Android Hook Java

Android Hook Java

       

        由于项目需要，实现了一个脱离XPosed框架的Android Hook Java方法。其原理是注入某系统进程，使该进程加载某动态链接库，执行该库里的某函数，通过该函数执行某jar包里的java函数，然后执行hook该进程中的java函数操作。其中Hook Java部分提取了XPosed框架中的hook原理。

        1、进程注入

    target_pid = find_pid_of("system_server");
    if(inject_remote_process(target_pid, "/system/lib/libtest.so", "java_hook_test", "I'm parameter!", strlen("I'm parameter!")) == 0)
        LOGV("inject success");

        2、在C层执行Java方法

    JavaVM* jvm = AndroidRuntime::getJavaVM();
    JNIEnv* env;
    jvm->AttachCurrentThread(&env, NULL);

    jstring apk_path = env->NewStringUTF(INJECT_JAR_PATH);
    jstring dex_out_path = env->NewStringUTF("/data/dalvik-cache");
    jclass dexloader_claxx = env->FindClass("dalvik/system/DexClassLoader");

    snprintf(sig_buffer, 512, "(%s%s%s%s)V", JSTRING, JSTRING, JSTRING, JCLASS_LOADER);
    jmethodID dexloader_init_method = env->GetMethodID(dexloader_claxx, "<init>", sig_buffer);

    snprintf(sig_buffer, 512, "(%s)%s", JSTRING, JCLASS);
    jmethodID loadClass_method = env->GetMethodID(dexloader_claxx, "loadClass", sig_buffer);
    jclass class_loader_claxx = env->FindClass("java/lang/ClassLoader");
    snprintf(sig_buffer, 512, "()%s", JCLASS_LOADER);
    jmethodID getSystemClassLoader_method = env->GetStaticMethodID(class_loader_claxx, "getSystemClassLoader", sig_buffer);
    jobject class_loader = env->CallStaticObjectMethod(class_loader_claxx, getSystemClassLoader_method);
    check_value(class_loader);

    jobject dex_loader_obj = env->NewObject(dexloader_claxx, dexloader_init_method, apk_path, dex_out_path, NULL, class_loader);
    jstring class_name = env->NewStringUTF(CLASS_JAVA);
    jclass class_jia = static_cast<jclass>(env->CallObjectMethod(dex_loader_obj, loadClass_method, class_name));
    check_value(class_jia);

    jmethodID invoke_method = env->GetStaticMethodID(class_jia, "hook", "(I)V");
    check_value(invoke_method);
    env->CallStaticObjectMethod(class_jia, invoke_method, 0);
    LOGI("end hook java");
    jvm->DetachCurrentThread();

        3、添加你想执行hook操作的java函数，interceptKeyBeforeQueueing方法主要做一下对特殊按键的处理。

    Bridge.hookAllMethods(Helpers.findClass("com.android.internal.policy.impl.PhoneWindowManager"), "interceptKeyBeforeQueueing");

        4、类似于XPosed框架，添加你想替换的java函数cb_interceptKeyBeforeQueueing，可根据需求添加执行真正函数前与执行完后的操作。

    static XC_MethodHook cb_interceptKeyBeforeQueueing = new XC_MethodHook() {

        @Override
        protected void beforeHookedMethod(MethodHookParam param)
                throws Throwable {
            Log.v("test", "[KeyPress]" + param.args[0] + " | " + param.args[1] + " | " + param.args[2]);
        }
    };

        handleHookedMethod是真正替换的函数。

    private static Object handleHookedMethod(Member method, int originalMethodId, Object additionalInfoObj,
            Object thisObject, Object[] args) throws Throwable  {
        //Log.v("test", "enter handleHookedMethod");
		
        AdditionalHookInfo additionalInfo = (AdditionalHookInfo) additionalInfoObj;

        MethodHookParam param = new MethodHookParam();
        param.method = method;
        param.thisObject = thisObject;
        param.args = args;

        // call "before method" callbacks
        try {
            if (method.getName().equals("interceptKeyBeforeQueueing"))
                Hook.cb_interceptKeyBeforeQueueing.beforeHookedMethod(param);	
        } catch (Throwable t) {
            Log.v("test", t.getMessage());
            // reset result (ignoring what the unexpectedly exiting callback did)
            param.setResult(null);
            param.returnEarly = false;
        }

        // call original method if not requested otherwise
        if (!param.returnEarly) {
            try {
                param.setResult(invokeOriginalMethodNative(method, originalMethodId,
                    additionalInfo.parameterTypes, additionalInfo.returnType, param.thisObject, param.args));
            } catch (InvocationTargetException e) {
                param.setThrowable(e.getCause());
            }
        }
        // call "after method" callbacks
        Object lastResult =  param.getResult();
        Throwable lastThrowable = param.getThrowable();
        try {
            //<span style="white-space:pre">	</span>if (method.getName().equals("init"))
            //<span style="white-space:pre">		</span>Hook.cb_init.afterHookedMethod(param);
        } catch (Throwable t) {
            Log.v("test", t.getMessage());
            // reset to last result (ignoring what the unexpectedly exiting callback did)
            if (lastThrowable == null)
                param.setResult(lastResult);
            else
                param.setThrowable(lastThrowable);
        }

        // return
        if (param.hasThrowable())
            throw param.getThrowable();
        else
            return param.getResult();}

        整个工程已上传至github： https://github.com/phoebe1990/javaHook

        运行结果如下：

        hook类PhoneWindowManager中interceptKeyBeforeQueueing函数成功，使每次手机按键时都打印一条log信息。