android 遊戲總結

iplay破解點

移動MM

package mm.purchasesdk;

import java.util.HashMap;

public interface OnPurchaseListener {
    public static final String LEFTDAY = "LeftDay";
    public static final String ORDERID = "OrderId";
    public static final String ORDERTYPE = "OrderType";
    public static final String PAYCODE = "Paycode";
    public static final String TRADEID = "TradeID";

    void onAfterApply();

    void onAfterDownload();

    void onBeforeApply();

    void onBeforeDownload();

    void onBillingFinish(int arg1, HashMap arg2);

    void onInitFinish(int arg1);

    void onQueryFinish(int arg1, HashMap arg2);

    void onUnsubscribeFinish(int arg1);
}

聯通沃商店

com.unicom.dcLoader.Utils

public interface UnipayPayResultListener {
    void PayResult(String arg1, int arg2, String arg3);
}

egame

Egamepay:

package cn.egame.terminal.paysdk;

import java.util.Map;

import android.app.Activity;
import android.app.AlertDialog;
import android.content.Context;
import android.content.DialogInterface;
import android.content.Intent;
import android.os.Looper;
import android.util.Log;

public class EgamePay
{
    public static final String PAY_PARAMS_KEY_CP_PARAMS = "cpParams";
    public static final String PAY_PARAMS_KEY_PRIORITY = "priority";
    public static final String PAY_PARAMS_KEY_TOOLS_ALIAS = "toolsAlias";
    public static final String PAY_PARAMS_KEY_TOOLS_NAME = "toolsName";
    public static final String PAY_PARAMS_KEY_TOOLS_PRICE = "toolsPrice";
    public static final String PAY_PARAMS_KEY_USERID = "userId";
    public static final String PAY_PARAMS_KEY_USE_SMSPAY = "useSmsPay";
    public static int sInitStatus;
    
    static {
        EgamePay.sInitStatus = -2;
    }
    
    public static void exit(final Context context) {
        AlertDialog alertDialog = new AlertDialog.Builder(context).setTitle("退出提醒")
                .setMessage("是否退出程序")
                .setPositiveButton("確定", new DialogInterface.OnClickListener() {
                    public void onClick(DialogInterface dialog, int which) {
                        Intent intent = new Intent(Intent.ACTION_MAIN);
                        intent.addCategory(Intent.CATEGORY_HOME);
                        intent.setFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP);
                        context.startActivity(intent);
                        android.os.Process.killProcess(android.os.Process.myPid());
                    }
 
                }).setNegativeButton("取消",
 
                new DialogInterface.OnClickListener() {
                    public void onClick(DialogInterface dialog, int which) {
                        return;
                    }
                }).create(); // 創建對話框
        alertDialog.show(); // 顯示對話框
    }
    
    public static void exit(final Activity activity, final EgameExitListener egameExitListener) {
        AlertDialog alertDialog = new AlertDialog.Builder(activity).setTitle("退出提醒")
                .setMessage("是否退出程序")
                .setPositiveButton("確定", new DialogInterface.OnClickListener() {
 
                    public void onClick(DialogInterface dialog, int which) {
                        Intent intent = new Intent(Intent.ACTION_MAIN);
                        intent.addCategory(Intent.CATEGORY_HOME);
                        intent.setFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP);
                        activity.startActivity(intent);
                        android.os.Process.killProcess(android.os.Process.myPid());
                    }
 
                }).setNegativeButton("取消",
 
                new DialogInterface.OnClickListener() {
                    public void onClick(DialogInterface dialog, int which) {
                        return;
                    }
                }).create(); // 創建對話框
        alertDialog.show(); // 顯示對話框
    }

    public static void init(final Context context) {
        new Thread("pay_sdk_init") {
            @Override
            public void run() {
                Looper.prepare();
//                getInstance(context);
//                if (EgamePay.sEPIInstance != null) {
//                    System.out.println("sEPIInstance");
//                    EgamePay.sEPIInstance.init(context);
//                    return;
//                }
                System.out.println("instance is null");
            }
        }.start();
    
}
    
    public static void init(final Activity activity) {
        new Thread("ipayt") {
            @Override
            public void run() {
                Looper.prepare();
                System.currentTimeMillis();
//                final ProtocolMessage initPay = EgamePayProtocol.initPay((Context)activity);
                System.currentTimeMillis();
//                if (initPay != null) {
//                    EgamePay.sInitStatus = initPay.arg1;
//                }
            }
        }.start();
    }
    
    
    public static void moreGame(final Context context) {
    }
    public static void moreGame(final Activity activity) {
    }
    
    public static void pay(final Activity activity, final Map<String, String> map, final EgamePayListener egamePayListener) {
        egamePayListener.paySuccess(map);

    }
    public static void pay(final Context context, final Map<String, String> map, final EgamePayListener egamePayListener) {
        egamePayListener.paySuccess(map);

    }
    public static void pay(final Context context, String  map, final EgamePayListener egamePayListener) {
        egamePayListener.paySuccess(map);

    }
}

EgamePayListener:

package cn.egame.terminal.paysdk;

import java.util.*;

public interface EgamePayListener
{
    void payCancel(Map<String, String> p0);
    
    void payFailed(Map<String, String> p0, int p1);
    
    void paySuccess(Map<String, String> p0);

    void paySuccess(String map);
}

migu遊戲:

public final class GameInterface
{
    public static void initializeApp(final Activity main) {
        initializeApp(main, null, null, null, null, null);
    }
    
    public static void initializeApp(final Activity main, final String gameName, final String provider, final String serviceTel, final String loginNo, final ILoginCallback callback) {
    }
    
    public static void showStartDialog(final Context context, final boolean sound, final boolean lowApi, final String loginCpParam, final ILaunchCallback callback) {
    }
    
    public static void doBilling(final Context context, final boolean useSms, final boolean isRepeated, final String billingIndex, final String cpparam,  final IPayCallback callback) {
//        Log.i("cccc", billingIndex);
        callback.onResult(1, billingIndex, new Object());
        
    }

 ......

}

破解點：

onbillingfinish

payresult

paysuccess
sendsuccess

有時支付流程比較複雜，
會利用handlemessage


public final void handleMessage(Message arg8) {
        Object v0 = arg8.obj;
        System.out.println("json --> " + (((String)v0)));
        try {
            JSONObject v1 = new JSONObject(((String)v0));
            int v0_2 = v1.getInt("resultCode");
            String v2 = v1.getString("desc");
            double v3 = v1.getDouble("money");
            System.out.println("resultCode = " + v0_2);
            System.out.println("desc = " + v2);
            System.out.println("money = " + v3);
            Toast.makeText(this.a.a, ((CharSequence)v2), 0).show();
            switch(v0_2) {
                case -2: {
                    goto label_62;
                }
                case -1: {
                    goto label_52;
                }
                case 0: {
                    goto label_39;
                }
            }

            return;
        label_39:
            b.a(this.a).sendMessage(b.a(this.a).obtainMessage(arg8.what, 1, 0));
            return;
        label_52:
            b.a(this.a).sendMessage(b.a(this.a).obtainMessage(arg8.what, -1, 0));
            return;
        label_62:
            b.a(this.a).sendMessage(b.a(this.a).obtainMessage(arg8.what, 0, 0));
        }
        catch(JSONException v0_1) {
            v0_1.printStackTrace();
        }
    }

skynet    idsky    關鍵點

product_owned

private void preparePayment(int methodId, float price) {
        int v0_1;
        this.d = methodId;
        this.i.product.price = price;
        this.p = d.a(((Context)this));
        if(this.d == -2) {
            this.notifyTransaction(new PluginResult(Status.CANCEL));
        }
        else {
            if(this.i != null && this.d != -1 && this.f > 0) {
                if(this.i.isOwned) {
                    Log.e("SkynetPayActivity", "product already owned.");
                    this.notifyTransaction(new PluginResult(Status.ERROR, "already owned"));
                }
                else {
                    this.h = this.g.getMethod(this.d);
                    HashMap v0 = new HashMap();
                    v0.put("context", this);

驗證點：

1、跟據提示信息

盜版：\u76d7\u7248

2、killprogram    函數搜索

3、resetgame   exit    quit

函數搜索

4、 Activity v1 = ay.a().q();
            if(v1 != null) {
                AlertDialog$Builder v2 = new AlertDialog$Builder(((Context)v1));
                v2.setMessage(v0.getString("dialog_initconfig_msg"));
                v2.setCancelable(false);
                v2.setPositiveButton(v0.getString("DOWNLOAD"), new ac(arg4, v0));
                v2.setNegativeButton(v0.getString("EXIT"), new ad());
                try {
                    v2.show();
                }
                catch(WindowManager$BadTokenException v0_1) {
                }
            }

5、入口處，一步一步搜索

鎖定sim卡

sim

getsim

getimsi

geiimei

46000

46002

46007

中國移動

cmcc

www.10086.cn

46001

中國聯通

China Unicom

www.10010.cn

46003

中國電信

www.189.cn

China Telecom

去除短信權限manifest

<sms>