实现Android Native端爆破源码

尝试在移动端so侧做一些内存修改，使之走向不通的逻辑，一下为将要爆破的APP源码

JAVA侧：

 package com.example.grady.sectestone;

 import android.os.Handler;
 import android.os.Message;
 import android.support.v7.app.AppCompatActivity;
 import android.os.Bundle;
 import android.widget.TextView;

 import java.util.Timer;
 import java.util.TimerTask;

 public class MainActivity extends AppCompatActivity {

     // Used to load the 'native-lib' library on application startup.
     static {
         System.loadLibrary("native-lib");
     }

     private TextView tv;
     private Timer timer;
     private int count = 0;

     private Handler mHandler = new Handler(){
         @Override
         public void handleMessage(Message msg) {
             super.handleMessage(msg);
             //tv.setText((String)(msg.getData().get("time")));
             String str = stringFromJNI();
             tv.setText(str);
         }
     };

     @Override
     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
         setContentView(R.layout.activity_main);

         // Example of a call to a native method
         tv = (TextView) findViewById(R.id.sample_text);
         tv.setText(stringFromJNI());

         timer = new Timer();
         TimerTask timerTask = new TimerTask() {
             @Override
             public void run() {
                 count++;
                 Message msg = new Message();
                 msg.getData().putCharSequence("time", String.valueOf(count));
                 mHandler.sendMessage(msg);
             }
         };
         timer.schedule(timerTask, 1000, 1000);
     }

     @Override
     protected void onDestroy() {
         super.onDestroy();
         timer.cancel();
         timer = null;
     }

     /**
      * A native method that is implemented by the 'native-lib' native library,
      * which is packaged with this application.
      */
     public native String stringFromJNI();
 }

Native侧

#include <jni.h>
#include <string>
#include <sstream>

static int count = ;

extern "C"

JNIEXPORT jstring

JNICALL
Java_com_example_grady_sectestone_MainActivity_stringFromJNI(
        JNIEnv *env,
        jobject /* this */) {
    std::string hello;
    count++;
    std::stringstream ss;
    if (count > )
    {
        hello = "Grady JNI Count > 30 :count = ";
    }
    else if (count <  && count >= )
    {
        hello = "Grady JNI Check it : count = " ;
    }
    else
    {
        hello = "Grady Boom it !!!!! count < 0 : count = ";
    }

    ss << count;
    std::string countStr;
    ss >> countStr;
    std::string result = hello + countStr;

    return env->NewStringUTF(result.c_str());
}

在此是永远走不进彩蛋 count < 0 的逻辑中的；

后面将通过一定手段走入到彩蛋逻辑中