VirtualXposed hook Android系统方法

一、概述

最近由于换了工作,就忙了一段时间,但是一直也想学习点东西、总结点东西。今天就学习下android安全检测的手段之一,使用hook检测app是否获取个人隐私问题的方案吧。
VirtualXposed的工作原理简单来理解,就是先在手机上建立一个“虚拟空间”,需要在这个“虚拟空间”里面安装APP ,并且安装其对应的Xposed框架模块,这样就能让这个模块对该APP 起到作用了。 这种工作模式有点类似于电脑上的虚拟机,安装虚拟机之后,无论怎么折腾,都不会影响主系统的正常动作,而虚拟系统仍然有主系统的全部功能,所以VirtualXposed是一个免Root的虚拟空间方案。 安装到VirtualXposed中的APP,运行起来跟普通应用无任何差别,可以正常收发消息,接收推送,读取本机文件等。
Xposed 能做什么?
1.系统方法调用的检测
2.hook方法重新实现
3.检测变量是否被修改

二、如何检测制定的系统方法被调用呢?

首先肯定是需要部署VirtualXposed环境,这个步骤就不聊了,直接实现检测系统方法调用检测吧。
1、新建一个Android工程,之后引入XposedBridgeApi-82.jar。
2、在assets的xposed_init中配置监听Hook的实现。
3、清单文件中配置为插件工程。
不花里胡哨的了,直接上代码吧:

 //imei- getDeviceId-无参 固定格式
        XposedHelpers.findAndHookMethod(
                android.telephony.TelephonyManager.class.getName(), // 需要hook的方法所在类的完整类名
                lpparam.classLoader,                            // 类加载器,固定这么写就行了
                "getDeviceId",                     // 需要hook的方法名
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getDeviceId()获取了imei";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getDeviceId()");
                    }
                }
        );

        //imei-getDeviceId-有参
        XposedHelpers.findAndHookMethod(
                android.telephony.TelephonyManager.class.getName(),
                lpparam.classLoader,
                "getDeviceId",
                int.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getDeviceId(int)获取了imei";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getDeviceId(1)");
                    }
                }
        );


        //imei- getImei-无参 固定格式
        XposedHelpers.findAndHookMethod(
                android.telephony.TelephonyManager.class.getName(), // 需要hook的方法所在类的完整类名
                lpparam.classLoader,                            // 类加载器,固定这么写就行了
                "getImei",                     // 需要hook的方法名
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getImei()获取了imei";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getImei()");
                    }
                }
        );

        //imei-getDeviceId-有参
        XposedHelpers.findAndHookMethod(
                android.telephony.TelephonyManager.class.getName(),
                lpparam.classLoader,
                "getImei",
                int.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getImei(int)获取了imei";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getImei(1)");
                    }
                }
        );


        //imsi
        XposedHelpers.findAndHookMethod(
                android.telephony.TelephonyManager.class.getName(),
                lpparam.classLoader,
                "getSubscriberId",
                int.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getSubscriberId获取了imsi";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getSubscriberId()");
                    }
                }
        );

        //mac
        XposedHelpers.findAndHookMethod(
                android.net.wifi.WifiInfo.class.getName(),
                lpparam.classLoader,
                "getMacAddress",
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getMacAddress()获取了mac地址";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getMacAcdress()");
                    }
                }

        );

        //mac
        XposedHelpers.findAndHookMethod(
                java.net.NetworkInterface.class.getName(),
                lpparam.classLoader,
                "getHardwareAddress",
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getHardwareAddress()获取了mac地址";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getHardwareAddress()");
                    }
                }

        );

        //android id  https://www.52pojie.cn/thread-1063915-1-1.html
        //android.provider.Settings.System.getString
        XposedHelpers.findAndHookMethod(android.provider.Settings.System.class.getName(),
                lpparam.classLoader,
                "getString",
                ContentResolver.class,
                String.class,
                new XC_MethodHook() {

                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {

                        if (param == null || param.args == null) {
                            Log.e(TAG, "getString 参数为空!!!!!");
                            return;
                        }
                        String log = "检测到 调用Settings.Secure.getstring获取了" + param.args[1];
                        Log.e(TAG, log);
                        XposedBridge.log(log);

                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("AndroidId()");
                    }
                });


        //获取定位
        XposedHelpers.findAndHookMethod(
                LocationManager.class.getName(),
                lpparam.classLoader,
                "getLastKnownLocation",
                String.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getLastKnownLocation获取了GPS地址";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getLastKnownLocation()");
                    }
                }
        );

        //获取任务列表 getRecentTasks
        XposedHelpers.findAndHookMethod(
                ActivityManager.class.getName(),
                lpparam.classLoader,
                "getRecentTasks",
                int.class,
                int.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getRecentTasks获取任务列表";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getRecentTasks()");
                    }
                }
        );


        //获取任务列表 getRunningTasks
        XposedHelpers.findAndHookMethod(
                ActivityManager.class.getName(),
                lpparam.classLoader,
                "getRunningTasks",
                int.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getRunningTasks(0)获取任务列表";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getRunningTasks()");
                    }
                }
        );
    }

另外需要打印log,可以使用下面方法,这样就可以在logcat和VirtualXposed中同时输出log了。

public void printStackTree(String method) {
        XposedBridge.log("***********************************");
        XposedBridge.log(method + " 堆栈:---------------start----------------");
        Log.e(TAG, "***********************************");
        Log.e(TAG, method + " 堆栈:---------------start----------------");
        Throwable ex = new Throwable();
        StackTraceElement[] stackElements = ex.getStackTrace();
        for (int i = 0; i < stackElements.length; i++) {
            StackTraceElement element = stackElements[i];
            String format = String.format("at %s.%s(%s:%d)",
                    element.getClassName(), element.getMethodName(), element
                            .getFileName(), element.getLineNumber());
            XposedBridge.log(format);
            Log.e(TAG, format);
        }
        XposedBridge.log(method + " 堆栈:---------------end----------------");
        Log.e(TAG, method + " 堆栈:---------------end----------------");
    }

三、hook修改返回值:

 //imei- getDeviceId-无参 固定格式
        XposedHelpers.findAndHookMethod(
                android.telephony.TelephonyManager.class.getName(), // 需要hook的方法所在类的完整类名
                lpparam.classLoader,                            // 类加载器,固定这么写就行了
                "getDeviceId",                     // 需要hook的方法名
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) {
                        String log = "检测到 调用getDeviceId()获取了imei";
                        Log.e(TAG, log);
                        XposedBridge.log(log);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
//                        super.afterHookedMethod(param);
                        printStackTree("getDeviceId()");
                        param.setResult("iamhookvalue");
                    }
                }
        );
参考资料:

定制Xposed框架:https://blog.csdn.net/qq_35834055/article/details/103256122
Xposed框架的检测和反制:https://blog.coderstory.cn/about-xposed/
使用:https://blog.csdn.net/weixin_42430341/article/details/113043216
干货:https://github.com/stormdzh/HookSources
https://github.com/stormdzh/HookCheck

你可能感兴趣的:(VirtualXposed hook Android系统方法)