1、叉叉加速器分析

2014/04/08 android 共 12384 字,约 36 分钟

2、叉叉加速器为全局通用,只要打开了加速器效果的游戏,无论用哪种方式启动,加速悬浮窗始终会显示。

在叉叉助手的“更多”-“叉叉加速器”里设置:

img

float_window_small.xml:

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout android:orientation="vertical" android:background="#00ffffff" android:layout_width="48.0dip" android:layout_height="48.0dip" xmlns:android="http://schemas.android.com/apk/res/android">
  <LinearLayout android:orientation="vertical" android:id="@id/small_window_layout" android:background="@drawable/gamespeed_bg_float_window_normal" android:layout_width="48.0dip" android:layout_height="48.0dip" />
</LinearLayout>

gamespeed_bg_float_window.xml:

<?xml version="1.0" encoding="utf-8"?>
<selector xmlns:android="http://schemas.android.com/apk/res/android">
  <item android:state_pressed="false" android:drawable="@drawable/gamespeed_bg_float_window_normal" />
  <item android:state_pressed="true" android:drawable="@drawable/gamespeed_bg_float_window_press" />
</selector>

img

float_window_big.xml:

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout android:gravity="bottom" android:layout_gravity="center" android:orientation="vertical" android:background="#00ffffff" android:layout_width="fill_parent" android:layout_height="fill_parent"
  xmlns:android="http://schemas.android.com/apk/res/android">
    <LinearLayout android:layout_gravity="center" android:orientation="vertical" android:id="@id/big_window_layout" android:background="#00ffffff" android:layout_width="fill_parent" android:layout_height="fill_parent" />
    <ImageView android:id="@id/setting_close" android:background="@drawable/gamespeed_bg_close" android:clickable="true" android:layout_width="fill_parent" android:layout_height="20.0dip" />
    <RelativeLayout android:layout_gravity="center" android:orientation="vertical" android:id="@id/big_window_layout_content" android:background="@drawable/gamespeed_bg_setting" android:layout_width="fill_parent" android:layout_height="60.0dip">
        <ImageView android:id="@id/setting_edit_params_bg" android:background="@drawable/gamespeed_bt_params" android:clickable="true" android:layout_width="90.0dip" android:layout_height="37.0dip" android:layout_centerInParent="true" /> bc
<TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="." android:layout_centerInParent="true" />
        <TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params_left" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="0" android:layout_toLeftOf="@id/setting_edit_params" android:layout_centerInParent="true" />
        <TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params_right" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="0" android:layout_toRightOf="@id/setting_edit_params" android:layout_centerInParent="true" />
        <ImageView android:id="@id/setting_sub_params" android:background="@drawable/gamespeed_bt_sub_params" android:clickable="true" android:layout_width="35.0dip" android:layout_height="35.0dip" android:layout_marginRight="10.0dip" android:layout_toLeftOf="@id/setting_edit_params_bg" android:layout_centerVertical="true" />
        <ImageView android:id="@id/setting_add_params" android:background="@drawable/gamespeed_bt_add_params" android:clickable="true" android:layout_width="35.0dip" android:layout_height="35.0dip" android:layout_marginLeft="10.0dip" android:layout_toRightOf="@id/setting_edit_params_bg" android:layout_centerVertical="true" />
        <ImageView android:id="@id/setting_byte_params" android:background="@drawable/gamespeed_bg_params_left" android:clickable="true" android:layout_width="145.0dip" android:layout_height="7.0dip" android:layout_marginRight="10.0dip" android:layout_below="@id/setting_edit_params_bg" android:layout_centerHorizontal="true" android:layout_centerVertical="true" />
        <ImageView android:id="@id/exit_button" android:background="@drawable/gamespeed_bt_exit" android:clickable="true" android:layout_width="50.0dip" android:layout_height="30.0dip" android:layout_marginLeft="10.0dip" android:layout_centerVertical="true" />
        <ImageView android:id="@id/setting_switch" android:background="@drawable/gamespeed_bt_switch_start" android:clickable="true" android:layout_width="50.0dip" android:layout_height="30.0dip" android:layout_marginRight="10.0dip" android:layout_alignParentRight="true" android:layout_centerVertical="true" />
        <ImageView android:id="@id/setting_byte_tip_center" android:layout_width="1.0dip" android:layout_height="10.0dip" android:layout_marginBottom="13.0dip" android:layout_alignParentBottom="true" android:layout_centerInParent="true" android:layout_centerVertical="true" />
        <ImageView android:id="@id/setting_byte_tip_left" android:background="@drawable/gamespeed_bg_byte_tip" android:clickable="true" android:layout_width="10.0dip" android:layout_height="10.0dip" android:layout_alignRight="@id/setting_edit_params_left" android:layout_alignBottom="@id/setting_add_params" />
        <ImageView android:id="@id/setting_byte_tip_right" android:background="@drawable/gamespeed_bg_byte_tip" android:visibility="invisible" android:clickable="true" android:layout_width="10.0dip" android:layout_height="10.0dip" android:layout_alignLeft="@id/setting_edit_params_right" android:layout_alignTop="@id/setting_byte_tip_left" />
    </RelativeLayout>
</LinearLayout>

gamespeed_bt_switch_start.xml:

<?xml version="1.0" encoding="utf-8"?>
<selector xmlns:android="http://schemas.android.com/apk/res/android">
    <item android:state_pressed="false" android:drawable="@drawable/gamespeed_bt_setting_switch_start_normal" />
    <item android:state_pressed="true" android:drawable="@drawable/gamespeed_bt_setting_switch_start_press" />
</selector>

img

 <public type="layout" name="float_window_big" id="0x7f030017" />
 <public type="layout" name="float_window_small" id="0x7f030018" />
package com.xxAssistant.GameSpeed;

import android.content.Context;
import android.content.res.Resources;
import android.view.LayoutInflater;
import android.view.ViewGroup.LayoutParams;
import android.view.WindowManager;
import android.view.WindowManager.LayoutParams;
import android.widget.LinearLayout;
import java.lang.reflect.Field;

public class FloatWindowSmallView extends LinearLayout
{
  public static int a;
  public static int b;
  private static int d;
  public LinearLayout c;
  private WindowManager e;
  private WindowManager.LayoutParams f;

  public FloatWindowSmallView(Context paramContext)
  {
    super(paramContext);
    this.e = ((WindowManager)paramContext.getSystemService("window"));
    LayoutInflater.from(paramContext).inflate(2130903064, this);
    this.c = ((LinearLayout)findViewById(2131427400));
    a = this.c.getLayoutParams().width;
    b = this.c.getLayoutParams().height;
  }

  private int getStatusBarHeight()
  {
    if (d == 0);
    try
    {
      Class localClass = Class.forName("com.android.internal.R$dimen");
      Object localObject = localClass.newInstance();
      int i = ((Integer)localClass.getField("status_bar_height").get(localObject)).intValue();
      d = getResources().getDimensionPixelSize(i);
      return d;
    }
    catch (Exception localException)
    {
      while (true)
        localException.printStackTrace();
    }
  }

  public void setParams(WindowManager.LayoutParams paramLayoutParams)
  {
    this.f = paramLayoutParams;
  }
}

其中:2130903064 = 0x7F030018

<public type="id" name="setting_switch" id="0x7f0b0044" />

2131427396

img

img

package com.xxAssistant.GameSpeed;

import android.view.View;
import android.view.View.OnClickListener;
import android.widget.ImageView;

class FloatWindowBigView$1
  implements View.OnClickListener
{
  public void onClick(View paramView)
  {
    if (FloatWindowBigView.f == 0)
    {
      this.a.setTimeScale(FloatWindowBigView.h);
      FloatWindowBigView.e.setBackgroundResource(2130837574);
      FloatWindowBigView.f = 1;
      return;
    }
    this.a.setTimeScale(0.0F);
    FloatWindowBigView.e.setBackgroundResource(2130837573);
    FloatWindowBigView.f = 0;
  }
}

FloatWindowBigView.java:

static
{
    g = false;
    System.loadLibrary("xxspeedmanager");
    h = 0.0F;
    i = 0;
}

public void setTimeScale(float paramFloat)
{
    int i1 = (int)Arith.c(paramFloat, 10.0F);
    if (i1 >= 0);
    for (int i2 = 1000 + i1 * 100; ; i2 = 10000 / (10 + -i1))
    {
        setTimeScale(i2);
        return;
    }
}

打开libxxspeedmanager.so分析:

Java_com_xxAssistant_GameSpeed_FloatWindowBigView_setTimeScale 00001778   

img

img

xx_clock_gettime

xx_clock_gettime   000012CC P
xx_clock_gettime_ptr 00004F88 
xx_gettimeofday    000014C4 P
xx_gettimeofday_ptr  00004F80 
xx_speed_manager_init 000015F0 P

MSHookFunction_ptr 00004FDC
MSHookFunction   000010DC 
XXJavaHookClassLoad    000010D0
XXJavaHookClassLoad_ptr  00004FD8
XXJavaHookMethod      0000107C
XXJavaHookMethod_ptr    00004FBC
XXSuperPathClassLoader   00001088
XXSuperPathClassLoader_ptr 00004FC0 

/data/data/com.xxAssistant/xx-filter/assistant.json
/data/data/com.xxAssistant/xx-filter/speed.conf
/data/data/com.xxAssistant/xx-filter/speedm.json

assistant.json打开有加密

speed.conf:

/data/app/com.xxAssistant-1.apk

speedm.json打开有加密

/data/app/com.xxAssistant-1.apk

MSHookFunction比较可疑,搜索一下发现:MobileSubstrate

MobileSubstrate是一个公共库,可以用来动态替换内存中的代码、数据等。

库文件存在:

com.xxAssistant\lib\armeabi\libsubstrate.so

package com.xxAssistant.GameSpeed;

import android.app.Activity;
import android.content.Context;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.res.Resources;
import android.util.DisplayMetrics;
import android.view.Display;
import android.view.ViewGroup;
import android.view.WindowManager;
import android.widget.AbsoluteLayout;
import android.widget.AbsoluteLayout.LayoutParams;
import android.widget.FrameLayout.LayoutParams;
import java.lang.reflect.Field;

public class GameSpeedView
{
  public static ViewGroup a;
  public static Activity b;
  public static Activity c;
  public static Context d;
  public static Context e;
  public static int f = 0;
  public static int g = 0;
  public static int h;
  public static int i;
  public static int j;
  public static int k;
  public static float m;
  public static FloatWindowSmallView n;
  public static FloatWindowBigView o;
  public static GameSpeedView p;
  private static int s = 0;
  private static int t = 0;
  int l = 0;
  private int q = 0;
  private int r = 0;
  private boolean u = false;

  public GameSpeedView(Context paramContext)
  {
    DisplayMetrics localDisplayMetrics = new DisplayMetrics();
    c.getWindowManager().getDefaultDisplay().getMetrics(localDisplayMetrics);
    f = c.getWindowManager().getDefaultDisplay().getWidth();
    g = c.getWindowManager().getDefaultDisplay().getHeight();
    c.getWindowManager().getDefaultDisplay().getMetrics(localDisplayMetrics);
    m = localDisplayMetrics.density;
  }

  private void c()
  {
    if (a == null)
    {
      a = new AbsoluteLayout(c);
      a.isClickable();
      FrameLayout.LayoutParams localLayoutParams = new FrameLayout.LayoutParams(-1, -1);
      c.addContentView(a, localLayoutParams);
      d();
    }
  }

  private void d()
  {
    int i3;
    int i4;
    label79: AbsoluteLayout.LayoutParams localLayoutParams1;
    if ((n == null) && (o == null))
    {
      n = new FloatWindowSmallView(e);
      o = new FloatWindowBigView(e);
      int i1 = (int)(48.0F * m * m);
      int i2 = (int)(48.0F * m);
      if (j == 0)
        break label208;
      i3 = j;
      if (k == 0)
        break label223;
      i4 = k;
      localLayoutParams1 = new AbsoluteLayout.LayoutParams(i1, i2, i3, i4);
      if (f >= 360.0F * m)
        break label233;
    }
    label208: label223: label233: for (int i5 = f; ; i5 = (int)(360.0F * m))
    {
      AbsoluteLayout.LayoutParams localLayoutParams2 = new AbsoluteLayout.LayoutParams(i5, (int)(80.0F * m), f / 2 - i5 / 2, g - (int)(80.0F * m));
      n.setLayoutParams(localLayoutParams1);
      o.setLayoutParams(localLayoutParams2);
      o.setVisibility(8);
      a.addView(n);
      a.addView(o);
      a.setOnTouchListener(new GameSpeedView.1(this));
      return;
      i3 = f - (int)(48.0F * m);
      break;
      i4 = g / 2;
      break label79;
    }
  }

  private int e()
  {
    if (this.l == 0);
    try
    {
      Class localClass = Class.forName("com.android.internal.R$dimen");
      Object localObject = localClass.newInstance();
      int i1 = ((Integer)localClass.getField("status_bar_height").get(localObject)).intValue();
      this.l = e.getResources().getDimensionPixelSize(i1);
      return this.l;
    }
    catch (Exception localException)
    {
      while (true)
        localException.printStackTrace();
    }
  }

  public static void init(Activity paramActivity)
  {
    if (paramActivity.isChild())
      return;
    if (e == null);
    try
    {
      e = paramActivity.createPackageContext("com.xxAssistant", 3);
      d = paramActivity.getApplicationContext();
      c = paramActivity;
      if (paramActivity != b)
      {
        if (a != null)
        {
          a.removeAllViews();
          a = null;
        }
        b = paramActivity;
      }
      if (p == null)
      {
        localGameSpeedView = new GameSpeedView(d);
        p = localGameSpeedView;
        p.c();
        return;
      }
    }
    catch (PackageManager.NameNotFoundException localNameNotFoundException)
    {
      while (true)
      {
        localNameNotFoundException.printStackTrace();
        continue;
        GameSpeedView localGameSpeedView = p;
      }
    }
  }
}

adb pull /data/data/com.xxAssistant/shared_prefs/gameSpeedSetting.xml e:\

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map><boolean name="gamespeed_com.babeltime.fknsango_360" value="true" />
    <boolean name="gamespeed_com.DefiantDev.SkiSafari" value="true" />
</map>

文档信息

Search

    Table of Contents