工具
MT管理器(看版本号选最新版本)
NP管理器(看版本号选最新版本)
我的汤姆猫2（自行必应）
教程
一、准备
1.在mt/np管理器提取安装包/找到安装包位置
2.去除软件签名效验，mt管理器中直接点击，np管理器中优先用超强方案2(去签后能正常打开不闪退才算成功，一般逆向都需要这一步)
3.随便选一个classex文件，点全选用dex++编辑器打开
二、开始
4.逆向购买，搜索方法名startBuying把com.outfit7.engine.billing.felis.d里面的第二个startBuying方法名替换为
.method public final startBuying(Ljava/lang/String;Ljava/lang/String;)V
.registers 10
const-string v0, "iapId"
invoke-static {p1, v0}, Lkotlin/jvm/internal/q;->f(Ljava/lang/Object;Ljava/lang/String;)V
直接模拟购买成功
new-instance v0, Ljava/lang/StringBuilder;
invoke-direct {v0}, Ljava/lang/StringBuilder;->()V
const-string v1, "fake_token_"
invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v0, p1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
invoke-virtual {v0}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v0
new-instance v1, Lcom/outfit7/engine/billing/message/OnBuyCompleteMessage;
const/4 v2, 0x0
invoke-direct {v1, p1, v0, v2, v2}, Lcom/outfit7/engine/billing/message/OnBuyCompleteMessage;->(Ljava/lang/String;Ljava/lang/String;Ljava/lang/Float;Ljava/lang/String;)V
iget-object v0, p0, Lcom/outfit7/engine/billing/felis/d;->h:LZ2/b;
check-cast v0, LZ2/c;
const-class v3, Lcom/outfit7/engine/billing/message/OnBuyCompleteMessage;
invoke-virtual {v0, v3, v1}, LZ2/c;->c(Ljava/lang/Class;Ljava/lang/Object;)Ljava/lang/String;
move-result-object v0
iget-object v1, p0, Lcom/outfit7/engine/billing/felis/d;->d:Lcom/outfit7/engine/messaging/b;
check-cast v1, Lcom/outfit7/engine/messaging/c;
const-string v3, "NativeInterface"
const-string v4, "_OnBuyComplete"
invoke-virtual {v1, v3, v4, v0}, Lcom/outfit7/engine/messaging/c;->a(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V
return-void
.end method
5.免广告获取奖励，修改 Lcom/outfit7/inventory/navidad/adapters/xiaomi/s 类的 show 方法
.method public final show(Landroid/app/Activity;)V
.registers 5
.line 1
const-string v0, "activity"
invoke-static {p1, v0}, Lkotlin/jvm/internal/q;->f(Ljava/lang/Object;Ljava/lang/String;)V
直接触发广告展示开始回调
iget-object v0, p0, Lcom/outfit7/inventory/navidad/adapters/xiaomi/s;->e:Ljava/lang/ref/WeakReference;
if-eqz v0, :cond_14
invoke-virtual {v0}, Ljava/lang/ref/Reference;->get()Ljava/lang/Object;
move-result-object v0
check-cast v0, LV3/b;
if-eqz v0, :cond_14
invoke-interface {v0}, LV3/b;->a()V # 广告展示开始
:cond_14
直接触发广告奖励回调
iget-object p1, p0, Lcom/outfit7/inventory/navidad/adapters/xiaomi/s;->e:Ljava/lang/ref/WeakReference;
if-eqz p1, :cond_23
invoke-virtual {p1}, Ljava/lang/ref/Reference;->get()Ljava/lang/Object;
move-result-object p1
check-cast p1, LV3/b;
if-eqz p1, :cond_23
invoke-interface {p1}, LV3/b;->f()V # 奖励完成
:cond_23
直接触发广告关闭回调
iget-object p1, p0, Lcom/outfit7/inventory/navidad/adapters/xiaomi/s;->e:Ljava/lang/ref/WeakReference;
if-eqz p1, :cond_32
invoke-virtual {p1}, Ljava/lang/ref/Reference;->get()Ljava/lang/Object;
move-result-object p1
check-cast p1, LV3/b;
if-eqz p1, :cond_32
invoke-interface {p1}, LV3/b;->c()V # 广告关闭
:cond_32
return-void
.end method
6.清空横幅广告与弹窗广告，把com.outfit7.inventory.navidad.O7AdsNavidad类里面的下列方法名清空
startBanners
startAdjustableBanners
loadInterstitial
showInterstitial
7.到此一切结束，一路保存返回签名安装即可
特别说明
此教程基于我的汤姆猫2v25.4.3.16055，其他版本代码位置可能有所变化，仅供学习交流！
