📖 Tutorial How to Mod In App Purchase (NO Lucky Patcher)

[senhorSandman]

Hi Guys
​First, I must make it clear that this is not an advanced tutorial for modifying an application. This post is the result of a knowledge I gained yesterday that I would like to share with you. However, I still have many doubts, and always try to post them here in the forum, as in:

Mod a Game x Mod a App: Is the same process?
How to modify an application and make it Premium?

Although I don't get an answer most of the time, I'm not upset and I will never be upset about it.
I also have to make it clear that this method does not work for all applications as it is a basic mod method. Now let's get down to business.

Requirements:

1. An app you want to mod (Preferably a simple app. We're still in the beginning, and if you're here, it's probably because you have the same amount of knowledge as me. We will evolve together.) As an example, we will use the ISS Detector application.
2. Apktool
3. Notepad++
4. ApkSigner

Our goal here is to make ISS Detector (or the app you choose) bypass the purchase verification that is sometimes done on the device itself. (In the other half, there are apps that check purchases with the help of a server.)
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1°) After downloading and installing all the necessary files, copy the apk file you want to mod to C:\apktool. Rename the app to something shorter for convenience. Ex: ISS Detector v1.2.3 apksite to = issdetector.
2°) Open a CMD window in the same folder where apktool and the app you want to mod are, and then use the following command:

apktool d nameofyourapp.apk

In this case we have:

apktool d issdetector.apk

3° Use the Windows Explorer search engine (or use a form that suits you best) and search for "Inventory". We are looking for Inventory.smali.
4° Once you find the file, open it with Notepad ++ that you previously downloaded. Just right-click on the file, and then click "Edit With Notepad ++".
5° Now that we have the file, we can look at a few things:

mPurchaseMap<String:

This field is referring to in-app purchases that can be made by the user. We are in luck.
If you found mPurchaseMap<String, chances are you will also find:

hasPurchase(Ljava/lang/String) Z.

This field is responsible for verifying if the user made the purchase, in the case of ISSDetector, we have:

.method public hasPurchase(Ljava/lang/String;)Z
    .locals 1

    .line 1
    iget-object v0, p0, Lcom/runar/issdetector/util/Inventory;->mPurchaseMap:Ljava/util/Map;

    invoke-interface {v0, p1}, Ljava/util/Map;->containsKey(Ljava/lang/Object;)Z

    move-result p1

    return p1
.end method

Now, we'll see what happens if this purchase check always gives true. Delete everything between "locals1" and "return p1" and replace it with the:

const p1, 0x1

Now, see what we have:

.method public hasPurchase(Ljava/lang/String;)Z
    .locals 1

    const p1, 0x1

    return p1
.end method

Remember to press the space key to keep a space between the keys. Also check if the alignment is correct. Notepad ++ helps with this step.

See:

WRONG:

.method public hasPurchase(Ljava/lang/String;)Z
    .locals 1
const p1, 0x1
       return p1
.end method

RIGHT:

.method public hasPurchase(Ljava/lang/String;)Z
    .locals 1

    const p1, 0x1

    return p1
.end method

Save the File. (CTRL + S). Close it.

6° Return to the main folder (c:\apktool), open CMD in the folder and type the following command:

apktool b foldername

In our example, the folder name is simply issdetector.
So:

apktool b issdetector

7° Copy the generated application (It is in: folder -> dist -> your application here.)

8° Move the app to your phone's internal memory. (I recommend that you move to the Download folder.)

9° Open apksigner, click the "pencil" icon, go to "Download" folder and click the app we just generated, and then click "Save".

10° When the process is done, open the folder (Download in this case) where you pasted the app generated by apktool. You will see two files, but one will be different. It will be named: GeneratedApplicationName.signed.apk. You must install this. Open.

In place of the app purchases button, you can see: Free, Already Purchased, Buy (press the Buy button in this case to work.) Or even nothing (in which case, the app simply approved our purchase, so at this point, you already have premium features or something.)

11° You did it.

Some questions:
1. I'm having an recompiling error, what can I do?
R: Try using the following command instead of: apktool d nameofyourapp.apk

apktool -r d nameyourapp.apk

This will prevent the decompile of resources.

 

[secretbunker]

Very clever, too much work for me, nevertheless, very clever approach.


I tried your suggestions and it worked for me.
I was curious and it worked on another app.

Thanks for sharing.

 

[senhorSandman]

Very clever, too much work for me, nevertheless, very clever approach.


I tried your suggestions and it worked for me.
I was curious and it worked on another app.

Thanks for sharing.

Thank you!

 

[Mavin]

Will definitely try..thanks for sharing

 

[Sbenny]

It's a great way to bypass in-app purchases for some applications, unfortunately the amount of games/apps it works with is very limited, but it's a good share of smali knowledge, useful for generic approaches with booleans (Z) as well

Nice job dude!

 

[Tigress]

Great share.

 

[gatack666]

Great tutorial. I'm beginning to learn how to mod games and in-app purchases are a bit annoying to me to bypass sometimes, so this is of a great help. I'll test this with some apps and will come back later to say if it worked.

 

[Lordkyoukan]

I've tried this on some things and it has not worked...but thanks for the info.

 

[Traytraytray1230]

Thanks for the info that I am going to use in a quick sec. This is the first time I tried a in app purchase so I'm excited

 

[raheel99]

1 Your wrong code and right code both will work because it's does not matter how smali code are align/formatted or leaving any blank multiple blank line.

2. No need for removing codes before returing true. This method name is haspurchase which return true or false. Adding const p1, 0x1 before method return is enough. 1 for true and 0 for false

3. Its recompiling error because this is bundle app and has 3 apk. Compiling without resources will compile without resources, which are in other 2 Apk.

 

[Zarico]

May b the file I've edited is not the right one I guess... Is there any alternative keyword to find the word... Moreover there are SO files with keywords "inapp purchase"... But I don't know how to edit them..
Atlast ended up with an error...
Btw I'm trying to mod the MoShow app..
Please help me out

 

[raheel99]

MoShow is well protected app. It has isSubscribed keyword, but its fake. Lucky Patcher also failed. Its using native call which are inside .so files. Cracking .so file is not easy job. Main activity is in class
.class public Lmd58322fb7ddfc12fb5aad70b2a837dcd80/MainActivity;