Android安全-逆向Android知识

屏蔽GMS的Dialog提示

2019-03-04  本文已影响8人  LiuJP

接到一个活儿,是让屏蔽谷歌gms的dialog提示,屏蔽游戏中的ShareButton,CloudSaveButton,屏蔽UnityAd
1、屏蔽CloudSaveButton,在相应的未知加入以下IL:

805 ldarg.0 
806 ldfld   UnityEngine.UI.Button MainMenuController::CloudSaveButton
811 callvirt    UnityEngine.GameObject UnityEngine.Component::get_gameObject()
816 ldc.i4.0    
817 callvirt    System.Void UnityEngine.GameObject::SetActive(System.Boolean)

2、屏蔽UnityAd,也是找到相应ContinueClick()方法,修改判断逻辑

3、屏蔽Dialog:

 com.google.android.gms.common.GoogleApiAvailability.zza();

返回是Dialog;
修改smali,返回null;

hook代码:

  try {
        Method methodzza = null;
        Class<?> a   =target.getClassLoader().loadClass("com.google.android.gms.common.GoogleApiAvailability");
        for (Method method : a.getDeclaredMethods()) {
            if ("zza".equals(method.getName())) {
                Log.e("gamea", ":" + method.getName() + ":" + method.getReturnType().getName());
                if (method.getReturnType().getName().equals("android.app.Dialog")) {
                    methodzza = method;
                }
            }
        }
         if (methodzza != null) {
            DexposedBridge.hookMethod(methodzza, new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    super.beforeHookedMethod(param);
                    Log.e("gamea", "param:" + param.args[2]);
                }

                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    super.afterHookedMethod(param);
                    Log.e("gamea", ":" + param.getResult());
                    param.setResult(null);
                }
            });
        }
    } catch (Exception e) {
        e.printStackTrace();
    }

若是华为手机,手机上装有gms,还需要屏蔽PackageManager的“com.google.android.gms”查找
在这个app 中的位置是

com.google.android.gms.common.GoogleApiAvailability.isGoogleGmsAvailability();
上一篇下一篇

猜你喜欢

热点阅读