SIFAS 正机位

大类
iOS
Game
技术标签
逆向-iOS
逆向-手游-Unity
开发-HookPatch-Unity
优先级
Low
开始日期
Mar 28, 2021
状态
Monitoring
Public
Public
最后更新
Dec 29, 2021

动机

想用来练舞

逆向分析

I. 分析相机受谁控制

  • 由Unity中的一个轨道控制

II. 分析怎么修改Mv出装

  • 分析调用流程
    • 触发UI事件:UpdateDeckSuit
    • 发送网络请求:SaveLiveMvDeckRequest → DotUnder.Rule.Send
    • 处理user model更新:UserModelResponse → UpdateUserModel
  • 我们hook网络请求发送,判断是不是SaveLiveMvDeckRequest,如果是就直接返回,不发给服务器
  • 构造返回值
    • 生成Dictionary:通过MiniJSON_Json__Deserialize生成一个System_Collections_Generic_Dictionary_string__object__o
    • 生成UserModelResponse:通过DotUnder_Serialization__DeserializeUserModelResponse解析上面的dict
    • 设置返回内容:
      • 通过DotUnder_Structure_UserModelResponse__set_UserModel设置
      • < 3.0.0:服务器始终返回全量UserModel,因此我们直接复制一份原来的UserModel,然后修改其中的一部分内容即可
      • > 3.0.0:服务器返回增量UserModel
        • 每次的UserModel中必定带有UserStatus,其他信息可选携带
        • 返回的Dictionary中每个key代表该key在原来的userModel中发生了变化。如果是value为空,则代表删除
        • 我们捕获服务器返回的UserModel数据
          • const char *userModelTemplate = "{" " \"user_status\": null," " \"user_member_by_member_id\": []," " \"user_card_by_card_id\": []," " \"user_suit_by_suit_id\": []," " \"user_live_deck_by_id\": []," " \"user_live_party_by_id\": []," " \"user_lesson_deck_by_id\": []," " \"user_live_mv_deck_by_id\": []," " \"user_live_mv_deck_custom_by_id\": []," " \"user_live_difficulty_by_difficulty_id\": []," " \"user_story_main_by_story_main_id\": []," " \"user_story_main_selected_by_story_main_cell_id\": []," " \"user_voice_by_voice_id\": []," " \"user_emblem_by_emblem_id\": []," " \"user_gacha_ticket_by_ticket_id\": []," " \"user_gacha_point_by_point_id\": []," " \"user_lesson_enhancing_item_by_item_id\": []," " \"user_training_material_by_item_id\": []," " \"user_grade_up_item_by_item_id\": []," " \"user_custom_background_by_id\": []," " \"user_story_side_by_id\": []," " \"user_story_member_by_id\": []," " \"user_communication_member_detail_badge_by_id\": []," " \"user_story_event_history_by_id\": []," " \"user_recovery_lp_by_id\": []," " \"user_recovery_ap_by_id\": []," " \"user_mission_by_mission_id\": []," " \"user_daily_mission_by_mission_id\": []," " \"user_weekly_mission_by_mission_id\": []," " \"user_info_trigger_basic_by_trigger_id\": []," " \"user_info_trigger_card_grade_up_by_trigger_id\": []," " \"user_info_trigger_member_guild_support_item_expired_by_trigger_id\": []," " \"user_info_trigger_member_love_level_up_by_trigger_id\": []," " \"user_accessory_by_user_accessory_id\": []," " \"user_accessory_level_up_item_by_id\": []," " \"user_accessory_rarity_up_item_by_id\": []," " \"user_unlock_scenes_by_enum\": []," " \"user_scene_tips_by_enum\": []," " \"user_rule_description_by_id\": []," " \"user_exchange_event_point_by_id\": []," " \"user_school_idol_festival_id_reward_mission_by_id\": []," " \"user_gps_present_received_by_id\": []," " \"user_event_marathon_by_event_master_id\": []," " \"user_event_mining_by_event_master_id\": []," " \"user_event_coop_by_event_master_id\": []," " \"user_live_skip_ticket_by_id\": []," " \"user_story_event_unlock_item_by_id\": []," " \"user_event_marathon_booster_by_id\": []," " \"user_reference_book_by_id\": []," " \"user_review_request_process_flow_by_id\": []," " \"user_tower_by_tower_id\": []," " \"user_recovery_tower_card_used_count_item_by_recovery_tower_card_used_count_item_master_id\": []," " \"user_story_linkage_by_id\": []," " \"user_subscription_status_by_id\": []," " \"user_story_main_part_digest_movie_by_id\": []," " \"user_member_guild_by_id\": []," " \"user_member_guild_support_item_by_id\": []," " \"user_daily_theater_by_daily_theater_id\": []" "}";
        • 通过这个数据生成UserModel,然后将UserStatus填充进去,再修改内容即可