破解内购小游戏《倒霉熊奇幻大冒险》

老论坛搬家

今 天再上一个破解的小游戏，
       方法不同于上个帖子，但同样也是跟着大神的脚步，复制代码，
   
                           这里还是要强调一下，，支持正版！！！！
     废话就不说了；上图


   
   


扔进Android killer
     ,搜“失败”   ，得出以下结果

  ，进入第一条看一下
       发现是支付成功失败跳转，这里我用复制代码，我先把支付成功、支付失败的代码列出来
  成功：
  [Java] [color=rgb(51, 102, 153) !important]纯文本查看 [color=rgb(51, 102, 153) !important]复制代码
[backcolor=rgb(27, 36, 38) !important][color=white !important][color=white !important]?
[table][tr][td]01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
[/td][td].method public static success()V    .locals 4

    .prologue
    .line 155
    sget-object v0, Ljava/lang/System;->outjava/io/PrintStream;

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "\u652f\u4ed8\u6210\u529f  payIndex="

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;->(Ljava/lang/String;)V

    sget v2, Lcom/bear/UnLuckBear/MainActivity;->payIndex:I

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    const-string v2, "   payRuntimeScript="

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    sget-object v2, Lcom/bear/UnLuckBear/MainActivity;->payRuntimeScriptjava/lang/String;

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-virtual {v0, v1}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V

    .line 156
    const-string v0, "UnLuckyBearController"

    sget-object v1, Lcom/bear/UnLuckBear/MainActivity;->payRuntimeScriptjava/lang/String;

    new-instance v2, Ljava/lang/StringBuilder;

    sget v3, Lcom/bear/UnLuckBear/MainActivity;->payIndex:I

    invoke-static {v3}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

    move-result-object v3

    invoke-direct {v2, v3}, Ljava/lang/StringBuilder;->(Ljava/lang/String;)V

    invoke-virtual {v2}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v2

    invoke-static {v0, v1, v2}, Lcom/unity3d/player/UnityPlayer;->UnitySendMessage(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V

    .line 157
    return-void
.end method






失败：
.method public static fail()V
    .locals 4

    .prologue
    .line 160
    sget-object v0, Ljava/lang/System;->outjava/io/PrintStream;

    new-instance v1, Ljava/lang/StringBuilder;

    const-string v2, "\u652f\u4ed8\u5931\u8d25  payIndex="

    invoke-direct {v1, v2}, Ljava/lang/StringBuilder;->(Ljava/lang/String;)V

    sget v2, Lcom/bear/UnLuckBear/MainActivity;->payIndex:I

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v1

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-virtual {v0, v1}, Ljava/io/PrintStream;->println(Ljava/lang/String;)V

    .line 161
    const-string v0, "UnLuckyBearController"

    const-string v1, "failCallBack"

    new-instance v2, Ljava/lang/StringBuilder;

    sget v3, Lcom/bear/UnLuckBear/MainActivity;->payIndex:I

    invoke-static {v3}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

    move-result-object v3

    invoke-direct {v2, v3}, Ljava/lang/StringBuilder;->(Ljava/lang/String;)V

    invoke-virtual {v2}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v2

    invoke-static {v0, v1, v2}, Lcom/unity3d/player/UnityPlayer;->UnitySendMessage(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V

    .line 162
    return-void
.end method

  这里把成功的代码，复制到失败的，就可以达到无论支付成功失败最后结果都是成功的目的。

点击购买，然后点叉号会触发购买失败的条件，因为我们改了失败，所以所有的结果都是成功。
   
   

      好了，破解成功，
      传送门：https://pan.baidu.com/s/1brdcLyf   密码：60w5