简介:Xposed框架是一款可以在不修改APK的情况下影响程序运行的框架服务,通过替换/system/bin/app_process程序控制zygote进程,使得app_process在启动过程中会加载XposedBridge.jar这个jar包,从而完成对Zygote进程及其创建的虚拟机的劫持。
Github地址:https://github.com/rovo89/Xposed
1
|
|
1
2
3
4
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
package
com.cockroach.hook_object;
import
android.content.Context;
import
android.support.v7.app.AppCompatActivity;
import
android.os.Bundle;
import
android.telephony.TelephonyManager;
import
android.widget.TextView;
public
class
MainActivity
extends
AppCompatActivity {
@Override
protected
void
onCreate(Bundle savedInstanceState) {
super
.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);
TextView tv1 = (TextView) findViewById(R.id.tv1);
TextView tv2 = (TextView) findViewById(R.id.tv2);
TelephonyManager tm = (TelephonyManager)getSystemService(Context.TELEPHONY_SERVICE);
tv1.setText(
"imei:"
+ tm.getDeviceId());
tv2.setText(
"imsi:"
+ tm.getSubscriberId());
}
}
|
这就是我们的等会要hook的apk程序,下面编写xposed插件
在 application 标签中增加模块说明信息
1
2
3
4
5
6
7
8
9
10
|
|
将 xposed 库文件 XposedBridgeApi-XX.jar, 放入 app/lib 文件夹下
需要注意的是: 修改 Scope 为 Provided
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
package
com.cockroach.xposedhookdemo;
import
android.telephony.TelephonyManager;
import
de.robv.android.xposed.IXposedHookLoadPackage;
import
de.robv.android.xposed.XC_MethodReplacement;
import
de.robv.android.xposed.XposedBridge;
import
de.robv.android.xposed.XposedHelpers;
import
de.robv.android.xposed.callbacks.XC_LoadPackage;
/**
* Created by 18459 on 2016/6/27.
*/
public
class
Main
implements
IXposedHookLoadPackage{
@Override
public
void
handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam)
throws
Throwable {
if
(!loadPackageParam.packageName.equals(
"com.cockroach.hook_object"
))
return
;
XposedBridge.log(
"Loaded app: "
+ loadPackageParam.packageName);
// 找到对应的方法,进行替换
// 参数 1:类名
// 参数 2: 方法名
// 参数 3:实现监听,重写方法
// replaceHookedMethod 替换方法
// beforeHookedMethod 方法前执行
// afterHookedMethod 方法后执行
XposedHelpers.findAndHookMethod(TelephonyManager.
class
,
"getSubscriberId"
,
new
XC_MethodReplacement() {
@Override
protected
Object replaceHookedMethod(MethodHookParam methodHookParam)
throws
Throwable {
return
"Hook 成功了 哈哈!!!"
;
}
});
}
}
|
需要在 main 文件夹下建立 assets 文件夹中新建一个 xposed_init 的文件,并在其中声明主入口类
到这里这个hook无参函数的简单demo插件就完成了,
布局文件中添加
1
2
|
|
MainActivity中添加
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
public
class
MainActivity
extends
AppCompatActivity {
@Override
protected
void
onCreate(Bundle savedInstanceState) {
super
.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);
}
public
void
my_onClick(View view) {
EditText editText = (EditText) findViewById(R.id.et1);
EditText editText1 = (EditText) findViewById(R.id.et2);
String string = editText.getText().toString();
String string1 = editText1.getText().toString();
if
(CheckRegister(string,string1)){
Toast.makeText(MainActivity.
this
,
"登陆成功"
,Toast.LENGTH_SHORT).show();
}
else
{
Toast.makeText(MainActivity.
this
,
"登陆失败"
,Toast.LENGTH_SHORT).show();
}
}
private
boolean
CheckRegister(String string, String string1) {
return
string.equals(string1);
}
}
|
效果,两个输入框输入相同时 提示登陆成功,不同时 提示登陆失败
到这里测试app完成
这里配置和前面无参插件编写一样,只需修改MainActivity
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
package
com.cockroach.xposedhookdemo;
import
android.util.Log;
import
de.robv.android.xposed.IXposedHookLoadPackage;
import
de.robv.android.xposed.XC_MethodHook;
import
de.robv.android.xposed.XposedBridge;
import
de.robv.android.xposed.XposedHelpers;
import
de.robv.android.xposed.callbacks.XC_LoadPackage;
/**
* Created by 18459 on 2016/6/27.
*/
public
class
Main
implements
IXposedHookLoadPackage{
//被HOOK的程序的包名和类名
String packName =
"com.cockroach.myapplication"
;
String className =
"com.cockroach.myapplication.MainActivity"
;
public
void
handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam)
throws
Throwable {
if
(!loadPackageParam.packageName.equals(packName))
return
;
XposedBridge.log(
"Loaded app: "
+ loadPackageParam.packageName);
// replaceHookedMethod 替换方法
// beforeHookedMethod 方法前执行
// afterHookedMethod 方法后执行
// 处理是的情况
// 找到对应类的方法,进行hook,hook的方式有两种
XposedHelpers.findAndHookMethod(className,
// 类名
loadPackageParam.classLoader,
// 类加载器
"CheckRegister"
,
// 方法名
String.
class
,
// 参数1
String.
class
,
// 参数2
new
XC_MethodHook() {
@Override
protected
void
beforeHookedMethod(MethodHookParam param)
throws
Throwable {
super
.beforeHookedMethod(param);
Log.d(
"xposedplugin"
, (String) param.args[
0
]);
Log.d(
"xposedplugin"
, (String) param.args[
1
]);
//将两个参数改为相等
param.args[
0
] =
"123"
;
param.args[
1
] =
"123"
;
//这样设置函数的返回值
param.setResult(
true
);
}
@Override
//这个hook方法之后有啥用还不知道
protected
void
afterHookedMethod(MethodHookParam param)
throws
Throwable {
super
.afterHookedMethod(param);
Log.d(
"xposedplugin"
, (String) param.args[
0
]);
Log.d(
"xposedplugin"
, (String) param.args[
1
]);
}
});
}
}
|
到这里hook有参函数的插件完成了
上面我们写了共写了两个测试app和两个插件app,我们用第一对app,来做测试
开机后我们运行测试app,看到已经hook成功了