本文最后更新于 166 天前，其中的信息可能已经有所发展或是发生改变。
1.前言
遇到了一个修改app酷我音乐，用了一段时间打不开了，表现为卡首屏。进过排查，确定为修改者添加了时间校验。
2.逆向
看看卡首屏时的类，类里面应该有时间检测方法，但用mt记录activity，发现在首屏没有任何类。
frida注入发现有检测，注入失败，尝试gadget注入app闪退，注入失败。
利用android stdio里面的logcat查看日志，过滤酷我包名，发现循环报错
Caused by: java.lang.Throwable:
at cn.kuwo.base.http.ok.m.<init>(Unknown Source:54)
at cn.kuwo.base.http.ok.OkHttpSession$a.a(SourceFile:6)
at cn.kuwo.base.http.ok.OkHttpSession$a.a(SourceFile:1)
at cn.kuwo.base.http.ok.OkHttpSession.<clinit>(SourceFile:1)
at cn.kuwo.base.fresco.supplier.f.<init>(SourceFile:2)
at cn.kuwo.base.fresco.load.impl.b.a(SourceFile:20)
at cn.kuwo.player.App.d(SourceFile:3)
at cn.kuwo.player.App.onCreate(SourceFile:37)是这个m类init方法抛出的错误，打开看看
.method public constructor <init>()V
.registers 11
const-wide v8, 0x197bc6ab0a8L
const-wide/16 v6, 0x8a8
const-wide/16 v4, -0x1
invoke-direct {p0}, Ljava/lang/Object;-><init>()V
new-instance v0, Ljava/util/Date;
invoke-direct {v0}, Ljava/util/Date;-><init>()V
new-instance v1, Ljava/util/Date;
xor-long v2, v8, v4
and-long/2addr v2, v6
xor-long/2addr v4, v6
and-long/2addr v4, v8
or-long/2addr v2, v4
invoke-direct {v1, v2, v3}, Ljava/util/Date;-><init>(J)V
invoke-static {v0, v1}, Lcn/kuwo/base/bean/quku/۟ۢۨۦۡ;->ۣۨ۟ۨ(Ljava/lang/Object;Ljava/lang/Object;)Z
move-result v1
const/16 v0, 0x650
:goto_22
xor-int/lit16 v0, v0, 0x661
sparse-switch v0, :sswitch_data_5e
goto :goto_22
:cond_28
:sswitch_28
const/16 v0, 0x68e
goto :goto_227行和9行有date，这个应该就是日期比较了，直接扔给ai梭哈一下
ai指出16行的混淆方法为关键，清空改成返回false即可
打包重安装发现进不去又报错了，还是用android stdio查看
Caused by: java.lang.Throwable:
at cn.kuwo.mod.mobilead.KuwoAdUrl$AdUrlDef.<init>(Unknown Source:68)
at cn.kuwo.mod.mobilead.KuwoAdUrl$AdUrlDef.<clinit>(Unknown Source:73)
at cn.kuwo.mod.mobilead.r.<init>(SourceFile:11)查看KuwoAdUrl$AdUrlDef.<init>方法
.method private constructor <init>(Ljava/lang/String;ILjava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V
.registers 15
.annotation system Ldalvik/annotation/Signature;
value = {
"(",
"Ljava/lang/String;",
"Ljava/lang/String;",
"Ljava/lang/String;",
"Ljava/lang/String;",
")V"
}
.end annotation
invoke-direct {p0, p1, p2}, Ljava/lang/Enum;-><init>(Ljava/lang/String;I)V
iput-object p3, p0, Lcn/kuwo/mod/mobilead/KuwoAdUrl$AdUrlDef;->startUrl:Ljava/lang/String;
iput-object p4, p0, Lcn/kuwo/mod/mobilead/KuwoAdUrl$AdUrlDef;->defaultHost:Ljava/lang/String;
iput-object p5, p0, Lcn/kuwo/mod/mobilead/KuwoAdUrl$AdUrlDef;->endUrl:Ljava/lang/String;
iput-object p6, p0, Lcn/kuwo/mod/mobilead/KuwoAdUrl$AdUrlDef;->configKey:Ljava/lang/String;
new-instance v0, Ljava/util/Date;
invoke-direct {v0}, Ljava/util/Date;-><init>()V
new-instance v1, Ljava/util/Date;
const-wide v2, 0x197bc6aad59L
const-wide/16 v4, -0x1
xor-long/2addr v2, v4
const-wide/16 v4, 0x1559
and-long/2addr v2, v4
const-wide/16 v4, 0x1559
const-wide/16 v6, -0x1
xor-long/2addr v4, v6
const-wide v6, 0x197bc6aad59L
and-long/2addr v4, v6
or-long/2addr v2, v4
invoke-direct {v1, v2, v3}, Ljava/util/Date;-><init>(J)V
invoke-virtual {v0, v1}, Ljava/util/Date;->after(Ljava/util/Date;)Z
move-result v1
const/16 v0, 0x650
:goto_32
xor-int/lit16 v0, v0, 0x661
sparse-switch v0, :sswitch_data_6c
goto :goto_32
:cond_38
:sswitch_38
const/16 v0, 0x68e
goto :goto_32
:sswitch_3b
if-eqz v1, :cond_38
const/16 v0, 0x6ad
goto :goto_32
:sswitch_40
new-instance v0, Ljava/lang/Throwable;
const-string v1, ""
invoke-direct {v0, v1}, Ljava/lang/Throwable;-><init>(Ljava/lang/String;)V
throw v0
:sswitch_48
invoke-static {}, Lcn/kuwo/base/http/ok/ۥۢۢ۟;->ۣ۟ۡۤۨ()I
move-result v1
const/16 v0, 0x6cc
:goto_4e
xor-int/lit16 v0, v0, 0x6dd
sparse-switch v0, :sswitch_data_7e
goto :goto_4e
:sswitch_54
if-gtz v1, :cond_59
const/16 v0, 0x729
goto :goto_4e
:cond_59
:sswitch_59
const/16 v0, 0x70a
goto :goto_4e
:sswitch_5c
const-string v0, "nAUWWwqoIdFno0UsAh4G"
invoke-static {v0}, Lcn/kuwo/base/bean/vipnew/۠ۤۤۥ;->ۢۤۦۥ(Ljava/lang/String;)Ljava/lang/String;
move-result-object v0
invoke-static {v0}, Ljava/lang/Long;->parseLong(Ljava/lang/String;)J
move-result-wide v0
sget-object v2, Ljava/lang/System;->out:Ljava/io/PrintStream;
invoke-virtual {v2, v0, v1}, Ljava/io/PrintStream;->println(J)V
:sswitch_6b
return-void
:sswitch_data_6c
.sparse-switch
0xe -> :sswitch_38
0x31 -> :sswitch_3b
0xcc -> :sswitch_40
0xef -> :sswitch_48
.end sparse-switch
:sswitch_data_7e
.sparse-switch
0x11 -> :sswitch_54
0x36 -> :sswitch_59
0x1d7 -> :sswitch_6b
0x1f4 -> :sswitch_5c
.end sparse-switch
.end method54行invoke-virtual {v0, v1}, Ljava/util/Date;->after(Ljava/util/Date;)Z 检查当前日期（v0）是否在固定日期（v1）之后。结果存储在变量v1中（注意：这里的v1被重用于存储布尔值）。
在56行后添加const/4 v0,0x0即可
重新安装就能进去了
