使用Xpose框架實(shí)現(xiàn)Hook操作
1.項(xiàng)目導(dǎo)入
在app/build.gradle中配置
repositories {
jcenter()
}
dependencies {
compileOnly 'de.robv.android.xposed:api:82'
}
2.在AndroidManifest.xml配置
<!-- 是否是xposed模塊梳玫，xposed根據(jù)這個(gè)來判斷是否是模塊 -->
<meta-data
android:name="xposedmodule"
android:value="true" />
<!-- 模塊描述，顯示在xposed模塊列表那里第二行 -->
<meta-data
android:name="xposeddescription"
android:value="測試Xposed模塊" />
<!-- 最低xposed版本號(lib文件名可知) -->
<meta-data
android:name="xposedminversion"
android:value="30" />
3.創(chuàng)建hook類和被hook的類
被hook的程序類
findViewById(R.id.btn).setOnClickListener(new View.OnClickListener() {
@Override
public void onClick(View v) {
// dexLoadTest();
TelephonyManager tm = (TelephonyManager)getSystemService(Context.TELEPHONY_SERVICE);
try {
Log.d("allen", "get imei " + tm.getDeviceId());
Log.d("allen", "get imsi " + tm.getSubscriberId());
}catch (Exception e) {
Log.d("allen", e.getMessage());
e.printStackTrace();
}
dexLoadTest();
}
});
}
public void dexLoadTest() {
System.out.print("----dexLoadTest 已執(zhí)行");
Log.d("allen", "----dexLoadTest 已執(zhí)行");
}
hook類
public class HookTest implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
XposedBridge.log("開始--handleLoadPackage---");
if (lpparam.packageName.equals("com.mediatek.classlodertest")) {
XposedBridge.log("開始hook測試程序");
//hook類調(diào)用方法
XposedHelpers.findAndHookMethod(TelephonyManager.class, "getDeviceId", new XC_MethodReplacement() {
@Override
protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
return "momoxiaoming";
}
});
//hook 類名+方法名所在方法
XposedHelpers.findAndHookMethod("com.mediatek.classlodertest.MainActivity",lpparam.classLoader,"dexLoadTest",new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
XposedBridge.log("洗澡后...");
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
XposedBridge.log("洗澡前...");
}
});
}
}
}
對于一些延遲動態(tài)加載的代碼,hook方式
XposedHelpers.findAndHookMethod("dalvik.system.DexFile", clzLd, "loadClass",
String.class, "java.lang.ClassLoader", new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
String className = (String) param.args[0];
Object result = param.getResult();
if (result != null && result instanceof Class) {
if ("com.alipay.mobile.nebulauc.impl.UCWebViewClient".equals(className)) {
LogUtil.debug(LOG_BILL_CLICK_LOG,"Load class:" + ((Class) result).getName());
// hookLoadWebViewClient(((Class) result).getClassLoader());
} else if ("com.alipay.mobile.bill.list.ui.BillListActivity".equals(className)) {
LogUtil.debug(LOG_BILL_CLICK_LOG,"Load class:" + ((Class) result).getName());
hookBillList(((Class) result).getClassLoader());
}
}
}
});
//這個(gè)和上面不會同時(shí)發(fā)生
if (XposedHelpers.findClassIfExists("com.alipay.mobile.nebulauc.impl.UCWebViewClient", clzLd) != null) {
LogUtil.debug(LOG_BILL_CLICK_LOG,"Hook class:" + "com.alipay.mobile.nebulauc.impl.UCWebViewClient");
// hookLoadWebViewClient(classLoader);
}
if (XposedHelpers.findClassIfExists("com.alipay.mobile.bill.list.ui.BillListActivity", clzLd) != null) {
LogUtil.debug(LOG_BILL_CLICK_LOG,"Hook class:" + "com.alipay.mobile.bill.list.ui.BillListActivity");
hookBillList(clzLd);
}
4.在assets目錄下創(chuàng)建xposed_init文件
內(nèi)容填寫為上面的hook類的包名+類名
5.安裝程序
5.2 安裝我們的測試程序和被測試程序
測試
將程序和被hook的程序裝入手機(jī),勾選Xpose模塊,重啟手機(jī),點(diǎn)擊被hook程序按鈕,查看代碼是否已被攔截
測試log
11-21 18:21:15.833 3535-3535/? I/Xposed: 開始--handleLoadPackage---
11-21 18:22:35.285 3057-3057/com.mediatek.classlodertest I/Xposed: 洗澡后...
11-21 18:22:35.285 3057-3057/com.mediatek.classlodertest I/Xposed: 洗澡前...
11-21 18:34:38.758 3057-3057/com.mediatek.classlodertest D/allen: get imei momoxiaoming
11-21 18:34:38.761 3057-3057/com.mediatek.classlodertest D/allen: get imsi null
二. substrate Hook
使用指南：http://www.cydiasubstrate.com/inject/android/
SDK下載：http://www.cydiasubstrate.com/id/73e45fe5-4525-4de7-ac14-6016652cc1b8/
框架APK下載：http://www.cydiasubstrate.com/download/com.saurik.substrate.apk
