逆向流水账(6): 微信读书墨水屏版
我曾经亲自说过:电子书比纸质书有一点好,看不到进度,我更喜欢这样读,Kindle比微信读书也有这一点好。
所以只能自己动手。
进度显示在右下角,格式是”当前页/总页数”,排版决定了后者,排版+百分比进度决定前者,关键词有了: “/” page total。
用page关键词在smali里找嫌疑变量,排除了几个错误答案之后,找到一个用进度计算出的estimatePageString
,最终被onAfterDrawPage
用到。简单把进度设置成空字符串:
diff --git a/smali_classes2/com/tencent/weread/reader/container/pageview/PageView.smali b/smali_classes2/com/tencent/weread/reader/container/pageview/PageView.smali
index ca615e6b..a5ef3a34 100644
--- a/smali_classes2/com/tencent/weread/reader/container/pageview/PageView.smali
+++ b/smali_classes2/com/tencent/weread/reader/container/pageview/PageView.smali
@@ -4028,6 +4028,8 @@
move-result-object p1
+ const-string p1, " "
+
iput-object p1, p0, Lcom/tencent/weread/reader/container/pageview/PageView;->estimatePageString:Ljava/lang/String;
.line 1004
好了,adb exec-out screencap -p > no-progress.png
:
打包小记
打包过程遇到了一个疑似是apktool的问题,登陆入口处layout丢失,扫不到二维码。
用smali/baksmali绕过资源文件打包zip:
mkdir smalii
cd smalii
cp ../weread_android_1.1.1_10140948_900.apk .
unzip weread_android_1.1.1_10140948_900.apk
rm weread_android_1.1.1_10140948_900.apk
cd ..
# 这个是重点, 绕过资源文件,用baksmali-2.5.2也可以
java -jar baksmali-2.4.0.jar d smalii/classes2.dex -o classes2
emacs classes2/com/tencent/weread/reader/container/pageview/PageView.smali
java -jar smali-2.4.0.jar a classes2 -o smalii/classes2.dex
cd smalii
zip -r ../weread_no_progress.apk *
cd ..
# uber-apk-signer也可以
apksigner sign --ks ~/somewhere/key.jks weread_no_progress.apk
微信读书1.5.4里它还是叫estimatePageString
,只是到classes3去了: java -jar baksmali-2.5.2.jar d smalii/classes3.dex -o classes3
和com/tencent/weread/reader/container/pageview/PageView.smali
diff就一句:
diff --git a/com/tencent/weread/reader/container/pageview/PageView.smali b/com/tencent/weread/reader/container/pageview/PageView.smali
index 0ad651b..9025648 100644
--- a/com/tencent/weread/reader/container/pageview/PageView.smali
+++ b/com/tencent/weread/reader/container/pageview/PageView.smali
@@ -4056,6 +4056,8 @@
move-result-object p1
+ const-string p1, " "
+
iput-object p1, p0, Lcom/tencent/weread/reader/container/pageview/PageView;->estimatePageString:Ljava/lang/String;
.line 13
最终APK下载:https://files.catbox.moe/f1hjuy.apk (SHA1 c827cdcacc71c24fc9cb20dd883b24df813de879)
系统更新
小米阅读器系统从1.1.8
升级到1.1.12
之后,上面的1.1.1
版本被覆盖(其实是卸载+重新安装)成了系统自带的微信读书,设备不带root,也就没法装回来……
除非刷回老系统或者Root,我Root完遇到了bootloop,用sim卡针和b站找到的救砖工具刷回老版本:
压缩包里有细致带图的操作指南,最后删除刷机模式驱动:pnputil /delete-driver usbdrv.inf /uninstall