TUT How To Crack In-App Billing Games

[Sysadmin]

This is a tutorial on how trick the billing system so the game thinks you bought it from the play store. I create this tutorial because there are some people around here that don't appreciate my work and write ***** all the time. By this tutorial i give a chance to the developers to fix their error and should use the other system instead that require a connection to the server to verify the purchase (wich many apps and games already have (Radiant Defense, smurf village, glu games etc).

1. Dowload Extreme Skater v1.0.3 from the market
2. Decompile the apk file
3. Find InAppActivity$MiniclipPurchaseObserver.smali
4. Remove the 2 red parts to trick the game
*. This method wont work on many other games because they use a slightly different system and verify the payment by a server check.

*Note: If you can't find the info you need then select all .smali files and drag them to notepad++ and search for ''RESULT_OK'' (without ''). It's for 95% written in a (some name infront)Observer.smali
 

.method public onRequestPurchaseResponse(Lcom/miniclip/nativeJNI/LibBillingService$RequestPurchase;Lcom/miniclip/nativeJNI/Consts$ResponseCode;)V
.locals 15
.parameter "request"
.parameter "responseCode"

.prologue
.line 115
sget-object v10, Lcom/miniclip/nativeJNI/Consts$ResponseCode;->RESULT_OK:Lcom/miniclip/nativeJNI/Consts$ResponseCode;

move-object/from16 v0, p2

if-ne v0, v10, :cond_2

.line 119
const/4 v10, 0x1

sput v10, Lcom/miniclip/nativeJNI/cocojava;->mInAppResponce:I

.line 131
:goto_0
iget-object v10, p0, Lcom/miniclip/nativeJNI/InAppActivity$MiniclipPurchaseObserver;->this$0:Lcom/miniclip/nativeJNI/InAppActivity;

sget v11, Lcom/miniclip/nativeJNI/cocojava;->mInAppResponce:I

sget-object v12, Lcom/miniclip/nativeJNI/cocojava;->mProductId:Ljava/lang/String;

invoke-virtual {v10, v11, v12}, Lcom/miniclip/nativeJNI/InAppActivity;->inAppResponce(ILjava/lang/String;)V

.line 133
sget v10, Lcom/miniclip/nativeJNI/cocojava;->mInAppResponce:I

const/4 v11, 0x1

if-ne v10, v11, :cond_1

.line 135
sget-boolean v10, Lcom/miniclip/nativeJNI/cocojava;->mSTORE_PENDING_PURCHASES:Z

if-eqz v10, :cond_0

.line 137
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mContext:Landroid/content/Context;

const-string v11, "INAPP_PURCHASED_TEMP"

const/4 v12, 0x0

invoke-virtual {v10, v11, v12}, Landroid/content/Context;->getSharedPreferences(Ljava/lang/String;I)Landroid/content/SharedPreferences;

move-result-object v9

.line 138
.local v9, settingsT:Landroid/content/SharedPreferences;
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mProductId:Ljava/lang/String;

const/4 v11, 0x0

invoke-interface {v9, v10, v11}, Landroid/content/SharedPreferences;->getInt(Ljava/lang/String;I)I

move-result v3

.line 139
.local v3, amountT:I
add-int/lit8 v3, v3, 0x1

.line 140
invoke-interface {v9}, Landroid/content/SharedPreferences;->edit()Landroid/content/SharedPreferences$Editor;

move-result-object v6

.line 141
.local v6, editorT:Landroid/content/SharedPreferences$Editor;
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mProductId:Ljava/lang/String;

invoke-interface {v6, v10, v3}, Landroid/content/SharedPreferences$Editor;->putInt(Ljava/lang/String;I)Landroid/content/SharedPreferences$Editor;

.line 142
invoke-interface {v6}, Landroid/content/SharedPreferences$Editor;->commit()Z

.line 145
.end local v3 #amountT:I
.end local v6 #editorT:Landroid/content/SharedPreferences$Editor;
.end local v9 #settingsT:Landroid/content/SharedPreferences;
:cond_0
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mContext:Landroid/content/Context;

const-string v11, "INAPP_PURCHASED"

const/4 v12, 0x0

invoke-virtual {v10, v11, v12}, Landroid/content/Context;->getSharedPreferences(Ljava/lang/String;I)Landroid/content/SharedPreferences;

move-result-object v7

.line 146
.local v7, settings:Landroid/content/SharedPreferences;
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mProductId:Ljava/lang/String;

const/4 v11, 0x0

invoke-interface {v7, v10, v11}, Landroid/content/SharedPreferences;->getInt(Ljava/lang/String;I)I

move-result v1

.line 147
.local v1, amount:I
add-int/lit8 v1, v1, 0x1

.line 148
invoke-interface {v7}, Landroid/content/SharedPreferences;->edit()Landroid/content/SharedPreferences$Editor;

move-result-object v4

.line 149
.local v4, editor:Landroid/content/SharedPreferences$Editor;
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mProductId:Ljava/lang/String;

invoke-interface {v4, v10, v1}, Landroid/content/SharedPreferences$Editor;->putInt(Ljava/lang/String;I)Landroid/content/SharedPreferences$Editor;

.line 150
invoke-interface {v4}, Landroid/content/SharedPreferences$Editor;->commit()Z

.line 152
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mContext:Landroid/content/Context;

const-string v11, "INAPP_PURCHASED_HISTORY"

const/4 v12, 0x0

invoke-virtual {v10, v11, v12}, Landroid/content/Context;->getSharedPreferences(Ljava/lang/String;I)Landroid/content/SharedPreferences;

move-result-object v8

.line 153
.local v8, settingsH:Landroid/content/SharedPreferences;
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mProductId:Ljava/lang/String;

const/4 v11, 0x0

invoke-interface {v8, v10, v11}, Landroid/content/SharedPreferences;->getInt(Ljava/lang/String;I)I

move-result v2

.line 154
.local v2, amountH:I
add-int/lit8 v2, v2, 0x1

.line 155
invoke-interface {v8}, Landroid/content/SharedPreferences;->edit()Landroid/content/SharedPreferences$Editor;

move-result-object v5

.line 156
.local v5, editorH:Landroid/content/SharedPreferences$Editor;
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mProductId:Ljava/lang/String;

invoke-interface {v5, v10, v2}, Landroid/content/SharedPreferences$Editor;->putInt(Ljava/lang/String;I)Landroid/content/SharedPreferences$Editor;

.line 157
invoke-interface {v5}, Landroid/content/SharedPreferences$Editor;->commit()Z

.line 159
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mContext:Landroid/content/Context;

check-cast v10, Lcom/miniclip/nativeJNI/cocojava;

iget-object v10, v10, Lcom/miniclip/nativeJNI/cocojava;->googleTracker:Lcom/google/android/apps/analytics/GoogleAnalyticsTracker;

const-string v11, "BuyEvents"

const-string v12, "Bought"

sget-object v13, Lcom/miniclip/nativeJNI/cocojava;->mProductId:Ljava/lang/String;

const/4 v14, 0x1

invoke-virtual {v10, v11, v12, v13, v14}, Lcom/google/android/apps/analytics/GoogleAnalyticsTracker;->trackEvent(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;I)V

.line 160
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mContext:Landroid/content/Context;

check-cast v10, Lcom/miniclip/nativeJNI/cocojava;

iget-object v10, v10, Lcom/miniclip/nativeJNI/cocojava;->googleTracker:Lcom/google/android/apps/analytics/GoogleAnalyticsTracker;

invoke-virtual {v10}, Lcom/google/android/apps/analytics/GoogleAnalyticsTracker;->dispatch()Z

.line 163
.end local v1 #amount:I
.end local v2 #amountH:I
.end local v4 #editor:Landroid/content/SharedPreferences$Editor;
.end local v5 #editorH:Landroid/content/SharedPreferences$Editor;
.end local v7 #settings:Landroid/content/SharedPreferences;
.end local v8 #settingsH:Landroid/content/SharedPreferences;
:cond_1
sget-object v10, Lcom/miniclip/nativeJNI/cocojava;->mGLView:Lcom/miniclip/nativeJNI/ClearGLSurfaceView;

new-instance v11, Lcom/miniclip/nativeJNI/InAppActivity$MiniclipPurchaseObserver$1;

invoke-direct {v11, p0}, Lcom/miniclip/nativeJNI/InAppActivity$MiniclipPurchaseObserver$1;-><init>(Lcom/miniclip/nativeJNI/InAppActivity$MiniclipPurchaseObserver;)V

invoke-virtual {v10, v11}, Lcom/miniclip/nativeJNI/ClearGLSurfaceView;->queueEvent(Ljava/lang/Runnable;)V

.line 170
return-void

.line 120
:cond_2
sget-object v10, Lcom/miniclip/nativeJNI/Consts$ResponseCode;->RESULT_USER_CANCELED:Lcom/miniclip/nativeJNI/Consts$ResponseCode;

move-object/from16 v0, p2

if-ne v0, v10, :cond_3

.line 124
const/4 v10, -0x1

sput v10, Lcom/miniclip/nativeJNI/cocojava;->mInAppResponce:I

goto/16 :goto_0

.line 129
:cond_3
const/4 v10, 0x0

sput v10, Lcom/miniclip/nativeJNI/cocojava;->mInAppResponce:I

goto/16 :goto_0
.end method

Games where this method worked with:
Hambo
iStunt 2
Fragger
Monkey Kick Off
Ping Pong
Extreme Skater
Word Collapse
Land-a Panda
Mini Pets
Coin Fever
Destiny Defense: Angel or Devil
The Amazing Fortune Teller 3D
Skyfrontier 3D
Infected
Final Defense
Empire Defense 2

[kingboi]

What about server side?

[Sysadmin]

Server sided games can be hacked this way as well.

[kingboi]

thanks

[kingboi]

I did exactly what you said for a GameVil game and got an "adnormal file Detected" error. Something I did wrong?

[Sysadmin]

I did exactly what you said for a GameVil game and got an "adnormal file Detected" error. Something I did wrong?

No. Gamevil is...Stubborn. GameVil and Com2Us aren't easy to mod.

[770]

hope i would mod some glu game with this

[noface]

No. Gamevil is...Stubborn. GameVil and Com2Us aren't easy to mod.

Gamevil is not stubborn, they just s**k. Most of the game need play online to validate the game data with their server. This mean we must play it with internet connection coverage. They have some game that MMORTS or MMORPG that require online which is fine, but for some that can play offline (like fishing superstar) it just redicolus.

[macimizedC]

What about other games since some of them do not have this cond thing how can they be cracked?

[Cooperb]

Yeah, the method is similar for most games

Sent from my GT-I9100 using Tapatalk 2

[eggtee]

can anyone look into Puzzle and Dragons? (https://play.google.com/store/apps/details?id=jp.gungho.padEN&hl=en)

Decompiled but there are no "xxxObserver.smali" files in the smali folder.  Only files like BillingReceiver.smali, BillingService.smali etc.

 

there are many if-xx v0, :cond_xx strings, which I dont know which one to delete in order to crack its In-App purchase.

wanna see if this game is possible to crack its IAP, or just to make it to work with Freedom.

 

thanks for helping.

[Onlykl]

ermmm can someone help me?? When i open Extreme Skater 1.0.4 i deleted parts of code you said d2dyno i get this message when i run game:
Can't make purchases
The Market billing service is not available at this time. You can continue to use this app but you won't be able to make purchases.

What to do?

[XxxProwalidxxX]

Some here :/

[XxxProwalidxxX]

can it be sometimes : 

if-ne v3, v4, :cond_0

cond_0 

??????????

plz help me !

[XxxProwalidxxX]

this way doesn't work anymore ! :/