基于Xposed hook 实时监测微信消息的三种策略

本文以微信版本6.7.3为例进行分析有hook,
大部分做微信机器人的话,首先要实时抓取微信的消息,在这里展示三种方式对微信的消息进行hook:
1.基于UI层拉取加载进行监听
2.基于微信dao层调用的保存进行监听
3.基于数据库的插入保存进行监听
这三层各有各的特点请自行选用。
/**
 * UI加载微信消息 接收消息的监听,
 */
 public static void uiMsgListener(XC_LoadPackage.LoadPackageParam lpparam) {
        log("uiMsgListener 开始");
        Object[] arrayOfObject = new Object[2];
        arrayOfObject[0] = Cursor.class;
        arrayOfObject[1] = new XC_MethodHook() {
            protected void afterHookedMethod(MethodHookParam methodHookParam) throws XmlPullParserException, IOException {
                //0代表别人发的消息,1代表是自己发的消息
                int field_isSend = ((Integer) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_isSend")).intValue();
                //消息类型:1是文本...参考wechat_manager里的消息类型定义
                int field_type = ((Integer) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_type")).intValue();
                //微信服务器端的消息id
                Object field_msgSvrId =  XposedHelpers.getObjectField(methodHookParam.thisObject, "field_msgSvrId");
                //消息内容
                String field_content = (String) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_content");
                String field_talker = (String) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_talker");
                //消息创建时间
                long field_createTime = ((Long) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_createTime")).longValue();
                log("uiMsgListener field_isSend:" + field_isSend + "--field_type:" + field_type + "--field_msgSvrId--" + field_msgSvrId + "--field_talker--" + field_talker + "--field_content--" + field_content);

            }
        };
        XposedHelpers.findAndHookMethod("com.tencent.mm.storage.bi", lpparam.classLoader, "d", arrayOfObject);
        log("uiMsgListener 结束");
    }
/**
 *微信  dao层 插入消息监听 
 */
 /**
     * 插入消息监听 处理微信 dao层
     */
    public static void insertMsgDAOListener(XC_LoadPackage.LoadPackageParam lpparam) {
        log("insertMsgDAOListener 开始");
        Class au = XposedHelpers.findClass("com.tencent.mm.storage.bi", lpparam.classLoader);
        Object[] arrayOfObject = new Object[3];
        arrayOfObject[0] = au;
        arrayOfObject[1] = boolean.class;
        arrayOfObject[2] = new XC_MethodHook() {
            protected void afterHookedMethod(MethodHookParam paramAnonymousMethodHookParam) throws XmlPullParserException, IOException {
                Object au = paramAnonymousMethodHookParam.args[0];
                if (au == null) {
                    return;
                }
                int field_isSend = ((Integer) XposedHelpers.getObjectField(au, "field_isSend")).intValue();
                int field_type = ((Integer) XposedHelpers.getObjectField(au, "field_type")).intValue();
                Object field_msgSvrId = XposedHelpers.getObjectField(au, "field_msgSvrId");
                String field_content = (String) XposedHelpers.getObjectField(au, "field_content");
                String field_talker = (String) XposedHelpers.getObjectField(au, "field_talker");
                log("insertMsgDAOListener field_isSend:" + field_isSend + "--field_type:" + field_type + "--field_msgSvrId--" + field_msgSvrId + "--field_talker--" + field_talker + "--field_content--" + field_content);

            }
        };
        XposedHelpers.findAndHookMethod(XposedHelpers.findClass("com.tencent.mm.storage.bj", lpparam.classLoader), "b", arrayOfObject);
        log("insertMsgDAOListener 结束");
    }
/**
 * database层数据的插入消息监听
 */

public static void insertMsgDBListener(XC_LoadPackage.LoadPackageParam lpparam) {
        log("insertMsgDBListener 开始");
        Object[] arrayOfObject = new Object[4];
        arrayOfObject[0] = String.class;
        arrayOfObject[1] = String.class;
        arrayOfObject[2] = ContentValues.class;
        arrayOfObject[3] = new XC_MethodHook() {
            protected void afterHookedMethod(MethodHookParam paramAnonymousMethodHookParam) throws XmlPullParserException, IOException {
                log("insertMsgDBListener 0"+paramAnonymousMethodHookParam.args[0]);
                log("insertMsgDBListener 1"+paramAnonymousMethodHookParam.args[1]);
                log("insertMsgDBListener 2"+paramAnonymousMethodHookParam.args[2]);

            }
        };
        XposedHelpers.findAndHookMethod(XposedHelpers.findClass("com.tencent.wcdb.database.SQLiteDatabase", lpparam.classLoader), "insert", arrayOfObject);
        log("insertMsgDBListener 结束");
    }
纯属发骚所作,如有侵权,请联系,如果对你的开发有帮助请给个赞
资源类下载地址:https://download.csdn.net/download/lamboo_cn/11128706

你可能感兴趣的:(Android逆向)