VIP SNIPHER PRO

# ORIGINAL (roughly what it looks like — DO NOT KEEP)
#
#   .method private checkAppSign()V
#       .registers 4
#       ...
#       invoke-virtual {v1}, Landroid/content/pm/Signature;->toCharsString()Ljava/lang/String;
#       move-result-object v2
#       invoke-virtual {v0, v2}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
#       move-result v0
#       if-nez v0, :cond_pass        ← if match, skip kill
#       invoke-static {}, Landroid/os/Process;->myPid()I
#       move-result v0
#       invoke-static {v0}, Landroid/os/Process;->killProcess(I)V   ← CRASH HERE
#   :cond_pass
#       return-void
#   .end method

# ──────────────────────────────────────────────
# PATCHED VERSION — replace entire method body
# with an immediate return.  Signature check is
# completely bypassed; app no longer crashes.
# ──────────────────────────────────────────────

.method private checkAppSign()V
    .registers 1          # only p0 (this) needed

    # Just return immediately — no check, no crash
    return-void

.end method

# ORIGINAL — reads the SharedPreferences boolean
#
#   const-string v1, "pref_inapp_buy_is_premium"
#   const/4 v2, 0x0              ← default = false
#   invoke-interface {v0, v1, v2},
#       Landroid/content/SharedPreferences;->getBoolean(Ljava/lang/String;Z)Z
#   move-result v0               ← v0 = isPremium (false by default)
#   if-eqz v0, :cond_not_vip    ← jump to locked path if false

# ──────────────────────────────────────────────
# PATCHED — skip the SharedPreferences read and
# force-set v0 to 1 (true) so the VIP branch
# is always taken.
# ──────────────────────────────────────────────

    # nop out the SharedPreferences call:
    nop
    nop
    nop
    nop

    # force isPremium = true
    const/4 v0, 0x1            # v0 = true

    # Original check: if-eqz v0, :cond_not_vip
    # Now v0 is always 1 so this branch is NEVER taken.
    # Leave the if-eqz line as-is — it will never fire.

# ORIGINAL — compares expiry time to current time
#
#   invoke-static {}, Ljava/lang/System;->currentTimeMillis()J
#   move-result-wide v0            ← v0:v1 = now
#
#   iget-wide v2, p0, Lrenz/.../VIPSNIPHERPROTimeManager;->expiryTime:J
#                                  ← v2:v3 = expiry from server
#
#   cmp-long v4, v0, v2            ← compare now vs expiry
#   if-gtz v4, :cond_expired       ← if now > expiry → revoke VIP

# ──────────────────────────────────────────────
# PATCHED — replace the conditional jump so it
# NEVER goes to :cond_expired, meaning VIP is
# never revoked regardless of the clock.
# ──────────────────────────────────────────────

    invoke-static {}, Ljava/lang/System;->currentTimeMillis()J
    move-result-wide v0

    iget-wide v2, p0, Lrenz/javacodez/vpn/activities/VIPSNIPHERPROTimeManager;->expiryTime:J

    cmp-long v4, v0, v2

    # ORIGINAL: if-gtz v4, :cond_expired
    # PATCHED:  replace with goto :cond_valid
    #           (unconditionally jump to the "still valid" path)
    goto :cond_valid     # ← this is the patch

:cond_expired
    # This block now unreachable — revoking VIP
    # (original code here — keep as-is, never runs)

:cond_valid
    # VIP remains active — continue normal flow

# ═══════════════════════════════════════════════════
# FILE: smali/renz/javacodez/vpn/PatchHelper.smali
#
# Purpose: centralizes all bypass logic.
# Three static methods called from patched sites.
# ═══════════════════════════════════════════════════

.class public Lrenz/javacodez/vpn/PatchHelper;
.super Ljava/lang/Object;
.source "PatchHelper.java"

# ─── METHOD 1: bypass signature check ──────────────
# Call this instead of checkAppSign() in Application
.method public static bypassSignatureCheck()V
    .registers 1
    # Do nothing — signature check is silently skipped
    return-void
.end method

# ─── METHOD 2: always return VIP = true ────────────
# Returns boolean 1 (true) unconditionally.
# Replace SharedPreferences.getBoolean(...) call with
# this in VIPSNIPHERPROPrefs / VIPSNIPHERPROMain.
.method public static isVip()Z
    .registers 1

    const/4 v0, 0x1      # v0 = true
    return v0

.end method

# ─── METHOD 3: time check always passes ────────────
# Returns long 0 so (now - expiry) is always <= 0,
# meaning the subscription is always "not expired".
# Replace System.currentTimeMillis() with this in
# VIPSNIPHERPROTimeManager so now appears as epoch 0.
.method public static getFakeCurrentTime()J
    .registers 2

    const-wide/16 v0, 0x0   # v0:v1 = 0L (epoch zero = always valid)
    return-wide v0

.end method

# ════════════════════════════════════════════════════
# A more resilient check: compare signature HASH
# multiple times in different methods, not just once.
# Even if attacker nops one site, others still fire.
# ════════════════════════════════════════════════════

.method private verifySignatureHash()Z
    .registers 6
    # p0 = this (Application context)

    # Step 1: get package manager
    invoke-virtual {p0}, Landroid/content/Context;->getPackageManager()Landroid/content/pm/PackageManager;
    move-result-object v0             # v0 = PackageManager

    # Step 2: get package name
    invoke-virtual {p0}, Landroid/content/Context;->getPackageName()Ljava/lang/String;
    move-result-object v1             # v1 = "dev.renz.soft.vipsnipherpro"

    # Step 3: get PackageInfo with signatures
    const/4 v2, 0x40                  # GET_SIGNATURES flag
    invoke-virtual {v0, v1, v2}, Landroid/content/pm/PackageManager;->getPackageInfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;
    move-result-object v3             # v3 = PackageInfo

    # Step 4: get first signature as hex string
    iget-object v4, v3, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;
    const/4 v5, 0x0
    aget-object v4, v4, v5           # v4 = signatures[0]

    invoke-virtual {v4}, Landroid/content/pm/Signature;->toCharsString()Ljava/lang/String;
    move-result-object v4             # v4 = hex string of cert

    # Step 5: compare with expected hash (hardcoded)
    const-string v5, "<YOUR_EXPECTED_CERT_HEX_HERE>"
    invoke-virtual {v5, v4}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
    move-result v0                     # v0 = true if genuine

    return v0                          # caller checks: if false → kill

.end method

# ─── Call this in MULTIPLE locations: ────────────
#   - Application.onCreate()
#   - VIPSNIPHERPROMain.onResume()
#   - ProcessService.onCreate()
#   - VIPSNIPHERPROTimeManager constructor
# Each call site makes the patch harder to remove completely.