熊大快跑免费充值版

这里我们需要hook的是支付宝的充值功能，这里用算法助手抓取弹窗

所以在支付界面选择支付宝

弹窗之后进算法助手查看日志

根据这个信息找到com.xiaomi.gamecenter.sdk.ui.paylistactivity

这里应该是生成支付订单列表信息的

找到关键函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
public void onItemClick(AdapterView<?> adapterView, View view, int i, long j) {
        if (PatchProxy.proxy(new Object[]{adapterView, view, new Integer(i), new Long(j)}, this, changeQuickRedirect, false, 1239, new Class[]{AdapterView.class, View.class, Integer.TYPE, Long.TYPE}, Void.TYPE).isSupported || HyUtils.m28911c()) {
            return;
        }
        ServiceToken m28103a = ServiceToken.m28103a();
        if (m28103a == null) {
            m28345a(-1, "ServiceToken is NULL");
            return;
        }
        PaytypeModel paytypeModel = (PaytypeModel) adapterView.getItemAtPosition(i);
        this.f25579k.setVisibility(8);
        OrderPurchase m28354b = m28354b();
        int i2 = C58248.f25599a[paytypeModel.getPayType().ordinal()];
        if (i2 == 1) {
            Logger.m27794d(Logger.DEF_TAG, "用户选择ALI支付");
            DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(ReportCode.f24713e).eventType(OneTrackParams.OneTrackEventType.EVENT_PAY).orderId(this.f25572d.getCpOrderId()).fuid(m28103a.m28114d()).build());
            HyDJ.m27570a().m27573b(this, m28354b, new InterfaceC5751a() { // from class: com.xiaomi.gamecenter.sdk.ui.PayListActivity.2
                public static ChangeQuickRedirect changeQuickRedirect;

                @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.InterfaceC5751a
                /* renamed from: a */
                public void mo27578a(int i3, String str) {
                    OneTrackNumBean.Builder builder;
                    int i4;
                    if (PatchProxy.proxy(new Object[]{new Integer(i3), str}, this, changeQuickRedirect, false, 1260, new Class[]{Integer.TYPE, String.class}, Void.TYPE).isSupported) {
                        return;
                    }
                    if (i3 == 185) {
                        builder = new OneTrackNumBean.Builder();
                        i4 = ReportCode.f24729u;
                    } else {
                        builder = new OneTrackNumBean.Builder();
                        i4 = ReportCode.f24728t;
                    }
                    DataCollectFactory.trackNum(builder.num(i4).eventType(OneTrackParams.OneTrackEventType.EVENT_PAY).build());
                    PayListActivity.m28348a(PayListActivity.this, i3, str);
                }

                @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.InterfaceC5751a
                /* renamed from: a */
                public void mo27579a(String str) {
                    if (PatchProxy.proxy(new Object[]{str}, this, changeQuickRedirect, false, 1261, new Class[]{String.class}, Void.TYPE).isSupported) {
                        return;
                    }
                    DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(ReportCode.f24727s).eventType(OneTrackParams.OneTrackEventType.EVENT_PAY).build());
                    PayListActivity.m28349a(PayListActivity.this, str);
                }
            });
        } else {
            if (i2 != 2) {
                return;
            }
            Logger.m27794d(Logger.DEF_TAG, "用户选择WX支付");
            DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(ReportCode.f24714f).eventType(OneTrackParams.OneTrackEventType.EVENT_PAY).orderId(this.f25572d.getCpOrderId()).fuid(m28103a.m28114d()).build());
            HyDJ.m27570a().m27572a(this, m28354b, new InterfaceC5751a() { // from class: com.xiaomi.gamecenter.sdk.ui.PayListActivity.3
                public static ChangeQuickRedirect changeQuickRedirect;

                @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.InterfaceC5751a
                /* renamed from: a */
                public void mo27578a(int i3, String str) {
                    OneTrackNumBean.Builder builder;
                    int i4;
                    if (PatchProxy.proxy(new Object[]{new Integer(i3), str}, this, changeQuickRedirect, false, 1262, new Class[]{Integer.TYPE, String.class}, Void.TYPE).isSupported) {
                        return;
                    }
                    if (i3 == 185) {
                        builder = new OneTrackNumBean.Builder();
                        i4 = ReportCode.f24726r;
                    } else {
                        builder = new OneTrackNumBean.Builder();
                        i4 = ReportCode.f24725q;
                    }
                    DataCollectFactory.trackNum(builder.num(i4).eventType(OneTrackParams.OneTrackEventType.EVENT_PAY).build());
                    PayListActivity.m28348a(PayListActivity.this, i3, str);
                }

                @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.InterfaceC5751a
                /* renamed from: a */
                public void mo27579a(String str) {
                    if (PatchProxy.proxy(new Object[]{str}, this, changeQuickRedirect, false, 1263, new Class[]{String.class}, Void.TYPE).isSupported) {
                        return;
                    }
                    DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(ReportCode.f24724p).eventType(OneTrackParams.OneTrackEventType.EVENT_PAY).build());
                    PayListActivity.m28349a(PayListActivity.this, str);
                }
            });
        }
    }

这里通过函数名就能大概猜测是用户在按下

这两个键位所走的两个分支

下一层逻辑主要在

1
HyDJ.m27570a().m27573b(this, m28354b, new InterfaceC5751a()

后面的代码是在进行支付成功和失败的分支

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
 				public static ChangeQuickRedirect changeQuickRedirect;

                @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.InterfaceC5751a
                /* renamed from: a */
                public void mo27578a(int i3, String str) {
                    OneTrackNumBean.Builder builder;
                    int i4;
                    if (PatchProxy.proxy(new Object[]{new Integer(i3), str}, this, changeQuickRedirect, false, 1260, new Class[]{Integer.TYPE, String.class}, Void.TYPE).isSupported) {
                        return;
                    }
                    if (i3 == 185) {
                        builder = new OneTrackNumBean.Builder();
                        i4 = ReportCode.f24729u;
                    } else {
                        builder = new OneTrackNumBean.Builder();
                        i4 = ReportCode.f24728t;
                    }
                    DataCollectFactory.trackNum(builder.num(i4).eventType(OneTrackParams.OneTrackEventType.EVENT_PAY).build());
                    PayListActivity.m28348a(PayListActivity.this, i3, str);
                }

                @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.InterfaceC5751a
                /* renamed from: a */
                public void mo27579a(String str) {
                    if (PatchProxy.proxy(new Object[]{str}, this, changeQuickRedirect, false, 1261, new Class[]{String.class}, Void.TYPE).isSupported) {
                        return;
                    }
                    DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(ReportCode.f24727s).eventType(OneTrackParams.OneTrackEventType.EVENT_PAY).build());
                    PayListActivity.m28349a(PayListActivity.this, str);
}

接着下一步分析HyDJ

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
package com.xiaomi.gamecenter.sdk.p504hy.dj;

import android.app.Activity;
import android.content.Context;
import android.content.Intent;
import android.os.Bundle;
import com.xiaomi.gamecenter.sdk.p504hy.dj.http.RestClient;
import com.xiaomi.gamecenter.sdk.p504hy.dj.model.AppInfo;
import com.xiaomi.gamecenter.sdk.p504hy.dj.model.CallModel;
import com.xiaomi.gamecenter.sdk.p504hy.dj.purchase.Purchase;
import com.xiaomi.gamecenter.sdk.robust.ChangeQuickRedirect;
import com.xiaomi.gamecenter.sdk.robust.PatchProxy;
import com.xiaomi.gamecenter.sdk.robust.PatchProxyResult;

/* loaded from: classes.dex */
public class HyDJ {

    /* renamed from: c */
    private static volatile HyDJ f24259c;
    public static ChangeQuickRedirect changeQuickRedirect;

    /* renamed from: a */
    private String f24260a;

    /* renamed from: b */
    private String f24261b;

    /* renamed from: d */
    private Context f24262d;

    public HyDJ(Context context, String str, String str2) {
        this.f24260a = str;
        this.f24261b = str2;
        this.f24262d = context;
        RestClient.m27609a(context);
    }

    /* renamed from: a */
    public static HyDJ m27570a() {
        PatchProxyResult proxy = PatchProxy.proxy(new Object[0], null, changeQuickRedirect, true, 689, new Class[0], HyDJ.class);
        if (proxy.isSupported) {
            return (HyDJ) proxy.result;
        }
        if (f24259c != null) {
            return f24259c;
        }
        throw new IllegalStateException("please HyDJ.init() in application before use this method");
    }

    /* renamed from: a */
    public static void m27571a(Context context, String str, String str2) {
        if (!PatchProxy.proxy(new Object[]{context, str, str2}, null, changeQuickRedirect, true, 688, new Class[]{Context.class, String.class, String.class}, Void.TYPE).isSupported && f24259c == null) {
            f24259c = new HyDJ(context, str, str2);
        }
    }

    /* renamed from: a */
    public void m27572a(Activity activity, Purchase purchase, InterfaceC5751a interfaceC5751a) {
        if (PatchProxy.proxy(new Object[]{activity, purchase, interfaceC5751a}, this, changeQuickRedirect, false, 690, new Class[]{Activity.class, Purchase.class, InterfaceC5751a.class}, Void.TYPE).isSupported) {
            return;
        }
        Intent intent = new Intent(activity, (Class<?>) HyDjActivity.class);
        AppInfo appInfo = new AppInfo();
        appInfo.m27617a(this.f24260a);
        appInfo.m27620b(this.f24261b);
        appInfo.m27616a(CallModel.m27624a(interfaceC5751a));
        appInfo.m27615a(1);
        Bundle bundle = new Bundle();
        bundle.putSerializable("_appinfo", appInfo);
        bundle.putSerializable("_purchase", purchase);
        intent.putExtra("_bundle", bundle);
        activity.startActivity(intent);
    }

    /* renamed from: b */
    public void m27573b(Activity activity, Purchase purchase, InterfaceC5751a interfaceC5751a) {
        if (PatchProxy.proxy(new Object[]{activity, purchase, interfaceC5751a}, this, changeQuickRedirect, false, 691, new Class[]{Activity.class, Purchase.class, InterfaceC5751a.class}, Void.TYPE).isSupported) {
            return;
        }
        Intent intent = new Intent(activity, (Class<?>) HyDjActivity.class);
        AppInfo appInfo = new AppInfo();
        appInfo.m27617a(this.f24260a);
        appInfo.m27620b(this.f24261b);
        appInfo.m27616a(CallModel.m27624a(interfaceC5751a));
        appInfo.m27615a(2);
        Bundle bundle = new Bundle();
        bundle.putSerializable("_appinfo", appInfo);
        bundle.putSerializable("_purchase", purchase);
        intent.putExtra("_bundle", bundle);
        activity.startActivity(intent);
    }
}

m27573b走的是支付宝支付

m27572a走的是微信支付

两个代码的逻辑其实都很简单，都是对订单信息进行打包，然后把信息传给HyDjActivity

接着进一步分析HyDjActivity

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
package com.xiaomi.gamecenter.sdk.p504hy.dj;

import android.R;
import android.app.Activity;
import android.app.FragmentTransaction;
import android.os.Bundle;
import com.xiaomi.gamecenter.sdk.log.Logger;
import com.xiaomi.gamecenter.sdk.p504hy.dj.config.ResultCode;
import com.xiaomi.gamecenter.sdk.p504hy.dj.fragment.HyAlipayFragment;
import com.xiaomi.gamecenter.sdk.p504hy.dj.fragment.HyQQWapFragment;
import com.xiaomi.gamecenter.sdk.p504hy.dj.fragment.HyWxScanFragment;
import com.xiaomi.gamecenter.sdk.p504hy.dj.fragment.HyWxWapFragment;
import com.xiaomi.gamecenter.sdk.p504hy.dj.model.AppInfo;
import com.xiaomi.gamecenter.sdk.robust.ChangeQuickRedirect;
import com.xiaomi.gamecenter.sdk.robust.PatchProxy;
import com.xiaomi.gamecenter.sdk.statistics.DataCollectFactory;
import com.xiaomi.gamecenter.sdk.statistics.OneTrackNumBean;
import com.xiaomi.gamecenter.sdk.utils.HyUtils;

/* loaded from: classes.dex */
public class HyDjActivity extends Activity {
    public static ChangeQuickRedirect changeQuickRedirect;

    /* renamed from: a */
    private Bundle f24263a;

    /* renamed from: a */
    private void m27574a() {
        if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, 693, new Class[0], Void.TYPE).isSupported) {
            return;
        }
        DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(176).build());
        FragmentTransaction beginTransaction = getFragmentManager().beginTransaction();
        HyWxScanFragment hyWxScanFragment = new HyWxScanFragment();
        hyWxScanFragment.setArguments(this.f24263a);
        beginTransaction.add(R.id.content, hyWxScanFragment, HyWxScanFragment.f24339d);
        beginTransaction.commit();
    }

    /* renamed from: b */
    private void m27575b() {
        if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, 694, new Class[0], Void.TYPE).isSupported) {
            return;
        }
        Logger.m27794d(Logger.DEF_TAG, "开启WX支付页面");
        DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(172).build());
        FragmentTransaction beginTransaction = getFragmentManager().beginTransaction();
        HyWxWapFragment hyWxWapFragment = new HyWxWapFragment();
        hyWxWapFragment.setArguments(this.f24263a);
        beginTransaction.add(R.id.content, hyWxWapFragment, HyWxWapFragment.f24345d);
        beginTransaction.commit();
    }

    /* renamed from: c */
    private void m27576c() {
        if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, 695, new Class[0], Void.TYPE).isSupported) {
            return;
        }
        Logger.m27794d(Logger.DEF_TAG, "开启ALI支付页面");
        DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(ResultCode.f24284j).build());
        FragmentTransaction beginTransaction = getFragmentManager().beginTransaction();
        HyAlipayFragment hyAlipayFragment = new HyAlipayFragment();
        hyAlipayFragment.setArguments(this.f24263a);
        beginTransaction.add(R.id.content, hyAlipayFragment, HyAlipayFragment.f24312d);
        beginTransaction.commit();
    }

    /* renamed from: d */
    private void m27577d() {
        if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, 696, new Class[0], Void.TYPE).isSupported) {
            return;
        }
        DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(ResultCode.f24296v).build());
        FragmentTransaction beginTransaction = getFragmentManager().beginTransaction();
        HyQQWapFragment hyQQWapFragment = new HyQQWapFragment();
        hyQQWapFragment.setArguments(this.f24263a);
        beginTransaction.add(R.id.content, hyQQWapFragment, HyQQWapFragment.f24319d);
        beginTransaction.commit();
    }

    @Override // android.app.Activity
    public void onCreate(Bundle bundle) {
        if (PatchProxy.proxy(new Object[]{bundle}, this, changeQuickRedirect, false, 692, new Class[]{Bundle.class}, Void.TYPE).isSupported) {
            return;
        }
        super.onCreate(bundle);
        Bundle bundleExtra = getIntent().getBundleExtra("_bundle");
        this.f24263a = bundleExtra;
        if (bundleExtra == null) {
            finish();
            return;
        }
        AppInfo appInfo = (AppInfo) bundleExtra.getSerializable("_appinfo");
        int m27622d = appInfo.m27622d();
        if (m27622d != 1) {
            if (m27622d == 2) {
                appInfo.m27618a(new String[]{"ALIPAY"});
                this.f24263a.putSerializable("_appinfo", appInfo);
                m27576c();
                return;
            }
            return;
        }
        if (!HyUtils.m28907a(this) || HyUtils.m28919j(this) <= 570556416) {
            appInfo.m27618a(new String[]{"WXNATIVE"});
            this.f24263a.putSerializable("_appinfo", appInfo);
            m27574a();
        } else {
            appInfo.m27618a(HyUtils.m28920k(this) ? new String[]{"WXMWEB", "WXAPP"} : new String[]{"WXMWEB"});
            this.f24263a.putSerializable("_appinfo", appInfo);
            m27575b();
        }
    }
}

根据程序的关键词可以找到

1
2
3
4
5
6
7
8
9
10
11
12
13
private void m27576c() {
       if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, 695, new Class[0], Void.TYPE).isSupported) {
           return;
       }
       Logger.m27794d(Logger.DEF_TAG, "开启ALI支付页面");
       DataCollectFactory.trackNum(new OneTrackNumBean.Builder().num(ResultCode.f24284j).build());
       FragmentTransaction beginTransaction = getFragmentManager().beginTransaction();
       HyAlipayFragment hyAlipayFragment = new HyAlipayFragment();
       hyAlipayFragment.setArguments(this.f24263a);
       beginTransaction.add(R.id.content, hyAlipayFragment, HyAlipayFragment.f24312d);
       beginTransaction.commit();
   }

从这可以看出支付宝支付由 HyAlipayFragment 执行

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
package com.xiaomi.gamecenter.sdk.p504hy.dj.fragment;

import android.app.Activity;
import android.os.Bundle;
import com.bykv.p072vk.component.ttvideo.player.MediaPlayer;
import com.xiaomi.gamecenter.sdk.log.Logger;
import com.xiaomi.gamecenter.sdk.p504hy.dj.config.ResultCode;
import com.xiaomi.gamecenter.sdk.p504hy.dj.model.PayResult;
import com.xiaomi.gamecenter.sdk.robust.ChangeQuickRedirect;
import com.xiaomi.gamecenter.sdk.robust.PatchProxy;
import com.xiaomi.gamecenter.sdk.utils.ReporterUtils;

/* loaded from: classes.dex */
public class HyAlipayFragment extends BaseFragment {
    public static ChangeQuickRedirect changeQuickRedirect = null;

    /* renamed from: d */
    public static final String f24312d = "HyAlipayFragment";

    @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.fragment.BaseFragment, com.xiaomi.gamecenter.sdk.p504hy.dj.protocol.InterfaceC5765a
    /* renamed from: a */
    public void mo27587a(String str) {
        if (PatchProxy.proxy(new Object[]{str}, this, changeQuickRedirect, false, MediaPlayer.MEDIA_PLAYER_OPTION_SET_AVPH_AUTO_EXIT, new Class[]{String.class}, Void.TYPE).isSupported) {
            return;
        }
        Logger.m27794d(Logger.DEF_TAG, "ALI支付查询支付结果" + str);
        if (str.equals("TRADE_SUCCESS")) {
            Logger.m27794d(Logger.DEF_TAG, "ALI支付成功");
            ReporterUtils.getInstance().report(ResultCode.f24285k);
            m27590b(ResultCode.f24285k);
        }
    }

    @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.fragment.BaseFragment, com.xiaomi.gamecenter.sdk.p504hy.dj.protocol.InterfaceC5765a
    /* renamed from: a */
    public void mo27589a(final String str, final String str2, String str3) {
        if (PatchProxy.proxy(new Object[]{str, str2, str3}, this, changeQuickRedirect, false, MediaPlayer.MEDIA_PLAYER_OPTION_LIVE_AVPH_VIDEO_DIFF_THRESHOLD, new Class[]{String.class, String.class, String.class}, Void.TYPE).isSupported) {
            return;
        }
        Logger.m27796e(Logger.DEF_TAG, "准备支付宝支付中...payinfo = " + str2 + "referer" + str3);
        new Thread(new Runnable() { // from class: com.xiaomi.gamecenter.sdk.hy.dj.fragment.HyAlipayFragment.1
            public static ChangeQuickRedirect changeQuickRedirect;

            @Override // java.lang.Runnable
            public void run() {
                Activity activity;
                Runnable runnable;
                if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, MediaPlayer.MEDIA_PLAYER_OPTION_LIVE_AVPH_READ_RETRY_COUNT, new Class[0], Void.TYPE).isSupported) {
                    return;
                }
                try {
                    Class<?> cls = Class.forName("com.alipay.sdk.app.PayTask");
                    PayResult payResult = new PayResult((String) cls.getMethod("pay", String.class, Boolean.TYPE).invoke(cls.getConstructor(Activity.class).newInstance(HyAlipayFragment.this.getActivity()), str2, true));
                    String m27628a = payResult.m27628a();
                    Logger.m27794d(Logger.DEF_TAG, "ALI支付结果payResult = " + payResult.toString());
                    if (m27628a.equals("9000")) {
                        activity = HyAlipayFragment.this.getActivity();
                        runnable = new Runnable() { // from class: com.xiaomi.gamecenter.sdk.hy.dj.fragment.HyAlipayFragment.1.1
                            public static ChangeQuickRedirect changeQuickRedirect;

                            @Override // java.lang.Runnable
                            public void run() {
                                if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, MediaPlayer.MEDIA_PLAYER_OPTION_LIVE_AVPH_READ_ERROR_EXIT, new Class[0], Void.TYPE).isSupported) {
                                    return;
                                }
                                Logger.m27794d(Logger.DEF_TAG, "开始查询ALI支付结果");
                                HyAlipayFragment.this.f24304b.setMessage("正在查询支付结果...");
                                HyAlipayFragment.this.m27588a(str, 4000L, 1000L);
                            }
                        };
                    } else if (m27628a.equals("6001")) {
                        activity = HyAlipayFragment.this.getActivity();
                        runnable = new Runnable() { // from class: com.xiaomi.gamecenter.sdk.hy.dj.fragment.HyAlipayFragment.1.2
                            public static ChangeQuickRedirect changeQuickRedirect;

                            @Override // java.lang.Runnable
                            public void run() {
                                if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, 715, new Class[0], Void.TYPE).isSupported) {
                                    return;
                                }
                                ReporterUtils.getInstance().report(ResultCode.f24286l);
                                HyAlipayFragment.this.m27590b(185);
                            }
                        };
                    } else {
                        activity = HyAlipayFragment.this.getActivity();
                        runnable = new Runnable() { // from class: com.xiaomi.gamecenter.sdk.hy.dj.fragment.HyAlipayFragment.1.3
                            public static ChangeQuickRedirect changeQuickRedirect;

                            @Override // java.lang.Runnable
                            public void run() {
                                if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, 716, new Class[0], Void.TYPE).isSupported) {
                                    return;
                                }
                                ReporterUtils.getInstance().report(171);
                                HyAlipayFragment.this.m27590b(171);
                            }
                        };
                    }
                    activity.runOnUiThread(runnable);
                } catch (Exception e) {
                    Logger.m27796e("Exception", "请添加支付宝官方SDK相关的jar包");
                }
            }
        }).start();
    }

    @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.fragment.BaseFragment, android.app.Fragment
    public void onCreate(Bundle bundle) {
        if (PatchProxy.proxy(new Object[]{bundle}, this, changeQuickRedirect, false, MediaPlayer.MEDIA_PLAYER_OPTION_LIVE_AVPH_STREAM_INFO, new Class[]{Bundle.class}, Void.TYPE).isSupported) {
            return;
        }
        super.onCreate(bundle);
    }
}

从这个代码就可以看出主要的处理逻辑就在这里了

这几行代码可以看出，程序从com.alipay.sdk.app.PayTask中的pay中获取了一个值来存入payresult中

如果m27628a的值等于9000，那么才会开始查询ALI的支付结果

否则就会走失败分支，6001和其它值都是失败分支，

所以我们现在需要分析com.alipay.sdk.app.PayTask的pay函数，hook它的返回值，将返回值修改成9000来让程序认为支付已经成功

这里用frida来实现hook

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
function hookTest1(){
    let PayTask = Java.use("com.alipay.sdk.app.PayTask");
    PayTask["pay"].implementation = function (str, z) {
    console.log(`PayTask.pay is called: str=${str}, z=${z}`);
    let result = this["pay"](str, z);
    console.log(`PayTask.pay result=${result}`);
    return result;
};
}
function main(){
    Java.perform(function(){
        hookTest1();
        hookTest2();
    });
}
setImmediate(main);

得到pay所传入的数据和返回值

这里改resultStatus的值即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
function hookTest1(){
    let PayTask = Java.use("com.alipay.sdk.app.PayTask");
    PayTask["pay"].implementation = function (str, z) {
    console.log(`PayTask.pay is called: str=${str}, z=${z}`);
    let result = this["pay"](str, z);
    console.log(`PayTask.pay result=${result}`);
    result = "resultStatus={9000};memo={用户取消};result={}"
    console.log(`PayTask.pay result=${result}`);
    return result;
};
}
function main(){
    Java.perform(function(){
        hookTest1();
        hookTest2();
    });
}
setImmediate(main);

hook完之后，发现一直卡在查询订单信息这个界面

证明我们成功走到成功分支里面来了，应该是走到了

1
HyAlipayFragment.this.m27588a(str, 4000L, 1000L);

这一步，接着往后跟

1
2
3
4
5
6
public void onTick(long j3) {
                    if (PatchProxy.proxy(new Object[]{new Long(j3)}, this, changeQuickRedirect, false, 708, new Class[]{Long.TYPE}, Void.TYPE).isSupported) {
                        return;
                    }
                    BaseFragment.this.f24303a.m27634a();
                }
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
public void m27634a() {
        String str;
        String str2 = "";
        if (PatchProxy.proxy(new Object[0], this, changeQuickRedirect, false, 775, new Class[0], Void.TYPE).isSupported) {
            return;
        }
        Map<String, Object> m27612b = RestClient.m27612b(this.f24380b);
        m27612b.put("devAppId", this.f24381c);
        m27612b.put("openId", MiCommplatform.appInfo.getAccount().getUid());
        m27612b.put("orderId", this.f24386h);
        try {
            byte[] m27659a = AESEncryption.m27659a("38464B6C45486561724D415964687A61");
            String jSONObject = new JSONObject(m27612b).toString();
            Logger.m27794d(Logger.DEF_TAG, "查询订单信息入参 = " + jSONObject);
            str = URLBase64.m27697a(AESEncryption.m27661a(jSONObject, m27659a));
        } catch (Exception e) {
            str = "";
        }
        HashMap hashMap = new HashMap();
        ServiceToken m28105a = ServiceToken.m28105a(MiCommplatform.appInfo.getAppId());
        if (m28105a != null) {
            hashMap.put("session", m28105a.m28112b());
            hashMap.put("uid", m28105a.m28114d());
        }
        hashMap.put("p", str);
        try {
            String str3 = HyUtils.m27688a(hashMap) + "&uri=" + URLConfig.f24302b;
            Logger.m27794d("signString", str3);
            Logger.m27794d(C0780a.f1024t, this.f24382d);
            str2 = HmacSHA1Encryption.m28895a(str3, this.f24382d + "&key");
        } catch (Exception e2) {
        }
        hashMap.put(C5045d.f21243e, str2);
        RestClient.m27610a(URLConfig.m27581b(), hashMap, new RequestListener() { // from class: com.xiaomi.gamecenter.sdk.hy.dj.protocol.PayProtocol.2
            public static ChangeQuickRedirect changeQuickRedirect;

            @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.http.RequestListener
            /* renamed from: a */
            public void mo27605a(String str4) {
                if (PatchProxy.proxy(new Object[]{str4}, this, changeQuickRedirect, false, 778, new Class[]{String.class}, Void.TYPE).isSupported || PayProtocol.this.f24390l) {
                    return;
                }
                try {
                    String str5 = new String(URLBase64.m27698a(str4), "UTF-8");
                    Logger.m27794d("queryOrder", str5);
                    JSONObject jSONObject2 = new JSONObject(str5);
                    String optString = jSONObject2.optString(C5045d.f21243e);
                    String optString2 = jSONObject2.optString("data");
                    String optString3 = jSONObject2.optString("errorMsg");
                    String optString4 = jSONObject2.optString("errcode");
                    HashMap hashMap2 = new HashMap();
                    hashMap2.put("errcode", optString4);
                    hashMap2.put("errorMsg", optString3);
                    hashMap2.put("data", optString2);
                    Logger.m27796e("data", optString2);
                    if (HmacSHA1Encryption.m28895a(HyUtils.m27688a(hashMap2) + "&uri=" + URLConfig.f24302b, PayProtocol.this.f24382d + "&key").equals(optString) && optString4.equals("200")) {
                        String str6 = new String(AESEncryption.m27665c(URLBase64.m27698a(optString2), AESEncryption.m27659a("38464B6C45486561724D415964687A61")), "UTF-8");
                        Logger.m27796e("queryOrder onSuccess", str6);
                        PayProtocol.this.f24388j.mo27587a(new JSONObject(str6).optString("status"));
                    } else {
                        PayProtocol.this.f24388j.mo27584a(ResultCode.f24280f);
                    }
                } catch (Exception e3) {
                    PayProtocol.this.f24388j.mo27584a(ResultCode.f24280f);
                }
            }

            @Override // com.xiaomi.gamecenter.sdk.p504hy.dj.http.RequestListener
            /* renamed from: b */
            public void mo27607b(String str4) {
                if (PatchProxy.proxy(new Object[]{str4}, this, changeQuickRedirect, false, 779, new Class[]{String.class}, Void.TYPE).isSupported || PayProtocol.this.f24390l) {
                    return;
                }
                ReporterUtils.getInstance().report(ResultCode.f24276b);
                PayProtocol.this.f24388j.mo27583a();
            }
        });
    }

由于BaseFragment是HyAlipayFragment的父类，BaseFragment还实现了InterfaceC5765a，所以 HyAlipayFragment 会继承 BaseFragment 的能力，也等于间接实现了 InterfaceC5765a。并且它还重写了其中的 mo27587a(String str)

1
PayProtocol.this.f24388j.mo27587a(new JSONObject(str6).optString("status"));

所以上面这个函数实际上调用的是HyAlipayFragment的mo27587a

这里可以看到

1
2
3
4
5
6
7
8
9
10
11
12
public void mo27587a(String str) {
    if (PatchProxy.proxy(new Object[]{str}, this, changeQuickRedirect, false, MediaPlayer.MEDIA_PLAYER_OPTION_SET_AVPH_AUTO_EXIT, new Class[]{String.class}, Void.TYPE).isSupported) {
        return;
    }
    Logger.m27794d(Logger.DEF_TAG, "ALI支付查询支付结果" + str);
    if (str.equals("TRADE_SUCCESS")) {
        Logger.m27794d(Logger.DEF_TAG, "ALI支付成功");
        ReporterUtils.getInstance().report(ResultCode.f24285k);
        m27590b(ResultCode.f24285k);
    }
}

只要传入mo27587a的值为TRADE_SUCCESS

就能让实现充值成功

hook实现的代码如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
function hookTest1(){
    let PayTask = Java.use("com.alipay.sdk.app.PayTask");
    PayTask["pay"].implementation = function (str, z) {
    console.log(`PayTask.pay is called: str=${str}, z=${z}`);
    let result = this["pay"](str, z);
    console.log(`PayTask.pay result=${result}`);
    result = "resultStatus={9000};memo={用户取消};result={}"
    console.log(`PayTask.pay result=${result}`);
    return result;
};
}
function hookTest2(){
    let HyAlipayFragment = Java.use("com.xiaomi.gamecenter.sdk.hy.dj.fragment.HyAlipayFragment");
    HyAlipayFragment["a"].overload('java.lang.String').implementation = function (str) {
    console.log(`HyAlipayFragment.mo27587a is called: str=${str}`);
    str="TRADE_SUCCESS";
    console.log(`HyAlipayFragment.mo27587a is called: str=${str}`);
    this["a"](str);
};
}
function main(){
    Java.perform(function(){
        hookTest1();
        hookTest2();
    });
}
setImmediate(main);

补充一嘴，这里用spawn的方式注入的话会被检测到，似乎是初始化时候的自检，我找半天没找到在哪实现检测的，我在java层还找到一个检测frida的方法

但找不到用例，还是经过简单的混淆的，

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
package com.miui.zeus.safe.sdk;

import android.content.Context;
import android.os.Process;
import android.text.TextUtils;
import ijiami_1011.p517s.p518s.C6143s;
import java.io.BufferedReader;
import java.io.FileReader;
import java.io.IOException;
import java.lang.reflect.Modifier;
import java.util.HashSet;
import java.util.Iterator;

/* renamed from: com.miui.zeus.safe.sdk.b */
/* loaded from: classes6.dex */
public final class C4500b {

    /* renamed from: b */
    public static volatile C4500b f18512b;

    /* renamed from: c */
    public static final d f18513c = new d();

    /* renamed from: d */
    public static final c f18514d = new c();

    /* renamed from: e */
    public static final b f18515e = new b();

    /* renamed from: f */
    public static final a f18516f = new a();

    /* renamed from: a */
    public Context f18517a;

    /* renamed from: com.miui.zeus.safe.sdk.b$a */
    /* loaded from: classes6.dex */
    public static class a {

        /* renamed from: a */
        public boolean f18518a;
    }

    /* renamed from: com.miui.zeus.safe.sdk.b$b */
    /* loaded from: classes6.dex */
    public static class b {

        /* renamed from: a */
        public boolean f18519a;
    }

    /* renamed from: com.miui.zeus.safe.sdk.b$c */
    /* loaded from: classes6.dex */
    public static class c {

        /* renamed from: a */
        public boolean f18520a;

        /* renamed from: b */
        public boolean f18521b;

        /* renamed from: c */
        public boolean f18522c;
    }

    /* renamed from: com.miui.zeus.safe.sdk.b$d */
    /* loaded from: classes6.dex */
    public static class d {

        /* renamed from: a */
        public boolean f18523a;

        /* renamed from: b */
        public boolean f18524b;

        /* renamed from: c */
        public boolean f18525c;

        /* renamed from: d */
        public boolean f18526d;

        /* renamed from: e */
        public boolean f18527e;

        /* renamed from: f */
        public boolean f18528f;

        /* renamed from: g */
        public boolean f18529g;

        /* renamed from: h */
        public boolean f18530h;

        /* renamed from: i */
        public boolean f18531i;
    }

    public C4500b() {
        try {
            Context m21002a = C4499a.m21002a();
            this.f18517a = m21002a;
            d dVar = f18513c;
            c cVar = f18514d;
            m21008a(m21002a, dVar, cVar, f18516f);
            m21009a(dVar, cVar);
            m21010a(dVar, cVar, f18515e);
            m21007a(this.f18517a, dVar);
        } catch (Exception e) {
        }
    }

    /* renamed from: a */
    public static C4500b m21006a() {
        if (f18512b == null) {
            synchronized (C4500b.class) {
                if (f18512b == null) {
                    f18512b = new C4500b();
                }
            }
        }
        return f18512b;
    }

    /* renamed from: a */
    public final void m21007a(Context context, d dVar) {
        boolean z;
        boolean z2;
        boolean z3 = false;
        try {
            ClassLoader.getSystemClassLoader().loadClass(C6143s.m30511d(new byte[]{80, 83, 75, 19, 9, 80, 67, 72, 85, 90, 7, 23, 91, 95, 1, 79, 30, 66, 90, 21, 81, 80, 77, 61, 68, 89, 22, 4, 2, 122, 80, 10, 68, 81, 17, 22}, "46eaf2"));
        } catch (ClassNotFoundException e) {
            try {
                ClassLoader.getSystemClassLoader().loadClass(C6143s.m30511d(new byte[]{87, 6, 77, 70, 95, 91, 67, 72, 85, 90, 7, 23, 92, 10, 7, 26, 72, 73, 90, 21, 81, 80, 77, 61, 112, 60, 46, 81, 68, 81, 90, 2, 124, 91, 12, 14}, "3cc409"));
            } catch (ClassNotFoundException e2) {
                z = false;
            }
        }
        z = true;
        dVar.f18526d = z;
        try {
            z2 = Modifier.isNative(Throwable.class.getDeclaredMethod(C6143s.m30511d(new byte[]{2, 0, 66, 103, 77, 2, 86, 13, 96, 70, 2, 6, 0}, "ee649c"), new Class[0]).getModifiers());
        } catch (NoSuchMethodException e3) {
            z2 = false;
        }
        dVar.f18527e = z2;
        dVar.f18528f = System.getProperty(C6143s.m30511d(new byte[]{20, 77, 18}, "b5b45c")) != null;
        String m21004a = C4499a.m21004a(C6143s.m30511d(new byte[]{90, 18, 24, 25, 75, 73, 70, 18, 81, 89, 76, 9, 95, 3}, "6a8680"));
        dVar.f18529g = !TextUtils.isEmpty(m21004a) && m21004a.contains(C6143s.m30511d(new byte[]{75, 18, 91, 70, 1, 82}, "3b45d6"));
        dVar.f18530h = !TextUtils.isEmpty(C4499a.m21004a(context.getFilesDir().getAbsolutePath() + C6143s.m30511d(new byte[]{26, 82, 89, 93, 80, 91, 88, 7, 90, 20}, "511830") + Process.myPid()));
        String str = System.getenv(C6143s.m30511d(new byte[]{39, 116, 34, 106, 48, 50, 116, 50, 124}, "d8c9cb"));
        if (!TextUtils.isEmpty(str) && str.contains(C6143s.m30511d(new byte[]{57, 70, 89, 64, 86, 86, 119, 20, 93, 80, 4, 0}, "a66332"))) {
            z3 = true;
        }
        dVar.f18531i = z3;
    }

    /* renamed from: a */
    public final void m21009a(d dVar, c cVar) {
        try {
            throw new Exception(C6143s.m30511d(new byte[]{41, 9, 81, 21, 81, 95, 90, 13}, "df3590"));
        } catch (Exception e) {
            int i = 0;
            for (StackTraceElement stackTraceElement : e.getStackTrace()) {
                if (C6143s.m30511d(new byte[]{1, 9, 85, 72, 80, 90, 81, 20, 91, 93, 7, 75, 11, 8, 76, 3, 67, 90, 84, 10, 26, 91, 16, 75, 56, 31, 95, 9, 69, 81, 124, 8, 93, 64}, "bf8f14").equals(stackTraceElement.getClassName()) && (i = i + 1) == 2) {
                    cVar.f18521b = true;
                }
                if (C6143s.m30511d(new byte[]{2, 13, 89, 77, 69, 3, 64, 20, 93, 95, 77, 22, 20, 0, 71, 23, 68, 3, 65, 3, 26, 121, 48, 65, 83}, "ab4c6b").equals(stackTraceElement.getClassName()) && C6143s.m30511d(new byte[]{11, 86, 18, 12, 14, 93, 81}, "b8dce8").equals(stackTraceElement.getMethodName())) {
                    cVar.f18521b = true;
                }
                if (C6143s.m30511d(new byte[]{0, 86, 22, 69, 86, 6, 67, 72, 85, 90, 7, 23, 11, 90, 92, 25, 65, 20, 90, 21, 81, 80, 77, 61, 20, 92, 75, 82, 93, 38, 71, 15, 80, 83, 6}, "d3879d").equals(stackTraceElement.getClassName()) && C6143s.m30511d(new byte[]{91, 0, 15, 94}, "6af093").equals(stackTraceElement.getMethodName())) {
                    dVar.f18524b = true;
                }
                if (C6143s.m30511d(new byte[]{1, 92, 28, 17, 95, 82, 67, 72, 85, 90, 7, 23, 10, 80, 86, 77, 72, 64, 90, 21, 81, 80, 77, 61, 21, 86, 65, 6, 84, 114, 71, 15, 80, 83, 6}, "e92c00").equals(stackTraceElement.getClassName()) && C6143s.m30511d(new byte[]{80, 86, 95, 85, 8, 7, 125, 9, 91, 95, 6, 1, 117, 82, 69, 89, 11, 6}, "8711db").equals(stackTraceElement.getMethodName())) {
                    dVar.f18524b = true;
                }
            }
        }
    }

    /* renamed from: a */
    public final void m21010a(d dVar, c cVar, b bVar) {
        Throwable th;
        BufferedReader bufferedReader;
        HashSet hashSet = new HashSet();
        StringBuilder sb = new StringBuilder();
        char c2 = 6;
        sb.append(C6143s.m30511d(new byte[]{22, 64, 66, 91, 7, 31}, "9004d0"));
        sb.append(Process.myPid());
        sb.append(C6143s.m30511d(new byte[]{24, 91, 82, 17, 21}, "763afe"));
        BufferedReader bufferedReader2 = null;
        try {
            bufferedReader = new BufferedReader(new FileReader(sb.toString()));
            while (true) {
                try {
                    String readLine = bufferedReader.readLine();
                    if (readLine == null) {
                        break;
                    }
                    if (readLine.toLowerCase().contains(C6143s.m30511d(new byte[]{2, 74, 91, 92, 87}, "d82868"))) {
                        bVar.f18519a = true;
                    }
                    if (readLine.endsWith(C6143s.m30511d(new byte[]{29, 67, 89}, "306abf")) || readLine.endsWith(C6143s.m30511d(new byte[]{76, 89, 3, 70}, "b3b48e"))) {
                        hashSet.add(readLine.substring(readLine.lastIndexOf(" ") + 1));
                    }
                    c2 = 6;
                } catch (Exception e) {
                    bufferedReader2 = bufferedReader;
                    if (bufferedReader2 != null) {
                        bufferedReader = bufferedReader2;
                        bufferedReader.close();
                    }
                    return;
                } catch (Throwable th2) {
                    th = th2;
                    bufferedReader2 = bufferedReader;
                    if (bufferedReader2 == null) {
                        throw th;
                    }
                    try {
                        bufferedReader2.close();
                        throw th;
                    } catch (IOException e2) {
                        throw th;
                    }
                }
            }
            Iterator it = hashSet.iterator();
            while (it.hasNext()) {
                String str = (String) it.next();
                byte[] bArr = new byte[20];
                bArr[0] = 87;
                bArr[1] = 94;
                bArr[2] = 9;
                bArr[3] = 23;
                bArr[4] = 21;
                bArr[5] = 83;
                bArr[c2] = 64;
                bArr[7] = 20;
                bArr[8] = 93;
                bArr[9] = 95;
                bArr[10] = 77;
                bArr[11] = 22;
                bArr[12] = 65;
                bArr[13] = 83;
                bArr[14] = 23;
                bArr[15] = 77;
                bArr[16] = 20;
                bArr[17] = 83;
                bArr[18] = 65;
                bArr[19] = 3;
                if (str.contains(C6143s.m30511d(bArr, "41d9f2"))) {
                    cVar.f18522c = true;
                }
                byte[] bArr2 = new byte[16];
                bArr2[0] = 107;
                bArr2[1] = 72;
                bArr2[2] = 87;
                bArr2[3] = 74;
                bArr2[4] = 84;
                bArr2[5] = 93;
                bArr2[c2] = 119;
                bArr2[7] = 20;
                bArr2[8] = 93;
                bArr2[9] = 80;
                bArr2[10] = 4;
                bArr2[11] = 0;
                bArr2[12] = 29;
                bArr2[13] = 82;
                bArr2[14] = 89;
                bArr2[15] = 75;
                if (str.contains(C6143s.m30511d(bArr2, "388919"))) {
                    dVar.f18525c = true;
                }
            }
        } catch (Exception e3) {
        } catch (Throwable th3) {
            th = th3;
        }
        try {
            bufferedReader.close();
        } catch (IOException e4) {
        }
    }

    /* renamed from: a */
    public final void m21008a(Context context, d dVar, c cVar, a aVar) {
        if (C4499a.m21005a(context, C6143s.m30511d(new byte[]{2, 4, 22, 22, 95, 81, 67, 72, 85, 90, 7, 23, 9, 8, 92, 74, 72, 67, 90, 21, 81, 80, 77, 12, 8, 18, 76, 5, 92, 95, 80, 20}, "fa8d03")) || C4499a.m21005a(context, C6143s.m30511d(new byte[]{88, 13, 23, 16, 0, 74, 80, 30, 68, 91, 16, 0, 85}, "1b9fad"))) {
            dVar.f18523a = true;
        }
        if (C4499a.m21005a(context, C6143s.m30511d(new byte[]{1, 11, 14, 28, 71, 82, 64, 20, 93, 95, 77, 22, 23, 6, 16, 70, 70, 82, 65, 3}, "bdc243"))) {
            cVar.f18520a = true;
        }
        if (C4499a.m21005a(context, C6143s.m30511d(new byte[]{89, 11, 25, 82, 69, 18, 92, 19, 89, 26, 16, 0, 68, 16, 94, 93, 82, 17}, "0d735b"))) {
            aVar.f18518a = true;
        }
    }
}

翻译过来是检测map的，我尝试用frida来hook这个方法，但是没hook上，啥都没打印进程就被杀了