MIUI 破解卡米教程

MIUI 破解卡米教程：解决MIUI删除内置应用商店会卡米的问题。

1. 反编译/system/framework/services.jar（需要Decodex化）
2. 打开smali/com/android/server/pm/PackageManagerService.smali
   搜索：

   .method static compareSignatures

将会找到：

.method static compareSignatures([Landroid/content/pm/Signature;[Landroid/content/pm/Signature;)I

.locals 11
.param p0, "s1"    # [Landroid/content/pm/Signature;
.param p1, "s2"    # [Landroid/content/pm/Signature;

.prologue
const/4 v6, 0x1

const/4 v8, -0x3

const/4 v7, 0x0

.line 3096
if-nez p0, :cond_1

.line 3097
if-nez p1, :cond_0

.line 3129
:goto_0
return v6

.line 3097
:cond_0
const/4 v6, -0x1

goto :goto_0

.line 3102
:cond_1
if-nez p1, :cond_2

.line 3103
const/4 v6, -0x2

goto :goto_0

.line 3106
:cond_2
array-length v9, p0

array-length v10, p1

if-eq v9, v10, :cond_3

move v6, v8

.line 3107
goto :goto_0

.line 3111
:cond_3
array-length v9, p0

if-ne v9, v6, :cond_5

.line 3112
aget-object v6, p0, v7

aget-object v9, p1, v7

invoke-virtual {v6, v9}, Landroid/content/pm/Signature;->equals(Ljava/lang/Object;)Z

move-result v6

if-eqz v6, :cond_4

move v6, v7

goto :goto_0

:cond_4
move v6, v8

goto :goto_0

.line 3117
:cond_5
new-instance v3, Ljava/util/HashSet;

invoke-direct {v3}, Ljava/util/HashSet;-><init>()V

.line 3118
.local v3, "set1":Ljava/util/HashSet;, "Ljava/util/HashSet<Landroid/content/pm/Signature;>;"
move-object v0, p0

.local v0, "arr[        DISCUZ_CODE_1        ]quot;:[Landroid/content/pm/Signature;
array-length v2, v0

.local v2, "len[        DISCUZ_CODE_1        ]quot;:I
const/4 v1, 0x0

.local v1, "i[        DISCUZ_CODE_1        ]quot;:I
:goto_1
if-ge v1, v2, :cond_6

aget-object v5, v0, v1

.line 3119
.local v5, "sig":Landroid/content/pm/Signature;
invoke-virtual {v3, v5}, Ljava/util/HashSet;->add(Ljava/lang/Object;)Z

.line 3118
add-int/lit8 v1, v1, 0x1

goto :goto_1

.line 3121
.end local v5    # "sig":Landroid/content/pm/Signature;
:cond_6
new-instance v4, Ljava/util/HashSet;

invoke-direct {v4}, Ljava/util/HashSet;-><init>()V

.line 3122
.local v4, "set2":Ljava/util/HashSet;, "Ljava/util/HashSet<Landroid/content/pm/Signature;>;"
move-object v0, p1

array-length v2, v0

const/4 v1, 0x0

:goto_2
if-ge v1, v2, :cond_7

aget-object v5, v0, v1

.line 3123
.restart local v5    # "sig":Landroid/content/pm/Signature;
invoke-virtual {v4, v5}, Ljava/util/HashSet;->add(Ljava/lang/Object;)Z

.line 3122
add-int/lit8 v1, v1, 0x1

goto :goto_2

.line 3126
.end local v5    # "sig":Landroid/content/pm/Signature;
:cond_7
invoke-virtual {v3, v4}, Ljava/util/HashSet;->equals(Ljava/lang/Object;)Z

move-result v6

if-eqz v6, :cond_8

move v6, v7

.line 3127
goto :goto_0

:cond_8
move v6, v8

.line 3129
goto :goto_0

.end method

用以下内容替换：

.method static compareSignatures([Landroid/content/pm/Signature;[Landroid/content/pm/Signature;)I
.registers 9

const/4 v0, 0x0

return v0
.end method

保存并退出

3. 打开smali\com\miui\server\SecurityManagerService.smali
   搜索：

   .method private checkSystemSelfProtection

将会找到：

.method private checkSystemSelfProtection(Z)V
.locals 3
.param p1, "onlyCore"    # Z

.prologue
.line 226
iget-object v1, p0, Lcom/miui/server/SecurityManagerService;->mContext:Landroid/content/Context;

invoke-virtual {v1}, Landroid/content/Context;->getPackageManager()Landroid/content/pm/PackageManager;

move-result-object v0

.line 227
.local v0, "pm":Landroid/content/pm/PackageManager;
sget-boolean v1, Lmiui/os/Build;->IS_TABLET:Z

if-nez v1, :cond_2

if-nez p1, :cond_2

.line 229
const-string v1, "android"

const-string v2, "com.android.updater"

invoke-virtual {v0, v1, v2}, Landroid/content/pm/PackageManager;->checkSignatures(Ljava/lang/String;Ljava/lang/String;)I

move-result v1

if-eqz v1, :cond_0

.line 230
new-instance v1, Ljava/lang/RuntimeException;

const-string v2, "System error : cannot find system app : com.android.updater"

invoke-direct {v1, v2}, Ljava/lang/RuntimeException;-><init>(Ljava/lang/String;)V

throw v1

.line 234
:cond_0
const-string v1, "android"

const-string v2, "com.miui.securitycenter"

invoke-virtual {v0, v1, v2}, Landroid/content/pm/PackageManager;->checkSignatures(Ljava/lang/String;Ljava/lang/String;)I

move-result v1

if-eqz v1, :cond_1

.line 235
new-instance v1, Ljava/lang/RuntimeException;

const-string v2, "System error : cannot find system app : com.miui.securitycenter"

invoke-direct {v1, v2}, Ljava/lang/RuntimeException;-><init>(Ljava/lang/String;)V

throw v1

.line 238
:cond_1
sget-boolean v1, Lmiui/os/Build;->IS_INTERNATIONAL_BUILD:Z

if-nez v1, :cond_2

sget-boolean v1, Lmiui/os/Build;->IS_CM_CUSTOMIZATION:Z

if-nez v1, :cond_2

sget-boolean v1, Lmiui/os/Build;->IS_CM_CUSTOMIZATION_TEST:Z

if-nez v1, :cond_2

.line 241
const-string v1, "android"

const-string v2, "com.xiaomi.market"

invoke-virtual {v0, v1, v2}, Landroid/content/pm/PackageManager;->checkSignatures(Ljava/lang/String;Ljava/lang/String;)I

move-result v1

if-eqz v1, :cond_2

.line 242
new-instance v1, Ljava/lang/RuntimeException;

const-string v2, "System error : cannot find system app : com.xiaomi.market"

invoke-direct {v1, v2}, Ljava/lang/RuntimeException;-><init>(Ljava/lang/String;)V

throw v1

.line 246
:cond_2
return-void
.end method

将以下内容删除：

.line 241
const-string v1, "android"

const-string v2, "com.xiaomi.market"

invoke-virtual {v0, v1, v2}, Landroid/content/pm/PackageManager;->checkSignatures(Ljava/lang/String;Ljava/lang/String;)I

move-result v1

if-eqz v1, :cond_2

.line 242
new-instance v1, Ljava/lang/RuntimeException;

const-string v2, "System error : cannot find system app : com.xiaomi.market"

invoke-direct {v1, v2}, Ljava/lang/RuntimeException;-><init>(Ljava/lang/String;)V

throw v1

4. 回编译services.jar，并替换原文件。再删除MIUI商店就不会卡开机动画了。