2026-09-11 04:36:55 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文详细记录了作者对某安卓游戏内购的逆向破解过程，使用jadx、算法助手Pro、MT管理器等工具分析支付流程，定位关键类与方法，并通过XposedHook技术重写支付方法、伪造订单号，最终实现内购破解。文章提供了完整Hook代码与操作步骤，属于实战经验分享，但作者也声明仅用于技术研究，禁止非法商业用途。 综合评分： 75 文章分类： 逆向分析,实战经验,安全工具

安卓逆向 — 某游戏内购破解

无聊的味道无聊的味道

逆向有你

2026年9月10日 09:26 河南

在小说阅读器读本章

去阅读

在公众号小说中沉浸阅读

本项目的初衷是研究Hook技术与游戏引擎的交互逻辑，请勿将其用于非法盈利等任何商业用途，所有下载的附件请在的24小时内自行删除。

应用名称：TWDX cingline版本：2.7.74.00下载：https://www.taptap.cn/app/31429所需工具：jadx/JEB，算法助手Pro，MT管理器

开始前的碎碎念：虽然已经看了很多教程和实战案例，但是无奈lz还是太菜了+只学过一点点java(≈0)，不是在各种方法和java机制里跳来跳去被绕晕，就是混淆的看都不想看，今天心血来潮分析了下童年游戏，发现不是很复杂而且没有混淆，最后成功破解

正式流程1.打开游戏，随便点击一个需要付费的道具，发现有一个确认弹窗和购买按钮。

2.打开算法助手Pro，勾选跳舞的线，启用onClick监听和弹窗定位，接着再去触发一下弹窗和购买，返回找到日志

3.回调类是com.cmplay.dancingline.ui.PayConfirmDialog，用jadx打开，定位到onClick，这里的C0588R.id.payconfirm_btn_payonlaythird(2131231494)就是确认按钮的资源id，所以我们直接进入payThird看看

4.payThird有联网校验和防沉迷，而且isBoolAntiAddiction()是强制返回true的，不会走下面的payAgent.pay，但是这样就很麻烦了，因为checkPayLimit会从服务端获取最高充值金额并且有很多校验，绕了一大圈才会回来，所以需要Hook isBoolAntiAddiction()强制返回false从而更轻松地Hook

进到payAgent.pay方法，发现是空方法，用mt管理器搜一下方法重写，找到一个：com.cmcm.cmplay.pay.TaptapPay类里的pay方法，点进去，有一个支付中…的弹窗，最后一行就是调起微信支付

再追进去就是发送服务器请求和调起微信支付了，具体后面的回调逻辑和流程如下

支付成功后紧接着调用SendProductBuy方法与Unity通信分发道具，传入参数为100(成功)，s1:商品 ID(mProductId)，s2:oid + “##” + 16，

其中oid为订单号，参与后续分发函数，感觉需要找出来，万一后续会再次校验格式且是Native方法，幸运的是wechatsdk有打印日志，通过算法助手的logcat捕获，抓到了订单号格式：177158*******-***************（13位时间戳+15位随机数字）

最后道具分发函数，参数s3格式：[商品ID]#SEPARATOR#[oid]##16##[商品ID]

逻辑搞清了，接下来只用写Hook就行，需要Hook isBoolAntiAddiction() 防-防沉迷和重写 TapTapPay 里的 pay 方法，把最后一行换成支付成功的回调，oid伪造一下就行PS:感觉可以通过查询商品ID然后构造s3，强行调用UnityPlayer.UnitySendMessage(“Nativeutil”, “onChannelBuySucessed”, s3)从而实现任意道具补给

Hook代码：

package com.dancingline.Hook;
import&nbsp;de.robv.android.xposed.IXposedHookLoadPackage;import&nbsp;de.robv.android.xposed.XC_MethodHook;import&nbsp;de.robv.android.xposed.XC_MethodReplacement;import&nbsp;de.robv.android.xposed.XposedBridge;import&nbsp;de.robv.android.xposed.XposedHelpers;import&nbsp;de.robv.android.xposed.callbacks.XC_LoadPackage;

public&nbsp;class&nbsp;MainHook&nbsp;implements&nbsp;IXposedHookLoadPackage&nbsp;{&nbsp; &nbsp;&nbsp;@Override&nbsp; &nbsp;&nbsp;public&nbsp;void&nbsp;handleLoadPackage(XC_LoadPackage.LoadPackageParam&nbsp;lpparam) throws&nbsp;Throwable&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!lpparam.packageName.equals("com.cmplay.dancingline"))&nbsp;return;
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedHelpers.findAndHookMethod( &nbsp; &nbsp;//防-防沉迷&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"com.cmplay.dancingline.util.AntiAddictionKitUtil",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lpparam.classLoader,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"isBoolAntiAddiction",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XC_MethodReplacement.returnConstant(false)&nbsp; &nbsp; &nbsp; &nbsp; );
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedHelpers.findAndHookMethod(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"com.cmcm.cmplay.pay.TaptapPay",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lpparam.classLoader,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"pay",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String.class,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String.class,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"com.cmcm.cmplay.pay.PayCallBack",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;new&nbsp;XC_MethodReplacement() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;@Override&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;protected&nbsp;Object&nbsp;replaceHookedMethod(MethodHookParam&nbsp;param) throws&nbsp;Throwable&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;processPaySurgery(param);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;null;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; );&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;private&nbsp;void&nbsp;processPaySurgery(XC_MethodHook.MethodHookParam&nbsp;param){ &nbsp; &nbsp;//pay方法重写&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedBridge.log("[DL-Hook] 开始执行支付重定向...");
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Object&nbsp;thisObject = param.thisObject;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;userid = (String) param.args[0];&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;productid = (String) param.args[1];&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Object&nbsp;callback = param.args[2];
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedHelpers.setObjectField(thisObject,"mUserid", userid);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedHelpers.callMethod(thisObject,"setPayCallBack",callback);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedHelpers.setObjectField(thisObject,"mProducid", productid);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedBridge.log("[DL-Hook] 已设置变量");
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;oid =&nbsp;generateFakeOid();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedBridge.log("[DL-Hook] 订单号已伪造: "&nbsp;+ oid);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Object&nbsp;progressDialog =&nbsp;XposedHelpers.getObjectField(thisObject,&nbsp;"mProgressDialog");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(progressDialog !=&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedHelpers.callMethod(progressDialog,&nbsp;"dismiss");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedBridge.log("[DL-Hook] 等待弹窗已关闭");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(Throwable&nbsp;t) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedHelpers.callMethod(thisObject,&nbsp;"callbackSucceed", productid, oid); &nbsp; &nbsp;//支付成功回调
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedBridge.log("[DL-Hook] 重定向完成:)"); &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(Throwable&nbsp;e){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;XposedBridge.log("[DL-Hook] ERROR: "&nbsp;+ e);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;private&nbsp;String&nbsp;generateFakeOid() { &nbsp;//伪造oid&nbsp; &nbsp; &nbsp; &nbsp; long timestamp =&nbsp;System.currentTimeMillis();
&nbsp; &nbsp; &nbsp; &nbsp; long randomPart = (long) (Math.random() * 900_000_000_000_000L) + 100_000_000_000_000L;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;timestamp +&nbsp;"-"&nbsp;+ randomPart;&nbsp; &nbsp; }}

安装测试，点击确认购买按钮后直接成功，跳过弹窗和支付

总结：第一次真正成功逆向了一个应用(虽然代码问了问ai,XD)，学到了很多东西和工具的使用方法，果然在论坛里没白学习{:301_987:}有错误望请大佬指出

·今日推荐·

| | | | — | — | | | |

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：逆向有你无聊的味道无聊的味道《安卓逆向 — 某游戏内购破解》