xposed 小实战

1. 经典贪吃蛇大作战
   关键字符串：支付取消

//zombie.class  11,Lcom/qy/zombie/zombie;->DX_Pay(Ljava/util/HashMap;)V+4h,,
public static void DX_Pay(HashMap arg3) {
    new AlertDialog$Builder(zombie.activity);
    EgamePay.pay(zombie.activity, ((Map)arg3), new EgamePayListener() {
        public void payCancel(Map arg4) {
            Toast.makeText(zombie.activity, "支付取消", 0).show();
            zombie.BuyFailed();
        }

        public void payFailed(Map arg4, int arg5) {
            Toast.makeText(zombie.activity, "支付失败" + arg5, 0).show();
            zombie.BuyFailed();
        }

        public void paySuccess(Map arg4) {
            Toast.makeText(zombie.activity, "支付成功", 0).show();
            zombie.BuySccess();
        }
    });
}

逻辑：payCancel 函数 payFailed 函数 都换成 paySuccess
通过androidkiller发现 这几个函数在类：com/qy/zombie/zombie$3 下

2. 单机斗地主
   支付宝购买关键字： 9000 （0x2328）
   全局搜索

//com/alipay/sdk/app/j
    public static j a(int arg1) {
        j v0;
        switch(arg1) {
            case 4001: {
                v0 = j.e;
                break;
            }
            case 5000: {
                v0 = j.f;
                break;
            }
            case 6001: {
                v0 = j.c;
                break;
            }
            case 6002: {
                v0 = j.d;
                break;
            }
            case 8000: {
                v0 = j.g;
                break;
            }
            case 9000: {
                v0 = j.a;
                break;
            }
            default: {
                v0 = j.b;
                break;
            }
        }

        return v0;
    }

修改此函数的参数为9000

3. 街机捕鱼达人 同上 com/alipay/sdk/app/i

// 代码：

package com.example.xposedplugin;

import android.os.Message;

import java.util.Map;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

public class XposedInit implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
XposedBridge.log(“当前启动的应用程序是：”+loadPackageParam.packageName);

    if(loadPackageParam.packageName.equals("com.yunhaoge.tanchishe.egame")){
        XposedHelpers.findAndHookMethod("com.qy.zombie.zombie$3", loadPackageParam.classLoader, "payCancel", Map.class,
                new XC_MethodReplacement() {
                    @Override
                    protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                        XposedHelpers.callMethod(methodHookParam.thisObject,"paySuccess",methodHookParam.args);
                        return null;
                    }
                });
        XposedHelpers.findAndHookMethod("com.qy.zombie.zombie$3", loadPackageParam.classLoader, "payFailed", Map.class,
                new XC_MethodReplacement() {
                    @Override
                    protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                        XposedHelpers.callMethod(methodHookParam.thisObject,"paySuccess",methodHookParam.args);
                        return null;
                    }
                });
    }

    if (loadPackageParam.packageName.equals("com.june.game.doudizhu")){
        XposedHelpers.findAndHookMethod("com.alipay.sdk.app.j", loadPackageParam.classLoader, "a", int.class, new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                XposedBridge.log("Str参数：" + param.args[0]);
                param.args[0] = 9000;
                XposedBridge.log("修改后参数："+param.args[0]);
            }
        });
    }


    if (loadPackageParam.packageName.equals("com.prgame5.fish2.baidu")){

        XposedHelpers.findAndHookMethod("com.alipay.sdk.app.i", loadPackageParam.classLoader, "a", int.class, new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                XposedBridge.log("Str参数：" + param.args[0]);
                param.args[0] = 9000;
                XposedBridge.log("修改后参数："+param.args[0]);
            }
        });
    }

}

}