论坛 › 北京 › 破解某交(y)友(p)app的VIP&&半自动im设备人

qzmjef 发表于 2024-8-22 15:38:24

破解某交(y)友(p)app的VIP&&半自动im设备人

    <h2 style="color: black; text-align: left; margin-bottom: 10px;">案例</h2>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">就不放了，某交(y)友(p)app</p>
    <h2 style="color: black; text-align: left; margin-bottom: 10px;">致谢</h2>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">Youpk</span><span style="color: black;">环信IM文档</span>hanbing&amp;&amp;r0ysue</p>
    <h2 style="color: black; text-align: left; margin-bottom: 10px;">加固简单分析</h2>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">拿到app就先拿到jadx中分析，<span style="color: black;">发掘</span>这是360加壳。<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9D8w24I9QOuER0yicM6WqTURRKypoTWHgsYHSHQbU6Sd6zIN1SzII0JBw/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">这是时候<span style="color: black;">咱们</span>就要祭出脱壳神奇Youpk
      Youpk的操作文档<span style="color: black;">详细</span><span style="color: black;">能够</span>看Youpk的github，再次感谢Youpk。<span style="color: black;">咱们</span>在吧修复好的dex放在jadx中分析。修复的很给力，<span style="color: black;">亦</span><span style="color: black;">能够</span>看出源代码基本<span style="color: black;">无</span>混淆，这就更利于<span style="color: black;">咱们</span>的分析了。<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DFIfkS6uIzdOqMdKKulNPmJt2MYXoyp5OfUxQba1fExJEKsDo8vannQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p>
    <h2 style="color: black; text-align: left; margin-bottom: 10px;">破解VIP</h2>利用Xposed/Frida破解
    <span style="color: black;">咱们</span><span style="color: black;">首要</span>打开这个app，在主页点到一个人-&gt;进去，点击私信，<span style="color: black;">发掘</span>要开通会员才<span style="color: black;">能够</span>呢。<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DrdrkzfMpFHsiaBG16Fsp0ucLNrlB4CV1kX2stJwV5tmr4WAeIaPc9Vg/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"><span style="color: black;">此时</span>候就<span style="color: black;">能够</span> 祭出搜索大法。打开jadx-全局搜索这个关键词“<span style="color: black;">作为</span>会员”。<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DaC8zxJnEbxwrom8w3rqLRhNfWEkhUvopJriaP2DbkEeEdib7N2ibiasVPw/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"><span style="color: black;">这儿</span><span style="color: black;">能够</span>看到有两个相同的。进入<span style="color: black;">瞧瞧</span>看。<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DyhcXyybN5agPNxVLEq2IfN8VibbQW9ibMZFJEsxKhOGudzJrcEPe8Msg/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">这两处都是，<span style="color: black;">咱们</span>分析一下这两处。<span style="color: black;">第1</span>处<span style="color: black;"> else if (this.isVip &lt;= 1) {</span><span style="color: black;">new CommomDialog(this, R.style.dialog, true, "<span style="color: black;">作为</span>会员<span style="color: black;">才可</span>私聊哦！", new CommomDialog.OnCloseListener() {</span><span style="color: black;"> /* class com.**.**.main.user.UserInfoActivity.AnonymousClass6 */</span><span style="color: black;">/* JADX WARN: Type inference failed for: r0v0, types: */</span><span style="color: black;"> @Override // com.**.**.widget.dialog.CommomDialog.OnCloseListener</span><span style="color: black;">public void onClick(Dialog dialog, boolean z) {</span><span style="color: black;"> if (z) {</span><span style="color: black;"> UserInfoActivity.this.startActivity(new Intent((Context) UserInfoActivity.this, MembersActivity.class));</span><span style="color: black;"> dialog.dismiss();</span><span style="color: black;"> }</span><span style="color: black;"> }</span><span style="color: black;">}).setTitle("温馨提示").setPositiveButton("开通会员").show();</span><span style="color: black;"> return;</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">else if 里面的this.isVip<span style="color: black;">仅有</span><span style="color: black;">少于</span>1才会进入，<span style="color: black;">亦</span><span style="color: black;">便是</span>提示让你开通会员。</p>第二处<span style="color: black;"> if (this.isVip &gt; 1) {</span><span style="color: black;">Intent intent = new Intent((Context) this, (Class&lt;?&gt;) ChatActivity.class);</span><span style="color: black;"> intent.putExtra(UserCacheInfo.COLUMNNAME_USERIDIMID, this.user_id);</span><span style="color: black;">intent.putExtra("userId", this.user_imid);</span><span style="color: black;"> startActivity(intent);</span><span style="color: black;"> return;</span><span style="color: black;"> }</span><span style="color: black;"> new CommomDialog(this, R.style.dialog, true, "<span style="color: black;">作为</span>会员<span style="color: black;">才可</span>私聊哦！", new CommomDialog.OnCloseListener() {</span><span style="color: black;">/* class com.**.**.main.user.UserInfoActivity.AnonymousClass8 */</span><span style="color: black;">/* JADX WARN: Type inference failed for: r0v0, types: */</span><span style="color: black;"> @Override // com.u**.**.widget.dialog.CommomDialog.OnCloseListener</span><span style="color: black;"> public void onClick(Dialog dialog, boolean z) {</span><span style="color: black;"> if (z) {</span><span style="color: black;">UserInfoActivity.this.startActivity(new Intent((Context) UserInfoActivity.this, MembersActivity.class));</span><span style="color: black;"> dialog.dismiss();</span><span style="color: black;"> }</span><span style="color: black;"> }</span><span style="color: black;">}).setTitle("温馨提示").setPositiveButton("开通会员").show();</span><span style="color: black;"> return;</span><span style="color: black;"> }</span><span style="color: black;"> return;</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">这儿</span><span style="color: black;">能够</span>看到this.isVip 大于1的话就会提示“开通会员了呢”</p>最后
    其实只要进入到this.isVip大于1那不就，，，，嘿嘿嘿
    继续分析一下这个isVip是在哪里赋值呢。<span style="color: black;">查询</span>用例。。。。。<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DwrqFazcSKKUElx8AibfrphOSt4BlxJgiamTH6rIyLSnevzdeAnF0cVYw/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">找到啦。。<span style="color: black;">咱们</span>改下返回值<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DL3Bod818icYshGUu52ZWvGQPyuYgj9dK6GO7Ox9vnSBDibEB6eAxnnrw/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"><span style="color: black;">咱们</span><span style="color: black;">这儿</span>frida改一下。献上代码
    <span style="color: black;">这儿</span>还会有个小问题，<span style="color: black;">便是</span>这块类没在内存加载的时候会报错，<span style="color: black;">此时</span>候点下某人的主页就好了。<span style="color: black;">Java.perform(function () {</span><span style="color: black;">var pre = Java.use("com.***.***.utils.UncleSharedPreferences");</span><span style="color: black;"> pre.getInt.overload(android.content.Context, java.lang.String).implementation = function (a1, a2) {</span><span style="color: black;"> return 2;</span><span style="color: black;"> }</span><span style="color: black;">})</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">瞧瞧</span>效果。。。<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DSmwTLsk6m3hJUpQRK4b6F0ObKOnPrRqPNzRXPBfBiaZRcuAFUk9TvpQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">发过去了。。。<span style="color: black;">然则</span><span style="color: black;">咱们</span>需要<span style="color: black;">始终</span>用的话就要一个xposed的插件。<span style="color: black;">这儿</span>app采用的360加固，那<span style="color: black;">咱们</span>就<span style="color: black;">不可</span>用常规的classloader进行hook，直接用360壳的classloader进行hook。</p><span style="color: black;">XposedHelpers.findAndHookMethod("com.stub.StubApp", loadPackageParam.classLoader, "attachBaseContext", Context.class, new XC_MethodHook() {</span><span style="color: black;"> @Override</span><span style="color: black;"> protected void afterHookedMethod(MethodHookParam param) throws Throwable {</span><span style="color: black;">super.afterHookedMethod(param);</span><span style="color: black;"> Context context = (Context) param.args;</span><span style="color: black;"> ClassLoader classLoader = context.getClassLoader();</span><span style="color: black;"> classLoaders = classLoader;</span><span style="color: black;">XposedHelpers.findAndHookMethod("com.***.***.utils.UncleSharedPreferences", classLoader, "getInt", Context.class, String.class, new XC_MethodHook() {</span><span style="color: black;">@Override</span><span style="color: black;"> protected void afterHookedMethod(MethodHookParam param) throws Throwable {</span><span style="color: black;"> //设置返回值为2</span><span style="color: black;"> param.setResult(2);</span><span style="color: black;"> }</span><span style="color: black;"> });</span><span style="color: black;">XposedHelpers.findAndHookMethod("com.***.***.utils.DateUtil", classLoader, "getDayDiff", Date.class, Date.class, new XC_MethodHook() {</span><span style="color: black;"> @Override</span><span style="color: black;">protected void afterHookedMethod(MethodHookParam param) throws Throwable {</span><span style="color: black;"> param.setResult(0L);</span><span style="color: black;"> }</span><span style="color: black;"> });</span><span style="color: black;"> }</span><span style="color: black;"> });</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">好了完美。。。私聊小姐姐（****）们</p>暗坑
    最后<span style="color: black;">发掘</span><span style="color: black;">她们</span>有个体验会员，到期<span style="color: black;">便是</span>放弃（退出）<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9D4YSTbPibDlfURfekHZs3T5TibzPBRib2ZYwVbctAXKZyRG4heacfajFgg/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">那还能咋办，继续分析
    搜索大法<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DSXgEMwibfkywP6YkIVBiaUWMKibWmKxpFn1r3n4jOXFTK616jEvQXy7LQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"><span style="color: black;">这儿</span>的if都是&amp;&amp;，一真则真，一假则假。前边几个看着<span style="color: black;">欠好</span>搞，就dayDiff入手，改他返回值，<span style="color: black;">少于</span>3就行了。<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9Dw2MBpcgoEFnRsyaILoUaGppHH6qvj0T0Iicng4YgA9dDv3iaLTuPetbw/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">代码就不放了。小结
    这个vip的破解还是很简单的那种。。。这块其实<span style="color: black;">能够</span><span style="color: black;">经过</span>拦截请求的方式更改数据包，将vip字段设置一下，没<span style="color: black;">详细</span>分析。<h2 style="color: black; text-align: left; margin-bottom: 10px;">聊天IM&amp;&amp;半自动im<span style="color: black;">设备</span>人</h2>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">按照</span>com.hyphenate.chat.EMMessage<span style="color: black;">能够</span>得到这是环信的im聊天，那就很简单了。两种方式实现发<span style="color: black;">信息</span>：</p>1.<span style="color: black;">运用</span>环信sdk，逆向该app的inti环境的<span style="color: black;">有些</span>配置信息，完成发<span style="color: black;">信息</span>。2<span style="color: black;">运用</span>app本身的<span style="color: black;">信息</span>发送<span style="color: black;">办法</span>，用frida<span style="color: black;">或</span>xposed主动调用。<span style="color: black;">这儿</span><span style="color: black;">因为</span><span style="color: black;">无</span>pythonSdk，<span style="color: black;">因此</span>采用第二种。<h3 style="color: black; text-align: left; margin-bottom: 10px;">分析<span style="color: black;">信息</span>发送</h3>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">这儿</span><span style="color: black;">咱们</span>上ddms和环信的文档，分析它的调用<span style="color: black;">状况</span>。文档如下</p><span style="color: black;">发送文本<span style="color: black;">信息</span></span><span style="color: black;">//创建一条文本<span style="color: black;">信息</span>，content为<span style="color: black;">信息</span>文字内容，toChatUsername为对方用户<span style="color: black;">或</span>群聊的id，后文皆是如此</span><span style="color: black;">EMMessage message = EMMessage.createTxtSendMessage(content, toChatUsername);</span><span style="color: black;">//<span style="color: black;">倘若</span>是群聊，设置chattype，默认是单聊</span><span style="color: black;">if (chatType == CHATTYPE_GROUP)</span><span style="color: black;"> message.setChatType(ChatType.GroupChat);</span><span style="color: black;">//发送<span style="color: black;">信息</span></span><span style="color: black;">EMClient.getInstance().chatManager().sendMessage(message);</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">ddms如下<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DcTkicfnTgFic53MVrQfJMrFnso3awIoUwYj7EZWpg5sMAY5d7lGyxQcg/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">打开jadx分析这个类代码，<span style="color: black;">能够</span>看到如下<img src="https://mmbiz.qpic.cn/mmbiz_png/RQicOzqf0IHYzaUUuLgqPcP9NnSWjJZ9DWqZ2Lb5jypEwh5MIjCqpZm8N1ZwrR1XwRdvGIyDvTjVLQj31Z4cjrQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;">发送<span style="color: black;">信息</span>时候，创建了EMMessage.createTxtSendMessage，需要发送文本和对方的id。下面的代码是发送文本信息的</p><span style="color: black;"> if (this.chatFragmentHelper != null) {</span><span style="color: black;">this.chatFragmentHelper.onSetMessageAttributes(eMMessage);</span><span style="color: black;"> }</span><span style="color: black;"> if (this.chatType == 2) {</span><span style="color: black;"> eMMessage.setChatType(EMMessage.ChatType.GroupChat);</span><span style="color: black;"> } else if (this.chatType == 3) {</span><span style="color: black;">eMMessage.setChatType(EMMessage.ChatType.ChatRoom);</span><span style="color: black;"> }</span><span style="color: black;">EaseUser userInfo = EaseUserUtils.getUserInfo(eMMessage.getFrom(), UncleSharedPreferences.getString(SZApplication.getContext(), UncleSharedPreferences.SP_UID));</span><span style="color: black;"> eMMessage.setAttribute("avatar", userInfo.getAvatar());</span><span style="color: black;">eMMessage.setAttribute("gender", UncleSharedPreferences.getString(SZApplication.getContext(), UncleSharedPreferences.SP_USER_SEX));</span><span style="color: black;">eMMessage.setAttribute("name", userInfo.getNickname());</span><span style="color: black;"> eMMessage.setAttribute("token", UncleSharedPreferences.getString(SZApplication.getContext(), UncleSharedPreferences.SP_UID));</span><span style="color: black;">if (UserCacheManager.getImidFromCache(this.toChatUsername) != null) {</span><span style="color: black;"> eMMessage.setAttribute("tokenTo", UserCacheManager.getImidFromCache(this.toChatUsername).getUserId());</span><span style="color: black;">} else {</span><span style="color: black;"> eMMessage.setAttribute("tokenTo", "");</span><span style="color: black;"> }</span><span style="color: black;"> eMMessage.setAttribute("nameTo", eMMessage.getTo());</span><span style="color: black;">eMMessage.setAttribute("avatarTo", UncleSharedPreferences.getString(SZApplication.getContext(), UncleSharedPreferences.SP_TO_USER_AVATAR));</span><span style="color: black;"> EMClient.getInstance().chatManager().saveMessage(eMMessage);</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">晓得</span>上边的<span style="color: black;">咱们</span>就<span style="color: black;">能够</span>用frida玩玩。</p><span style="color: black;"> var to_user_id = 1000477560;</span><span style="color: black;"> var content = 我是一个<span style="color: black;">设备</span>人你信吗;</span><span style="color: black;"> var uid = 1000511189;</span><span style="color: black;"> var EMMessage = Java.use("com.hyphenate.chat.EMMessage");</span><span style="color: black;">var eMMessage = EMMessage.createTxtSendMessage(content, to_user_id);</span><span style="color: black;"> eMMessage.setAttribute("avatar", "http://***/android/pic/1591284964")//头像</span><span style="color: black;">eMMessage.setAttribute("gender", "1")</span><span style="color: black;"> eMMessage.setAttribute("name", "看123了看刻录机")</span><span style="color: black;"> eMMessage.setAttribute("token", uid)//自己uid</span><span style="color: black;">eMMessage.setAttribute("nameTo", to_user_id)//对方imid</span><span style="color: black;"> eMMessage.setAttribute("avatarTo", "")</span><span style="color: black;"> eMMessage.setAttribute("tokenTo", to_user_id)</span><span style="color: black;">var EMClient = Java.use("com.hyphenate.chat.EMClient");</span><span style="color: black;"> EMClient.getInstance().chatManager().saveMessage(eMMessage)</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="data:image/svg+xml,%3C%3Fxml version=1.0 encoding=UTF-8%3F%3E%3Csvg width=1px height=1px viewBox=0 0 1 1 version=1.1 xmlns=http://www.w3.org/2000/svg xmlns:xlink=http://www.w3.org/1999/xlink%3E%3Ctitle%3E%3C/title%3E%3Cg stroke=none stroke-width=1 fill=none fill-rule=evenodd fill-opacity=0%3E%3Cg transform=translate(-249.000000, -126.000000) fill=%23FFFFFF%3E%3Crect x=249 y=126 width=1 height=1%3E%3C/rect%3E%3C/g%3E%3C/g%3E%3C/svg%3E" style="width: 50%; margin-bottom: 20px;">发送之后，需要点进去聊天界面，才会发送过去，并且<span style="color: black;">倘若</span>这个app<span style="color: black;">无</span>缓存这个用户信息，就会闪退。</p>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;">处理</span>闪退</h3>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">继续ddms，点击私信。<img src="data:image/svg+xml,%3C%3Fxml version=1.0 encoding=UTF-8%3F%3E%3Csvg width=1px height=1px viewBox=0 0 1 1 version=1.1 xmlns=http://www.w3.org/2000/svg xmlns:xlink=http://www.w3.org/1999/xlink%3E%3Ctitle%3E%3C/title%3E%3Cg stroke=none stroke-width=1 fill=none fill-rule=evenodd fill-opacity=0%3E%3Cg transform=translate(-249.000000, -126.000000) fill=%23FFFFFF%3E%3Crect x=249 y=126 width=1 height=1%3E%3C/rect%3E%3C/g%3E%3C/g%3E%3C/svg%3E" style="width: 50%; margin-bottom: 20px;">搜索startAc，<span style="color: black;">能够</span>看到在UserInfoActivity下<img src="data:image/svg+xml,%3C%3Fxml version=1.0 encoding=UTF-8%3F%3E%3Csvg width=1px height=1px viewBox=0 0 1 1 version=1.1 xmlns=http://www.w3.org/2000/svg xmlns:xlink=http://www.w3.org/1999/xlink%3E%3Ctitle%3E%3C/title%3E%3Cg stroke=none stroke-width=1 fill=none fill-rule=evenodd fill-opacity=0%3E%3Cg transform=translate(-249.000000, -126.000000) fill=%23FFFFFF%3E%3Crect x=249 y=126 width=1 height=1%3E%3C/rect%3E%3C/g%3E%3C/g%3E%3C/svg%3E" style="width: 50%; margin-bottom: 20px;">分析到如下代码，<span style="color: black;">能够</span>很清楚到看到，<span style="color: black;">这儿</span>吧用户信息存起来了。<span style="color: black;">而后</span><span style="color: black;">起步</span>聊天的tActivity。</p><span style="color: black;"> UserCacheManager.save(this.user_id, this.user_imid, this.nickname, this.avatar);</span><span style="color: black;">EaseUser easeUser = new EaseUser(this.user_imid);</span><span style="color: black;"> easeUser.setAvatar(this.avatar);</span><span style="color: black;"> easeUser.setNickname(this.nickname);</span><span style="color: black;"> if (this.isVip &gt; 1) {</span><span style="color: black;">Intent intent = new Intent((Context) this, (Class&lt;?&gt;) ChatActivity.class);</span><span style="color: black;"> intent.putExtra(UserCacheInfo.COLUMNNAME_USERIDIMID, this.user_id);</span><span style="color: black;">intent.putExtra("userId", this.user_imid);</span><span style="color: black;"> startActivity(intent);</span><span style="color: black;"> return;</span><span style="color: black;"> }</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">这次用xposed实现发送<span style="color: black;">信息</span>和<span style="color: black;">起步</span>ui。</p><span style="color: black;"> Class EMMessage = XposedHelpers.findClass("com.hyphenate.chat.EMMessage", classLoaders);</span><span style="color: black;">Object eMMessage = XposedHelpers.callStaticMethod(EMMessage, "createTxtSendMessage", content, to_user_id);</span><span style="color: black;">XposedHelpers.callMethod(eMMessage, "setAttribute", "avatar", avatar);</span><span style="color: black;"> XposedHelpers.callMethod(eMMessage, "setAttribute", "gender", gender);</span><span style="color: black;">XposedHelpers.callMethod(eMMessage, "setAttribute", "name", name);</span><span style="color: black;"> XposedHelpers.callMethod(eMMessage, "setAttribute", "token", token);</span><span style="color: black;"> XposedHelpers.callMethod(eMMessage, "setAttribute", "nameTo", nameTo);</span><span style="color: black;">XposedHelpers.callMethod(eMMessage, "setAttribute", "avatarTo", avatarTo);</span><span style="color: black;"> XposedHelpers.callMethod(eMMessage, "setAttribute", "tokenTo", tokenTo);</span><span style="color: black;">Class EMClient = XposedHelpers.findClass("com.hyphenate.chat.EMClient", classLoaders);</span><span style="color: black;"> Object getInstance = XposedHelpers.callStaticMethod(EMClient, "getInstance");</span><span style="color: black;">Object chatManager = XposedHelpers.callMethod(getInstance, "chatManager");</span><span style="color: black;"> XposedHelpers.callMethod(chatManager, "saveMessage", eMMessage);</span><span style="color: black;">Class ChatActivity = XposedHelpers.findClass("com.***.***.main.im.ChatActivity", classLoaders);</span><span style="color: black;">Class UserCacheManager = XposedHelpers.findClass("com.***.***.main.im.cache.UserCacheManager", classLoaders);</span><span style="color: black;"> XposedHelpers.callStaticMethod(UserCacheManager, "save", to_user_id, to_user_id, to_user_id, avatar);</span><span style="color: black;">Class EaseUser = XposedHelpers.findClass("com.hyphenate.easeui.domain.EaseUser", classLoaders);</span><span style="color: black;">Object easeUsernewInstance = XposedHelpers.newInstance(EaseUser, to_user_id);</span><span style="color: black;"> XposedHelpers.callMethod(easeUsernewInstance, "setNickname", to_user_id);</span><span style="color: black;">XposedHelpers.callMethod(easeUsernewInstance, "setAvatar", avatar);</span><span style="color: black;"> Intent intentChat = new Intent(contexts, ChatActivity);</span><span style="color: black;"> intentChat.putExtra("userImId", to_user_id);</span><span style="color: black;"> intentChat.putExtra("userId", to_user_id);</span><span style="color: black;">contexts.startActivity(intentChat);</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">这就基本完<span style="color: black;">成为了</span>。</p>
    <h2 style="color: black; text-align: left; margin-bottom: 10px;">效果展示</h2>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">最后借助NanoHTTPD做了web接口。看下效果</p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">gif传不上来，戳原文看效果吧。</p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="data:image/svg+xml,%3C%3Fxml version=1.0 encoding=UTF-8%3F%3E%3Csvg width=1px height=1px viewBox=0 0 1 1 version=1.1 xmlns=http://www.w3.org/2000/svg xmlns:xlink=http://www.w3.org/1999/xlink%3E%3Ctitle%3E%3C/title%3E%3Cg stroke=none stroke-width=1 fill=none fill-rule=evenodd fill-opacity=0%3E%3Cg transform=translate(-249.000000, -126.000000) fill=%23FFFFFF%3E%3Crect x=249 y=126 width=1 height=1%3E%3C/rect%3E%3C/g%3E%3C/g%3E%3C/svg%3E" style="width: 50%; margin-bottom: 20px;"></p>
    <h2 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><span style="color: black;">‍</span><span style="color: black;">‍</span></span>总结</h2>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">这个app比较简单，虽然360加壳，<span style="color: black;">然则</span><span style="color: black;">经过</span>youpk脱壳之后，<span style="color: black;">发掘</span>基本没混淆。文中是借助ddms分析调用<span style="color: black;">状况</span>。这个<span style="color: black;">能够</span>继续扩展到，hook接收<span style="color: black;">信息</span>，收到<span style="color: black;">信息</span>之后，自动回复信息。接口在com.<strong style="color: blue;">.</strong>.SZHelper$9.onMessageReceived上，以后有时间再分析写出来。</p>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;">参考资料</span></h3><span style="color: black;"><span style="color: black;"></span>
      <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">Youpk: https://github.com/Youlor/Youpk</p>
    </span><span style="color: black;"><span style="color: black;"></span>
      <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">环信IM文档: http://docs-im.easemob.com/im/android/basics/message</p>
    </span>

nykek5i 发表于 2024-10-3 23:21:24

你的话语如春风拂面，温暖了我的心房，真的很感谢。

4lqedz 发表于 2024-10-20 08:30:16

你的见解独到，让我受益匪浅，非常感谢。

qzmjef 发表于 2024-10-31 01:24:58

seo常来的论坛，希望我的网站快点收录。

4lqedz 发表于 2024-11-7 22:36:27

seo常来的论坛，希望我的网站快点收录。

查看完整版本: 破解某交(y)友(p)app的VIP&&半自动im设备人