event.ChatRoomEventView"; var RedpaperApi = Java.use("com.xxx.xx.Api.redpaper.RedpaperApi"); var AppCallBack = Java.use("com.xxx.xx.model.AppCallBack"); var a = 1; Java.choose(ChatRoomEventView, { onMatch:function(instance){ if(a == 1) { console.log("getRedpaper : ", instance, authorId, userId); RedpaperApi.$new().getRedpaper(instance.mContext.value, authorId, userId, AppCallBack.$new(instance.mContext.value)); a ++; } }, onComplete:function(){ } }) } } }); //console.log("--------start thread--------"); var runnable = MyRunnable.$new(); runnable.run(); }else if(dataType == 64){ console.log("抽奖来了。。。。。。。。。。。。。"); console.log("data: ", customBaseMode.getContent()) }else if(dataType == 251){ console.log("福利来了。。。。。。。。。。。。。"); console.log("data: ", customBaseMode.getContent()) } return this.handleCustomMessage(chatRoomMessage); } }) }
[看雪官方培训]《安卓高级研修班(网课)》9月班开始招生!顶尖技术、挑战极限、工资翻倍!
最后于 17小时前 被Snark编辑 ,原因: