1.之前手机上要是想要使用Xposed 功能必须root,然后我们并不想root,或者麻烦，偶尔看到了下面的APP,毫不犹豫用上了xpost
http://vxposed.com/
2.详细使用指南看官网把，简单就是单独开了个沙盒，不需要在root了
3.插件开发准备
image.png
添加依赖
dependencies {
provided fileTree(include: ['*.jar'], dir: 'libs')
//noinspection GradleCompatible
compile 'com.android.support:appcompat-v7:24.2.1'
}
4.写一个类实现与IXposedHookLoadPackage
public class Xp implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(LoadPackageParam loadPackageParam) throws Throwable {
Log.e("handleLoadPackage",loadPackageParam.packageName);
if ("你需要hook的包名".equals(loadPackageParam.packageName)){
XposedBridge.log("开始hook");
XposedHelpers.findAndHookMethod("你需要完全hook的类名", loadPackageParam.classLoader,"需要hook的方法名",“需要hook的方法的参数，没有可以空出来”, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Class clazz = param.thisObject.getClass();
Field field = clazz.getDeclaredField("iv_headImage");
field.setAccessible(true);
Log.e("handleLoadPackage",field.getName());
((ImageView) field.get(param.thisObject)).setVisibility(View.GONE);
}
});
}
}
}
5. 在assets资源目录下建立一个文件
image.png
上面的例子就是简单实现hook界面的图片隐藏。
跑完毕之后我们在xpost框架中间就可以看到我们开发的插件
image.png
以上就是开发一个插件的简单步奏，开发插件主要是要看懂反编译的apk，知道他大概的流程，从而找到具体的属性，方法入手，从而改变成我们想要的结果。
6.如果有时候我们的应用是多个dex使用上面的方法就可能失效，所以推荐使用下面的方法，一下就是我屏蔽某个应用的欢迎界面的代码
public class Xp implements IXposedHookLoadPackage {
private static final String FILTER_PKGNAME = "cn.com.open.mooc";
@Override
public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
Log.e("handleLoadPackage", loadPackageParam.packageName);
/* XposedHelpers.findAndHookConstructor("java.net.URL", loadPackageParam.classLoader, String.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
String url = (String) param.args[0];
param.args[0] = "http://www.baidu.com/";
Log.e("handleLoadPackage",url);
}
});*/
if(FILTER_PKGNAME.equals(loadPackageParam.packageName)){
//这里是为了解决app多dex进行hook的问题，Xposed默认是hook主dex
XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
ClassLoader cl = ((Context)param.args[0]).getClassLoader();
Class aClass = cl.loadClass("com.imooc.component.imoocmain.splash.MCSplashActivity");
XposedHelpers.findAndHookMethod(aClass, "onCreate", Bundle.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage","beforeHookedMethod");
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage","afterHookedMethod");
Activity activity = (Activity) param.thisObject;
Intent intent = new Intent();
intent.setClassName(activity,"com.imooc.component.imoocmain.index.MCMainActivity");
activity.startActivity(intent);
super.afterHookedMethod(param);
}
});
}
});
}
/* XposedHelpers.findAndHookMethod("com.squareup.okhttp.HttpUrl",
loadPackageParam.classLoader, "openConnection", new XC_MethodHook() {
@SuppressLint("WrongConstant")
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
URL url = (URL) param.thisObject;
Log.e("handleLoadPackage", url.get);
*//* Activity activity = (Activity) param.thisObject;
Intent intent = new Intent();
intent.setClassName(activity, "com.imooc.component.imoocmain.index.MCMainActivity");
activity.startActivity(intent);
activity.finish();*//*
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage", "afterHookedMethod");
}
});*/
}
}
上面的思路就是hook主欢迎界面的onCreate方法,然后直接跳转到首页。
7 hook微信显示Menu
package com.test.gradletask;
import android.app.Application;
import android.content.Context;
import android.util.Log;
import android.view.Menu;
import android.view.MenuItem;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
/**
* 项目名称：GradleTask
* 类描述：
* 创建人：Administrator
* 创建时间：2018/3/12 10:46
* 修改人：Administrator
* 修改时间：2018/3/12 10:46
* 修改备注：
* 联系方式：[email protected]
*/
public class Man implements IXposedHookLoadPackage {
private static final String FILTER_PKGNAME = "com.tencent.mm";
@Override
public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
Log.e("handleLoadPackage", loadPackageParam.packageName);
if (FILTER_PKGNAME.equals(loadPackageParam.packageName)) {
//这里是为了解决app多dex进行hook的问题，Xposed默认是hook主dex
XposedHelpers
.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
final ClassLoader cl = ((Context) param.args[0]).getClassLoader();
final Class aClass = cl
.loadClass("com.tencent.mm.ui.LauncherUI");
XposedHelpers
.findAndHookMethod(aClass, "onCreateOptionsMenu", Menu.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage", "beforeHookedMethod");
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage", "afterHookedMethod");
Menu menu=(Menu) param.args[0];
menu.add(0,3,0,"1b");
menu.add(0,4,0,"2b");
menu.add(0,5,0,"3b");
menu.add(0,6,0,"4b");
menu.add(0,7,0,"5b");
menu.add(0,8,0,"sb");
for(int i=0;i
image.png
7.xposed如果我们调用的参数是反编译APP类型，需要这样处理
public class Man implements IXposedHookLoadPackage {
private static final String FILTER_PKGNAME = "com.shuofeng.dl.application";
@Override
public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
Log.e("handleLoadPackage", loadPackageParam.packageName);
if (FILTER_PKGNAME.equals(loadPackageParam.packageName)) {
//这里是为了解决app多dex进行hook的问题，Xposed默认是hook主dex
XposedHelpers
.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
ClassLoader cl = ((Context) param.args[0]).getClassLoader();
Class aClass = cl.loadClass("com.shuofeng.dl.application.sf.GetUserStatu");
XposedHelpers
.findAndHookMethod(aClass, "autologin", cl.loadClass("com.shuofeng.dl.application.sf.callbackinterface"),new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
Log.e("handleLoadPackage","beforeHookedMethod");
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage", "afterHookedMethod");
}
});
}
});
}
}
}
中间参数类型，我们使用目标APP的全类名就可以了