1、叉叉加速器分析
2、叉叉加速器为全局通用，只要打开了加速器效果的游戏，无论用哪种方式启动，加速悬浮窗始终会显示。
在叉叉助手的“更多”-“叉叉加速器”里设置：
float_window_small.xml：
<?xml version="1.0" encoding="utf-8"?>
<LinearLayout android:orientation="vertical" android:background="#00ffffff" android:layout_width="48.0dip" android:layout_height="48.0dip"
xmlns:android="http://schemas.android.com/apk/res/android">
<LinearLayout android:orientation="vertical" android:id="@id/small_window_layout" android:background="@drawable/gamespeed_bg_float_window_normal" android:layout_width="48.0dip" android:layout_height="48.0dip" />
</LinearLayout>
<LinearLayout android:orientation="vertical" android:background="#00ffffff" android:layout_width="48.0dip" android:layout_height="48.0dip"
xmlns:android="http://schemas.android.com/apk/res/android">
<LinearLayout android:orientation="vertical" android:id="@id/small_window_layout" android:background="@drawable/gamespeed_bg_float_window_normal" android:layout_width="48.0dip" android:layout_height="48.0dip" />
</LinearLayout>
gamespeed_bg_float_window.xml：
<selector
xmlns:android="http://schemas.android.com/apk/res/android">
<item android:state_pressed="false" android:drawable="@drawable/gamespeed_bg_float_window_normal" />
<item android:state_pressed="true" android:drawable="@drawable/gamespeed_bg_float_window_press" />
</selector>
float_window_big.xml：
<?xml version="1.0" encoding="utf-8"?>
<LinearLayout android:gravity="bottom" android:layout_gravity="center" android:orientation="vertical" android:background="#00ffffff" android:layout_width="fill_parent" android:layout_height="fill_parent"
xmlns:android="http://schemas.android.com/apk/res/android">
<LinearLayout android:layout_gravity="center" android:orientation="vertical" android:id="@id/big_window_layout" android:background="#00ffffff" android:layout_width="fill_parent" android:layout_height="fill_parent" />
<ImageView android:id="@id/setting_close" android:background="@drawable/gamespeed_bg_close" android:clickable="true" android:layout_width="fill_parent" android:layout_height="20.0dip" />
<RelativeLayout android:layout_gravity="center" android:orientation="vertical" android:id="@id/big_window_layout_content" android:background="@drawable/gamespeed_bg_setting" android:layout_width="fill_parent" android:layout_height="60.0dip">
<ImageView android:id="@id/setting_edit_params_bg" android:background="@drawable/gamespeed_bt_params" android:clickable="true" android:layout_width="90.0dip" android:layout_height="37.0dip" android:layout_centerInParent="true" /> bc
<TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="." android:layout_centerInParent="true" />
<TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params_left" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="0" android:layout_toLeftOf="@id/setting_edit_params" android:layout_centerInParent="true" />
<TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params_right" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="0" android:layout_toRightOf="@id/setting_edit_params" android:layout_centerInParent="true" />
<ImageView android:id="@id/setting_sub_params" android:background="@drawable/gamespeed_bt_sub_params" android:clickable="true" android:layout_width="35.0dip" android:layout_height="35.0dip" android:layout_marginRight="10.0dip" android:layout_toLeftOf="@id/setting_edit_params_bg" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_add_params" android:background="@drawable/gamespeed_bt_add_params" android:clickable="true" android:layout_width="35.0dip" android:layout_height="35.0dip" android:layout_marginLeft="10.0dip" android:layout_toRightOf="@id/setting_edit_params_bg" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_byte_params" android:background="@drawable/gamespeed_bg_params_left" android:clickable="true" android:layout_width="145.0dip" android:layout_height="7.0dip" android:layout_marginRight="10.0dip" android:layout_below="@id/setting_edit_params_bg" android:layout_centerHorizontal="true" android:layout_centerVertical="true" />
<ImageView android:id="@id/exit_button" android:background="@drawable/gamespeed_bt_exit" android:clickable="true" android:layout_width="50.0dip" android:layout_height="30.0dip" android:layout_marginLeft="10.0dip" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_switch" android:background="@drawable/gamespeed_bt_switch_start" android:clickable="true" android:layout_width="50.0dip" android:layout_height="30.0dip" android:layout_marginRight="10.0dip" android:layout_alignParentRight="true" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_byte_tip_center" android:layout_width="1.0dip" android:layout_height="10.0dip" android:layout_marginBottom="13.0dip" android:layout_alignParentBottom="true" android:layout_centerInParent="true" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_byte_tip_left" android:background="@drawable/gamespeed_bg_byte_tip" android:clickable="true" android:layout_width="10.0dip" android:layout_height="10.0dip" android:layout_alignRight="@id/setting_edit_params_left" android:layout_alignBottom="@id/setting_add_params" />
<ImageView android:id="@id/setting_byte_tip_right" android:background="@drawable/gamespeed_bg_byte_tip" android:visibility="invisible" android:clickable="true" android:layout_width="10.0dip" android:layout_height="10.0dip" android:layout_alignLeft="@id/setting_edit_params_right" android:layout_alignTop="@id/setting_byte_tip_left" />
</RelativeLayout>
</LinearLayout>
<LinearLayout android:gravity="bottom" android:layout_gravity="center" android:orientation="vertical" android:background="#00ffffff" android:layout_width="fill_parent" android:layout_height="fill_parent"
xmlns:android="http://schemas.android.com/apk/res/android">
<LinearLayout android:layout_gravity="center" android:orientation="vertical" android:id="@id/big_window_layout" android:background="#00ffffff" android:layout_width="fill_parent" android:layout_height="fill_parent" />
<ImageView android:id="@id/setting_close" android:background="@drawable/gamespeed_bg_close" android:clickable="true" android:layout_width="fill_parent" android:layout_height="20.0dip" />
<RelativeLayout android:layout_gravity="center" android:orientation="vertical" android:id="@id/big_window_layout_content" android:background="@drawable/gamespeed_bg_setting" android:layout_width="fill_parent" android:layout_height="60.0dip">
<ImageView android:id="@id/setting_edit_params_bg" android:background="@drawable/gamespeed_bt_params" android:clickable="true" android:layout_width="90.0dip" android:layout_height="37.0dip" android:layout_centerInParent="true" /> bc
<TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="." android:layout_centerInParent="true" />
<TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params_left" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="0" android:layout_toLeftOf="@id/setting_edit_params" android:layout_centerInParent="true" />
<TextView android:textSize="18.0sp" android:textStyle="bold" android:textColor="#ff2cadff" android:id="@id/setting_edit_params_right" android:layout_width="wrap_content" android:layout_height="wrap_content" android:text="0" android:layout_toRightOf="@id/setting_edit_params" android:layout_centerInParent="true" />
<ImageView android:id="@id/setting_sub_params" android:background="@drawable/gamespeed_bt_sub_params" android:clickable="true" android:layout_width="35.0dip" android:layout_height="35.0dip" android:layout_marginRight="10.0dip" android:layout_toLeftOf="@id/setting_edit_params_bg" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_add_params" android:background="@drawable/gamespeed_bt_add_params" android:clickable="true" android:layout_width="35.0dip" android:layout_height="35.0dip" android:layout_marginLeft="10.0dip" android:layout_toRightOf="@id/setting_edit_params_bg" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_byte_params" android:background="@drawable/gamespeed_bg_params_left" android:clickable="true" android:layout_width="145.0dip" android:layout_height="7.0dip" android:layout_marginRight="10.0dip" android:layout_below="@id/setting_edit_params_bg" android:layout_centerHorizontal="true" android:layout_centerVertical="true" />
<ImageView android:id="@id/exit_button" android:background="@drawable/gamespeed_bt_exit" android:clickable="true" android:layout_width="50.0dip" android:layout_height="30.0dip" android:layout_marginLeft="10.0dip" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_switch" android:background="@drawable/gamespeed_bt_switch_start" android:clickable="true" android:layout_width="50.0dip" android:layout_height="30.0dip" android:layout_marginRight="10.0dip" android:layout_alignParentRight="true" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_byte_tip_center" android:layout_width="1.0dip" android:layout_height="10.0dip" android:layout_marginBottom="13.0dip" android:layout_alignParentBottom="true" android:layout_centerInParent="true" android:layout_centerVertical="true" />
<ImageView android:id="@id/setting_byte_tip_left" android:background="@drawable/gamespeed_bg_byte_tip" android:clickable="true" android:layout_width="10.0dip" android:layout_height="10.0dip" android:layout_alignRight="@id/setting_edit_params_left" android:layout_alignBottom="@id/setting_add_params" />
<ImageView android:id="@id/setting_byte_tip_right" android:background="@drawable/gamespeed_bg_byte_tip" android:visibility="invisible" android:clickable="true" android:layout_width="10.0dip" android:layout_height="10.0dip" android:layout_alignLeft="@id/setting_edit_params_right" android:layout_alignTop="@id/setting_byte_tip_left" />
</RelativeLayout>
</LinearLayout>
gamespeed_bt_switch_start.xml：
<?xml version="1.0" encoding="utf-8"?>
<selector
xmlns:android="http://schemas.android.com/apk/res/android">
<item android:state_pressed="false" android:drawable="@drawable/gamespeed_bt_setting_switch_start_normal" />
<item android:state_pressed="true" android:drawable="@drawable/gamespeed_bt_setting_switch_start_press" />
</selector>
<selector
xmlns:android="http://schemas.android.com/apk/res/android">
<item android:state_pressed="false" android:drawable="@drawable/gamespeed_bt_setting_switch_start_normal" />
<item android:state_pressed="true" android:drawable="@drawable/gamespeed_bt_setting_switch_start_press" />
</selector>
<public type="layout" name="float_window_big" id="0x7f030017" />
<public type="layout" name="float_window_small" id="0x7f030018" />
<public type="layout" name="float_window_small" id="0x7f030018" />
package com.xxAssistant.GameSpeed;
import android.content.Context;
import android.content.res.Resources;
import android.view.LayoutInflater;
import android.view.ViewGroup.LayoutParams;
import android.view.WindowManager;
import android.view.WindowManager.LayoutParams;
import android.widget.LinearLayout;
import java.lang.reflect.Field;
public class FloatWindowSmallView extends LinearLayout
{
public static int a;
public static int b;
private static int d;
public LinearLayout c;
private WindowManager e;
private WindowManager.LayoutParams f;
public FloatWindowSmallView(Context paramContext)
{
super(paramContext);
this.e = ((WindowManager)paramContext.getSystemService("window"));
LayoutInflater.from(paramContext).inflate(2130903064, this);
this.c = ((LinearLayout)findViewById(2131427400));
a = this.c.getLayoutParams().width;
b = this.c.getLayoutParams().height;
}
private int getStatusBarHeight()
{
if (d == 0);
try
{
Class localClass = Class.forName("com.android.internal.R$dimen");
Object localObject = localClass.newInstance();
int i = ((Integer)localClass.getField("status_bar_height").get(localObject)).intValue();
d = getResources().getDimensionPixelSize(i);
return d;
}
catch (Exception localException)
{
while (true)
localException.printStackTrace();
}
}
public void setParams(WindowManager.LayoutParams paramLayoutParams)
{
this.f = paramLayoutParams;
}
}
import android.content.Context;
import android.content.res.Resources;
import android.view.LayoutInflater;
import android.view.ViewGroup.LayoutParams;
import android.view.WindowManager;
import android.view.WindowManager.LayoutParams;
import android.widget.LinearLayout;
import java.lang.reflect.Field;
public class FloatWindowSmallView extends LinearLayout
{
public static int a;
public static int b;
private static int d;
public LinearLayout c;
private WindowManager e;
private WindowManager.LayoutParams f;
public FloatWindowSmallView(Context paramContext)
{
super(paramContext);
this.e = ((WindowManager)paramContext.getSystemService("window"));
LayoutInflater.from(paramContext).inflate(2130903064, this);
this.c = ((LinearLayout)findViewById(2131427400));
a = this.c.getLayoutParams().width;
b = this.c.getLayoutParams().height;
}
private int getStatusBarHeight()
{
if (d == 0);
try
{
Class localClass = Class.forName("com.android.internal.R$dimen");
Object localObject = localClass.newInstance();
int i = ((Integer)localClass.getField("status_bar_height").get(localObject)).intValue();
d = getResources().getDimensionPixelSize(i);
return d;
}
catch (Exception localException)
{
while (true)
localException.printStackTrace();
}
}
public void setParams(WindowManager.LayoutParams paramLayoutParams)
{
this.f = paramLayoutParams;
}
}
其中：2130903064 = 0x7F030018
<public type="id" name="setting_switch" id="0x7f0b0044" />
2131427396
package com.xxAssistant.GameSpeed;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.ImageView;
class FloatWindowBigView$1
implements View.OnClickListener
{
public void onClick(View paramView)
{
if (FloatWindowBigView.f == 0)
{
this.a.setTimeScale(FloatWindowBigView.h);
FloatWindowBigView.e.setBackgroundResource(2130837574);
FloatWindowBigView.f = 1;
return;
}
this.a.setTimeScale(0.0F);
FloatWindowBigView.e.setBackgroundResource(2130837573);
FloatWindowBigView.f = 0;
}
}
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.ImageView;
class FloatWindowBigView$1
implements View.OnClickListener
{
public void onClick(View paramView)
{
if (FloatWindowBigView.f == 0)
{
this.a.setTimeScale(FloatWindowBigView.h);
FloatWindowBigView.e.setBackgroundResource(2130837574);
FloatWindowBigView.f = 1;
return;
}
this.a.setTimeScale(0.0F);
FloatWindowBigView.e.setBackgroundResource(2130837573);
FloatWindowBigView.f = 0;
}
}
FloatWindowBigView.java：
static
{
g = false;
System.loadLibrary("xxspeedmanager");
h = 0.0F;
i = 0;
}
{
g = false;
System.loadLibrary("xxspeedmanager");
h = 0.0F;
i = 0;
}
public void setTimeScale(float paramFloat)
{
int i1 = (int)Arith.c(paramFloat, 10.0F);
if (i1 >= 0);
for (int i2 = 1000 + i1 * 100; ; i2 = 10000 / (10 + -i1))
{
setTimeScale(i2);
return;
}
}
public native void setTimeScale(int paramInt);
{
int i1 = (int)Arith.c(paramFloat, 10.0F);
if (i1 >= 0);
for (int i2 = 1000 + i1 * 100; ; i2 = 10000 / (10 + -i1))
{
setTimeScale(i2);
return;
}
}
public native void setTimeScale(int paramInt);
打开libxxspeedmanager.so分析：
Java_com_xxAssistant_GameSpeed_FloatWindowBigView_setTimeScale 00001778
xx_clock_gettime
xx_clock_gettime 000012CC P
xx_clock_gettime_ptr 00004F88
xx_gettimeofday 000014C4 P
xx_gettimeofday_ptr 00004F80
xx_speed_manager_init 000015F0 P
xx_clock_gettime_ptr 00004F88
xx_gettimeofday 000014C4 P
xx_gettimeofday_ptr 00004F80
xx_speed_manager_init 000015F0 P
MSHookFunction_ptr 00004FDC
MSHookFunction 000010DC
MSHookFunction 000010DC
XXJavaHookClassLoad 000010D0
XXJavaHookClassLoad_ptr 00004FD8
XXJavaHookMethod 0000107C
XXJavaHookMethod_ptr 00004FBC
XXSuperPathClassLoader 00001088
XXSuperPathClassLoader_ptr 00004FC0
XXJavaHookClassLoad_ptr 00004FD8
XXJavaHookMethod 0000107C
XXJavaHookMethod_ptr 00004FBC
XXSuperPathClassLoader 00001088
XXSuperPathClassLoader_ptr 00004FC0
/data/data/com.xxAssistant/xx-filter/assistant.json
/data/data/com.xxAssistant/xx-filter/speed.conf
/data/data/com.xxAssistant/xx-filter/speedm.json
/data/data/com.xxAssistant/xx-filter/speed.conf
/data/data/com.xxAssistant/xx-filter/speedm.json
assistant.json打开有加密
speed.conf：
/data/app/com.xxAssistant-1.apk
speedm.json打开有加密
/data/app/com.xxAssistant-1.apk
MSHookFunction比较可疑，搜索一下发现：MobileSubstrate
MobileSubstrate是一个公共库，可以用来动态替换内存中的代码、数据等。
库文件存在：
com.xxAssistant\lib\armeabi\libsubstrate.so
packagecom.xxAssistant.GameSpeed;importandroid.app.Activity;importandroid.content.Context;importandroid.content.pm.PackageManager.NameNotFoundException;importandroid.content.res.Resources;importandroid.util.DisplayMetrics;importandroid.view.Display;importandroid.view.ViewGroup;importandroid.view.WindowManager;importandroid.widget.AbsoluteLayout;importandroid.widget.AbsoluteLayout.LayoutParams;importandroid.widget.FrameLayout.LayoutParams;importjava.lang.reflect.Field;publicclassGameSpeedView {publicstaticViewGroup a;publicstaticActivity b;publicstaticActivity c;publicstaticContext d;publicstaticContext e;publicstaticintf = 0;publicstaticintg = 0;publicstaticinth;publicstaticinti;publicstaticintj;publicstaticintk;publicstaticfloatm;publicstaticFloatWindowSmallView n;publicstaticFloatWindowBigView o;publicstaticGameSpeedView p;privatestaticints = 0;privatestaticintt = 0;intl = 0;privateintq = 0;privateintr = 0;privatebooleanu =false;publicGameSpeedView(Context paramContext) { DisplayMetrics localDisplayMetrics =newDisplayMetrics(); c.getWindowManager().getDefaultDisplay().getMetrics(localDisplayMetrics); f = c.getWindowManager().getDefaultDisplay().getWidth(); g = c.getWindowManager().getDefaultDisplay().getHeight(); c.getWindowManager().getDefaultDisplay().getMetrics(localDisplayMetrics); m = localDisplayMetrics.density; }privatevoidc() {if(a ==null) { a =newAbsoluteLayout(c); a.isClickable(); FrameLayout.LayoutParams localLayoutParams =newFrameLayout.LayoutParams(-1, -1); c.addContentView(a, localLayoutParams); d(); } }privatevoidd() {inti3;inti4; label79: AbsoluteLayout.LayoutParams localLayoutParams1;if((n ==null) && (o ==null)) { n =newFloatWindowSmallView(e); o =newFloatWindowBigView(e);inti1 = (int)(48.0F * m * m);inti2 = (int)(48.0F * m);if(j == 0)breaklabel208; i3 = j;if(k == 0)breaklabel223; i4 = k; localLayoutParams1 =newAbsoluteLayout.LayoutParams(i1, i2, i3, i4);if(f >= 360.0F * m)breaklabel233; } label208: label223: label233:for(inti5 = f; ; i5 = (int)(360.0F * m)) { AbsoluteLayout.LayoutParams localLayoutParams2 =newAbsoluteLayout.LayoutParams(i5, (int)(80.0F * m), f / 2 - i5 / 2, g - (int)(80.0F * m)); n.setLayoutParams(localLayoutParams1); o.setLayoutParams(localLayoutParams2); o.setVisibility(8); a.addView(n); a.addView(o); a.setOnTouchListener(newGameSpeedView.1(this));return; i3 = f - (int)(48.0F * m);break; i4 = g / 2;breaklabel79; } }privateinte() {if(this.l == 0);try{ Class localClass = Class.forName("com.android.internal.R$dimen"); Object localObject = localClass.newInstance();inti1 = ((Integer)localClass.getField("status_bar_height").get(localObject)).intValue();this.l = e.getResources().getDimensionPixelSize(i1);returnthis.l; }catch(Exception localException) {while(true) localException.printStackTrace(); } }publicstaticvoidinit(Activity paramActivity) {if(paramActivity.isChild())return;if(e ==null);try{ e = paramActivity.createPackageContext("com.xxAssistant", 3); d = paramActivity.getApplicationContext(); c = paramActivity;if(paramActivity != b) {if(a !=null) { a.removeAllViews(); a =null; } b = paramActivity; }if(p ==null) { localGameSpeedView =newGameSpeedView(d); p = localGameSpeedView; p.c();return; } }catch(PackageManager.NameNotFoundException localNameNotFoundException) {while(true) { localNameNotFoundException.printStackTrace();continue; GameSpeedView localGameSpeedView = p; } } } }
adb pull /data/data/com.xxAssistant/shared_prefs/gameSpeedSetting.xmle:\
<?xml version='1.0' encoding='utf-8' standalone='yes'?><map><booleanname="gamespeed_com.babeltime.fknsango_360"value="true"/><booleanname="gamespeed_com.DefiantDev.SkiSafari"value="true"/></map>
版权声明：本文为博主原创文章，未经博主允许不得转载。