基于Xposed修改微信运动步数

      前言：Zygote 是 Android 的核心，每打开一个 app，Zygote 就会 fork 一个虚拟机实例来运行
 app，基于Xposed我们可以使用Android hook技术对APK中的方法进行调试、关键API拦截、外挂等。

这篇文章建立在Xposed模块开发的基础之上，没有开发过Xposed模块的请先看这篇入门教程《Xposed模块开发入门教程》

一、微信运动修改步数原理

当点击微信运动排行榜的时候微信APP会获取手机上计数传感器的数值，然后传感器会返回我们行走的步数。此时我们使用Xposed框架来hook计数传感器的队列函数dispatchSensorEvent()，该函数在android.hardware.SystemSensorManager$SensorEventQueue这个类中。当询问传感器的时候我们在数值上加上相应步数返回给微信运动达到欺骗效果。

二、开发Xposed模块

1.新建一个类WeixinSport，具体代码如下：

package com.example.administrator.weixinsport;

import static de.robv.android.xposed.XposedHelpers.findClass;

import java.lang.reflect.Field;

import android.hardware.Sensor;
import android.util.SparseArray;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

/**
 * Created by Administrator on 2016/5/11.
 */
public class WeixinSport implements IXposedHookLoadPackage {

    private static int stepCount = 1;

    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {

        // filter
        if (!loadPackageParam.packageName.equals("com.tencent.mm")) {
            return;
        }

        final Class<?> sensorEL = findClass("android.hardware.SystemSensorManager$SensorEventQueue", loadPackageParam.classLoader);

        XposedBridge.hookAllMethods(sensorEL, "dispatchSensorEvent", new XC_MethodHook() {

            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                ((float[]) param.args[1])[0] = ((float[]) param.args[1])[0] + 1168 * stepCount;
                stepCount++;

                Field field = param.thisObject.getClass().getEnclosingClass().getDeclaredField("sHandleToSensor");
                field.setAccessible(true);

                int handle = (Integer) param.args[0];
                Sensor sensor = ((SparseArray<Sensor>) field.get(0)).get(handle);
                XposedBridge.log("sensor = " + sensor);
            }
        });
    }
}

package com.example.administrator.weixinsport; 
  
 
  
 
  
 import static de.robv.android.xposed.XposedHelpers.findClass; 
  
 
  
 
  
 import java.lang.reflect.Field; 
  
 
  
 
  
 import android.hardware.Sensor; 
  
 import android.util.SparseArray; 
  
 
  
 
  
 import de.robv.android.xposed.IXposedHookLoadPackage; 
  
 import de.robv.android.xposed.XC_MethodHook; 
  
 import de.robv.android.xposed.XposedBridge; 
  
 import de.robv.android.xposed.callbacks.XC_LoadPackage; 
  
 
  
 
  
 /** 
  
  * Created by Administrator on 2016/5/11. 
  
  */ 
  
 public class WeixinSport implements IXposedHookLoadPackage { 
  
 
  
 
  
     private static int stepCount = 1; 
  
 
  
 
  
     @Override 
  
     public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable { 
  
 
  
 
  
         // filter 
  
         if (!loadPackageParam.packageName.equals("com.tencent.mm")) { 
  
             return; 
  
         } 
  
 
  
 
  
         final Class<?> sensorEL = findClass("android.hardware.SystemSensorManager$SensorEventQueue", loadPackageParam.classLoader); 
  
 
  
 
  
         XposedBridge.hookAllMethods(sensorEL, "dispatchSensorEvent", new XC_MethodHook() { 
  
 
  
 
  
             @Override 
  
             protected void beforeHookedMethod(MethodHookParam param) throws Throwable { 
  
                 ((float[]) param.args[1])[0] = ((float[]) param.args[1])[0] + 1168 * stepCount; 
  
                 stepCount++; 
  
 
  
 
  
                 Field field = param.thisObject.getClass().getEnclosingClass().getDeclaredField("sHandleToSensor"); 
  
                 field.setAccessible(true); 
  
 
  
 
  
                 int handle = (Integer) param.args[0]; 
  
                 Sensor sensor = ((SparseArray<Sensor>) field.get(0)).get(handle); 
  
                 XposedBridge.log("sensor = " + sensor); 
  
             } 
  
         }); 
  
     } 
  
 }

这段代码中我们首先通过equals("com.tencent.mm")过滤出了来自微信的请求:

if (!loadPackageParam.packageName.equals("com.tencent.mm")) {
            return;
        }

if (!loadPackageParam.packageName.equals("com.tencent.mm")) { 
  
             return; 
  
         }

然后hook了android.hardware.SystemSensorManager$SensorEventQueue这个类中的dispatchSensorEvent()函数：

final Class<?> sensorEL = findClass("android.hardware.SystemSensorManager$SensorEventQueue", loadPackageParam.classLoader);

        XposedBridge.hookAllMethods(sensorEL, "dispatchSensorEvent", new XC_MethodHook()

final Class<?> sensorEL = findClass("android.hardware.SystemSensorManager$SensorEventQueue", loadPackageParam.classLoader); 
  
 
  
 
  
         XposedBridge.hookAllMethods(sensorEL, "dispatchSensorEvent", new XC_MethodHook()

在计数传感器将步数返回微信运动之前修改步数，加上了1168步：

((float[]) param.args[1])[0] = ((float[]) param.args[1])[0] + 1168 * stepCount;
                stepCount++;

((float[]) param.args[1])[0] = ((float[]) param.args[1])[0] + 1168 * stepCount; 
  
                 stepCount++;

为了便于调试，将传感器的一些数据打印了出来：

int handle = (Integer) param.args[0];
                Sensor sensor = ((SparseArray<Sensor>) field.get(0)).get(handle);
                XposedBridge.log("sensor = " + sensor);

int handle = (Integer) param.args[0]; 
  
                 Sensor sensor = ((SparseArray<Sensor>) field.get(0)).get(handle); 
  
                 XposedBridge.log("sensor = " + sensor);

2.修改xposed_init

com.example.administrator.weixinsport.WeixinSport

com.example.administrator.weixinsport.WeixinSport

将xposed_init的入口设定为该WeixinSport类。

注：该类中的代码参考了乌云上蒸米大神的文章，该文章地址：http://drops.wooyun.org/tips/8416

三、测试

将该APK安装重启后打开微信运动，行走几步后再点击排行榜，发现步数增加了1168。

完整源码下载请点击这里。