0x01 前言

演示APK: 计算器(cale.apk)
测试平台: Win7 64
反编译工具: APK改之理3.5

对新手来说，这个APK改之理还是不错了，都是一键搞定，虽然网上说重新编译会添加一些信息，那可以在找到修改处后用另一种反编译工具修改

0x02 收集信息并定位

1. 提示信息：免费版用户 定位到 br.smali 1.jpg
2. 查看AndroidManifaset.xml文件，得到包名与主活动xwj.calculator.MainActivityFree

0x03 关键函数分析

注释全写在代码中

# instance fields
// SkinsActivity a;
.field final synthetic a:Lxwj/calculator/SkinsActivity;

// 重载方法
# virtual methods
// public void handleMessage(Message msg)
.method public handleMessage(Landroid/os/Message;)V
    .locals 4

    // v3 = 0
    const/4 v3, 0x0
    
    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    // ProgressDialog v0 = SkinsActivity.a(this.a);
    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;

    move-result-object v0

    // if(v0 == 0) {goto cond_0};
    if-eqz v0, :cond_0

    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    // ProgressDialog v0 = SkinsActivity.a(this.a);
    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;

    move-result-object v0

    // Boolean v0 = v0.isShowing()
    invoke-virtual {v0}, Landroid/app/ProgressDialog;->isShowing()Z

    move-result v0

    // if(v0 == 0) {goto cond_0};
    if-eqz v0, :cond_0

    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    // ProgressDialog v0 = SkinsActivity.a(this.a);
    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;

    move-result-object v0

    // void v0 = v0.dismiss()
    invoke-virtual {v0}, Landroid/app/ProgressDialog;->dismiss()V

    /*
        以上代码意思:
        1. 判断信息框是否存存
        2. 存在则再次使用isShowing方法判断是否存在
        3. 存在则关闭信息框
    */
    
    :cond_0
    // int v0 = msg
    iget v0, p1, Landroid/os/Message;->what:I

    // if(v0 != 0) {goto cond_1;
    // 对于handleMessage函数是Android的消息处理函数，本人暂时没学到，所以不明白这些意思，无法翻译，见谅
    if-nez v0, :cond_1

    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    // int v0 = SkinsActivity.b(this.a)
    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->b(Lxwj/calculator/SkinsActivity;)I

    move-result v0

    const/16 v1, 0x32

    // if(v0 >= 0x32) {goto cond_3}
    if-ge v0, v1, :cond_3

    // 消息框AlertDialog，看下面的字符串不用多说了，弹出一个消息框
    new-instance v0, Landroid/app/AlertDialog$Builder;

    iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-direct {v0, v1}, Landroid/app/AlertDialog$Builder;-><init>(Landroid/content/Context;)V

    // String v1 = "需要激活"
    const-string v1, "\u9700\u8981\u6fc0\u6d3b"

    // 我把多余的删了，直观点
    ......

    invoke-virtual {v0}, Landroid/app/AlertDialog$Builder;->show()Landroid/app/AlertDialog;

    :cond_1
    // 看到goto我就感觉看到了循环
    :goto_0
    iget v0, p1, Landroid/os/Message;->what:I

    const/4 v1, 0x1

    // if(msg != 1) {goto cond_5}
    if-ne v0, v1, :cond_5

    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;

    move-result-object v0

    // String v0 = SkinsActivity.c(this.a).v0.m()
    invoke-virtual {v0}, Lxwj/calculator/s;->m()Ljava/lang/String;

    move-result-object v0

    if(v0 != null) {goto cond_4}
    if-nez v0, :cond_4

    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    // s v0 = SkinsActivity.c(this.a)
    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;

    move-result-object v0

    // 创建一个StringBuilder实例，与下面invoke_direct配套
    new-instance v1, Ljava/lang/StringBuilder;

    iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v2}, Lxwj/calculator/SkinsActivity;->d(Lxwj/calculator/SkinsActivity;)I

    move-result v2

    invoke-static {v2}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

    move-result-object v2

    // StringBuilder v1 = new StringBuilder(String.valueOf(SkinsActivity.d(this.a)))
    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    String v1 = v1.toString();
    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    // v0.b(v1)
    invoke-virtual {v0, v1}, Lxwj/calculator/s;->b(Ljava/lang/String;)V

    :goto_1
    // 激活成功，下面不再解释了
    new-instance v0, Lxwj/calculator/ce;

    invoke-direct {v0}, Lxwj/calculator/ce;-><init>()V

    iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v2}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;

    move-result-object v2

    invoke-virtual {v0, v1, v2}, Lxwj/calculator/ce;->a(Landroid/app/Activity;Lxwj/calculator/s;)V

    new-instance v0, Landroid/app/AlertDialog$Builder;

    iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-direct {v0, v1}, Landroid/app/AlertDialog$Builder;-><init>(Landroid/content/Context;)V

    // String v1 = "您已成功激活本皮肤。感谢您的支持！"
    const-string v1, "\u60a8\u5df2\u6210\u529f\u6fc0\u6d3b\u672c\u76ae\u80a4\u3002\u611f\u8c22\u60a8\u7684\u652f\u6301\uff01"

    invoke-virtual {v0, v1}, Landroid/app/AlertDialog$Builder;->setMessage(Ljava/lang/CharSequence;)Landroid/app/AlertDialog$Builder;

    move-result-object v0

    const-string v1, "\u597d\u7684"

    invoke-virtual {v0, v1, v3}, Landroid/app/AlertDialog$Builder;->setPositiveButton(Ljava/lang/CharSequence;Landroid/content/DialogInterface$OnClickListener;)Landroid/app/AlertDialog$Builder;

    move-result-object v0

    invoke-virtual {v0}, Landroid/app/AlertDialog$Builder;->show()Landroid/app/AlertDialog;

    :cond_2
    :goto_2
    return-void

    :cond_3
    ......
    goto/16 :goto_0

    :cond_4
    ......
    goto/16 :goto_1

    :cond_5
    ......
    goto/16 :goto_2
.end method

修改方法:

1. 把不要的代码全删除，仅保留 消息框的判断语句 与 成功语句
2. 把cond_4中的代码提升到cond_0下面，这样就变成了流水线，不再跳来跳去

# virtual methods
.method public handleMessage(Landroid/os/Message;)V
    .locals 4

    const/4 v3, 0x0

    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;

    move-result-object v0

    if-eqz v0, :cond_0

    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;

    move-result-object v0

    invoke-virtual {v0}, Landroid/app/ProgressDialog;->isShowing()Z

    move-result v0

    if-eqz v0, :cond_0

    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->a(Lxwj/calculator/SkinsActivity;)Landroid/app/ProgressDialog;

    move-result-object v0

    invoke-virtual {v0}, Landroid/app/ProgressDialog;->dismiss()V

    :cond_0
    
    iget-object v0, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v0}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;

    move-result-object v0

    new-instance v1, Ljava/lang/StringBuilder;

    iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v2}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;

    move-result-object v2

    invoke-virtual {v2}, Lxwj/calculator/s;->m()Ljava/lang/String;

    move-result-object v2

    invoke-static {v2}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

    move-result-object v2

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    const-string v2, ","

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v2}, Lxwj/calculator/SkinsActivity;->d(Lxwj/calculator/SkinsActivity;)I

    move-result v2

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-virtual {v0, v1}, Lxwj/calculator/s;->b(Ljava/lang/String;)V

    new-instance v0, Lxwj/calculator/ce;

    invoke-direct {v0}, Lxwj/calculator/ce;-><init>()V

    iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    iget-object v2, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-static {v2}, Lxwj/calculator/SkinsActivity;->c(Lxwj/calculator/SkinsActivity;)Lxwj/calculator/s;

    move-result-object v2

    invoke-virtual {v0, v1, v2}, Lxwj/calculator/ce;->a(Landroid/app/Activity;Lxwj/calculator/s;)V

    new-instance v0, Landroid/app/AlertDialog$Builder;

    iget-object v1, p0, Lxwj/calculator/br;->a:Lxwj/calculator/SkinsActivity;

    invoke-direct {v0, v1}, Landroid/app/AlertDialog$Builder;-><init>(Landroid/content/Context;)V

    const-string v1, "\u60a8\u5df2\u6210\u529f\u6fc0\u6d3b\u672c\u76ae\u80a4\u3002\u611f\u8c22\u60a8\u7684\u652f\u6301\uff01"

    invoke-virtual {v0, v1}, Landroid/app/AlertDialog$Builder;->setMessage(Ljava/lang/CharSequence;)Landroid/app/AlertDialog$Builder;

    move-result-object v0

    const-string v1, "\u597d\u7684"

    invoke-virtual {v0, v1, v3}, Landroid/app/AlertDialog$Builder;->setPositiveButton(Ljava/lang/CharSequence;Landroid/content/DialogInterface$OnClickListener;)Landroid/app/AlertDialog$Builder;

    move-result-object v0

    invoke-virtual {v0}, Landroid/app/AlertDialog$Builder;->show()Landroid/app/AlertDialog;

    return-void

.end method

0x04 使用工具查看源代码

当0x03章smali分析完后，大体源代码可以浮现出来了
当对smali有一定了解后，就可以使用现成工具直接查看源代码，如JD-GUI

2.png