You don't understand the pain of Coolpad phones

Did you know? No matter how you swipe the Coolpad smart phone, the anti-theft password is still strong, as if giving it a title, mobile phone anti-theft expert -_-||
There is an anti-theft lock input interface in the framework-res.apk of the framework layer, which cannot be removed.
There is also a background service, CP_SystemInterface.jar, this is the key, and the crack is also broken on this layer.
The core is the JNI layer libcoolpadversion.so, which is called by the background service to read and write the hardware. The corresponding device file is /dev/yl_params.
Some users may think after seeing this that it will be OK to just kill libcoolpadversion.so. This is true, but it will cause the system to crash, as shown in the figure:

The approximate cracking steps are:
Extract CP_SystemInterface.jar, adb pull /system/framework/CP_SystemInterface.jar
First unzip CP_SystemInterface.jar -d CP_SystemInterface-Now and decompress it for later use;
Then apktool d Decompile CP_SystemInterface.jar
Enter the CP_SystemInterface-Now directory, ./dex2jar/dex2jar.sh classes.dex to convert dex into jar;
Then use jd-gui classes_dex2jar.jar to open the newly converted jar;
Find the place as shown in the picture:

Go to the decompiled directory, find the corresponding SystemInterfaceImpl.smali, open and search to "
d*", as shown below:

Change if-nez to if-eqz, save, compile back, apktool b CP_SystemInterface.jar.out, students with programming experience should understand that the "
d*" here is to match the numeric password;
go to the CP_SystemInterface-Now directory, replace the compiled dex after modification, cp ../CP_SystemInterface.jar.out/build/apk/classes.dex .
package, zip -0 ../CP_SystemInterface.jar ./ -r
replace it in the mobile phone, adb remount; adb push CP_SystemInterface.jar /system/framework/
restart the phone, adb reboot.
The screenshot after the final success is as follows: ? ?? ? The prerequisite for the above cracking process is ROOT permission. It is easy to ROOT by using a ROOT tool. The second step is to have an available third-party Recovery, which is not difficult either;The last step is to turn on the adb debugging mode on the phone, modify boot.img, and modify the default.prop as follows:

The tools used mainly include apktool, jd-gui, and dex2jar. I googled a lot of usage methods on the Internet, so I won't attach the link here. Okay, casually speaking, the paid unlocking on Taobao and the QQ group targets almost all Coolpad Android smartphones, so the above method is probably applicable until Coolpad changes the encryption method again. The modified location may be different. With appropriate modifications, the added password can be changed to the clear password. Finally, as a reminder, make good use of the error output of adb logcat. The above can be used to locate the places to be modified.

Coolpad after-sales service relies on this to make money T^T