这两天开始学英语口语，下了一个英语口语8000句（http://as.baidu.com/a/item?docid=2669698034&pre=web_am_se），感觉可以，就老老实实的去下载了离线mp3，一百多兆，玩了没有几天竟然不能够播放mp3了，仔细看看原来是需要积分，获取积分的方式竟然是安装n多个应用，我晕，考虑到下了一百多兆的离线文件，不舍得放弃，只好破解了。
1 apktool反编译一下，搜索关键字符串，发现在strings.xml文件中
<string name="msg_lackpoint">您的积分已经不足啦，快快点击广告或者运行OFFER获取大量积分吧！</string>
2 既然是使用资源字符串，再搜索一下msg_lackpoint， 发现
smali/me/uubook/spoken8000/R$string.smali:.field public static final msg_lackpoint:I =0x7f040026
3 搜索0x7f040026，找到弹出缺少积分的对话框地方，代码如下
.line 525
.end local v1 #e:Ljava/lang/Exception;
:cond_2
:try_start_1
sget-boolean v7, Lme/uubook/spoken8000/J;->hasPayed:Z
if-nez v7, :cond_3
.line 526
invoke-virtual {p0}, Lme/uubook/spoken8000/Chapter;->getResources()Landroid/content/res/Resources;
move-result-object v7
const v8, 0x7f04001e
invoke-virtual {v7, v8}, Landroid/content/res/Resources;->getString(I)Ljava/lang/String;
move-result-object v7
invoke-virtual {p0}, Lme/uubook/spoken8000/Chapter;->getResources()Landroid/content/res/Resources;
move-result-object v8
const v9, 0x7f040026
invoke-virtual {v8, v9}, Landroid/content/res/Resources;->getString(I)Ljava/lang/String;
move-result-object v8
invoke-static {p0, v7, v8}, Lme/uubook/spoken8000/J;->showMessage(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V
goto :goto_0
#如果hasPayed变量为true的时候就可以跳到这里
.line 532
:cond_3
invoke-static {}, Landroid/os/Environment;->getExternalStorageState()Ljava/lang/String;
4 显然hasPayed变量为true的时候就可以跳过，查找一下在哪里赋值的 grep -r hasPayed .
./smali/me/uubook/spoken8000/Chapter.smali: sget-boolean v7, Lme/uubook/spoken8000/J;->hasPayed:Z
./smali/me/uubook/spoken8000/Chapter.smali: sget-boolean v7, Lme/uubook/spoken8000/J;->hasPayed:Z
./smali/me/uubook/spoken8000/J.smali:.field protected static hasPayed:Z
./smali/me/uubook/spoken8000/J.smali: sput-boolean v2, Lme/uubook/spoken8000/J;->hasPayed:Z
./smali/me/uubook/spoken8000/J.smali: sget-boolean v0, Lme/uubook/spoken8000/J;->hasPayed:Z
./smali/me/uubook/spoken8000/J.smali: sput-boolean v0, Lme/uubook/spoken8000/J;->hasPayed:Z
./smali/me/uubook/spoken8000/J.smali: sput-boolean v0, Lme/uubook/spoken8000/J;->hasPayed:Z
./smali/me/uubook/spoken8000/J.smali: sput-boolean v2, Lme/uubook/spoken8000/J;->hasPayed:Z
./smali/me/uubook/spoken8000/J.smali: sput-boolean v2, Lme/uubook/spoken8000/J;->hasPayed:Z
5 赋值的地方都在J.smali文件中（sput-boolean），打开文件，运气不错，除了构造函数之外，只有一处赋值为0，改成赋值1即可
6 还有一个比较讨厌的地方就是广告条了，关键代码如下(Chapter$1.smali)，
.method public handleMessage(Landroid/os/Message;)V
.locals 1
.parameter "msg"
.prologue
.line 199
iget v0, p1, Landroid/os/Message;->what:I
packed-switch v0, :pswitch_data_0
.line 209
:cond_0
:goto_0
:pswitch_0
return-void
.line 204
:pswitch_1
sget-boolean v0, Lme/uubook/spoken8000/J;->adRemoved:Z
if-nez v0, :cond_0
.line 205
iget-object v0, p0, Lme/uubook/spoken8000/Chapter$1;->this$0:Lme/uubook/spoken8000/Chapter;
#calls: Lme/uubook/spoken8000/Chapter;->initAdContainer()V
invoke-static {v0}, Lme/uubook/spoken8000/Chapter;->access$0(Lme/uubook/spoken8000/Chapter;)V
goto :goto_0
.line 199
:pswitch_data_0
.packed-switch 0x1
:pswitch_0
:pswitch_1
.end packed-switch
.end method
7 发现只要if判断不成功就可以阻止广告条加入布局， 直接删除这几行就可以
if-nez v0, :cond_0
.line 205
iget-object v0, p0, Lme/uubook/spoken8000/Chapter$1;->this$0:Lme/uubook/spoken8000/Chapter;
#calls: Lme/uubook/spoken8000/Chapter;->initAdContainer()V
invoke-static {v0}, Lme/uubook/spoken8000/Chapter;->access$0(Lme/uubook/spoken8000/Chapter;)V
8 收尾工作
卸载已经安装的程序，
重新打包，重新签名，安装
阿里云助力开发者！2核2G 3M带宽不限流量！6.18限时价，开
发者可享99元/年，续费同价！
