背景
某同事要学应用，拿出来几个app让给破解了…… 趁着闲工夫，简单“破解”了一下。
代码
private void hookYidian(final XC_LoadPackage.LoadPackageParam lpparam) {
if (!lpparam.processName.equals("com.wumii.android.athena")) {
return;
}
//因为使用的360加固，要拿到360的context，所以在360加固的StubApp中获取。
XposedHelpers.findAndHookMethod("com.stub.StubApp", lpparam.classLoader,
"attachBaseContext", Context.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
final Context context = (Context) param.args[0];
final ClassLoader cl = context.getClassLoader();
XposedBridge.log("hookYidian " + cl.getClass().getName());
//第一个破解需求：几次发音后，不能发音了，而且分数被模糊了，求破解
//解决办法：拿到这个类SpeakScoreView 在检查是不是vip时候，强制返回是vip 这里的意思应该是 “是不是需要vip权限” =>false
XposedHelpers.findAndHookMethod("com.wumii.android.athena.ui.widget.SpeakScoreView", cl, "setCheckVip", boolean.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
param.args[0] = false;
XposedBridge.log("hookYidian beforeHookedMethod setCheckVip " + param.args[0]);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
XposedBridge.log("hookYidian afterHookedMethod setCheckVip " + param.args[0]);
}
});
//上一步发现 最后一次发音后，分数的视图被模糊 在这里直接返回 不模糊 测试生效~
XposedHelpers.findAndHookMethod("com.wumii.android.athena.ui.widget.SpeakScoreView", cl, "setBlur", boolean.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
param.args[0] = false;
XposedBridge.log("hookYidian beforeHookedMethod setBlur " + param.args[0]);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
XposedBridge.log("hookYidian afterHookedMethod setBlur" + param.args[0]);
}
});
//这里是vip视频 vip下才能进入，非vip有弹窗提示 所以在弹窗之前 返回不需要vip权限 直接跳转到下页
XposedHelpers.findAndHookMethod("com.wumii.android.athena.ui.practice.video.PlayingVideoPagerFragment", cl, "h", boolean.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
param.args[0] = false;
XposedBridge.log("hookYidian beforeHookedMethod PlayingVideoPagerFragment vipTip " + param.args[0]);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
XposedBridge.log("hookYidian afterHookedMethod PlayingVideoPagerFragment vipTip" + param.args[0]);
}
});
//这里是确实是忘了什么东西了。
XposedHelpers.findAndHookMethod("com.wumii.android.athena.store.W", cl, "W", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
param.setResult(true);
XposedBridge.log("hookYidian afterHookedMethod W vipTip " + param.getResult());
}
});
//经过打印 发现之前为false 改为vip 强制返回true
XposedHelpers.findAndHookMethod("com.wumii.android.athena.model.ui.PlayingVideoData", cl, "getVip", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
param.setResult(true);
XposedBridge.log("hookYidian afterHookedMethod W vipTip " + param.getResult());
}
});
//实在是忘了是干啥的了
Class c = XposedHelpers.findClass("com.wumii.android.athena.model.ui.PlayingVideoData", cl);
XposedHelpers.findAndHookMethod("com.wumii.android.athena.ui.practice.PlayingVideoActivity.a", cl, "a", Context.class, c, String.class, boolean.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
XposedBridge.log("hookYidian PlayingVideoActivity beforeHookedMethod " + param.args[3]);
param.args[3] = false;
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
XposedBridge.log("hookYidian PlayingVideoActivity afterHookedMethod " + param.args[3]);
}
});
//10000是点击查看示意的次数 然而没啥用 因为最后不要这个提示了
Class f = XposedHelpers.findClass("com.wumii.android.athena.core.feature.FeatureType", cl);
XposedHelpers.findAndHookMethod("com.wumii.android.athena.c.c.e", cl, "a", f, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
param.setResult(10000);
}
});
//发音专项 不需要vip权限 返回false
XposedHelpers.findAndHookMethod("com.wumii.android.athena.c.c.e", cl, "b", f, String.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
param.setResult(false);
}
});
//由于是一个H5页面 找源代码找了好久，泛型有一个Config类中有个getVip方法 返回true 则都能看了
XposedHelpers.findAndHookMethod("com.wumii.android.athena.model.realm.Config", cl, "getVip", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
param.setResult(true);
}
});
}
});
}后记
太极中不能添加插件 需要提交给太极的作者才能使用，所以建议使用virtualXposed。当前hook的一点应用版本是v3.15.0。
