lsposed模块开发
- AndroidManifest.xml -> application 标签中加入以下内容
<meta-data
android:name="xposedmodule"
android:value="true" />
<meta-data
android:name="xposeddescription"
android:value="xiaojianbang Hook Demo" />
<meta-data
android:name="xposedminversion"
android:value="54" />
|
- app -> build.gradle -> dependencies 中加入以下内容
compileOnly files('libs\\api.jar')
|
将 api.jar 放入 libs 目录下， 在 api.jar 上右键，add as library
创建 assets 目录，在里面创建 xposed_init 文件，该文件中写入模块入口类全路径
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
public class Main implements IXposedHookLoadPackage{
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
Log.d("xiaojianbang", "lsposed Hooking......");
}
}
|
注意：前面的步骤不能做错，否则模块会无法开启
hook构造函数和普通方法
package com.example.lsposeddemo;
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
public class Main implements IXposedHookLoadPackage{
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
Log.d("hyq", "lsposed Hooking......");
XposedHelpers.findAndHookConstructor("com.xiaojianbang.hook.Money", loadPackageParam.classLoader,
String.class,
int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Log.d("xiaojianbangXposed", "Money Constructor beforeHookedMethod");
}
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
Log.d("xiaojianbangXposed", "Money Constructor afterHookedMethod");
}
});
Class<?> aClass = XposedHelpers.findClass("com.xiaojianbang.Wallet", loadPackageParam.classLoader);
XposedHelpers.findAndHookConstructor(aClass,
String.class,
int.class,
new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
Log.d("xiaojianbangXposed", "Wallet Constructor beforeHookedMethod");
}
});
}
}
|
获取和修改函数参数的返回值
package com.example.lsposeddemo;
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
public class Main implements IXposedHookLoadPackage{
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
Log.d("hyq", "lsposed Hooking......");
XposedHelpers.findAndHookConstructor("com.xiaojianbang.hook.Money", loadPackageParam.classLoader,
String.class,
int.class,
new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
String args1 = (String) param.args[0];
int args2 = (int) param.args[1];
Log.d("xiaojianbangXposed", "Money Constructor afterHookedMethod" + args1 + " " + args2);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Log.d("xiaojianbangXposed", "Money Constructor beforeHookedMethod");
}
});
Class<?> aClass = XposedHelpers.findClass("com.xiaojianbang.hook.Wallet", loadPackageParam.classLoader);
XposedHelpers.findAndHookConstructor(aClass,
String.class,
String.class,
int.class,
new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
param.args[0] = "ruyi";
param.args[2] = 10000;
Log.d("xiaojianbangXposed", "Wallet Constructor beforeHookedMethod");
}
});
XposedHelpers.findAndHookMethod("com.xiaojianbang.hook.Money", loadPackageParam.classLoader,
"getInfo",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
String retval = (String) param.getResult();
Log.d("xiaojianbangXposed", "Money getInfo afterHookedMethod");
}
}
);
XposedHelpers.findAndHookMethod("com.xiaojianbang.hook.Utils", loadPackageParam.classLoader,
"getCalc",
int.class,
int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
param.setResult(10000);
Log.d("xiaojianbangXposed", "Utils getCalc afterHookedMethod");
}
}
);
}
}
|
获取和修改类的字段
package com.example.lsposeddemo;
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
public class Main implements IXposedHookLoadPackage{
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
Log.d("hyq", "lsposed Hooking......");
try{
XposedHelpers.findAndHookConstructor("com.xiaojianbang.hook.Money", loadPackageParam.classLoader,
String.class,
int.class,
new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
String args1 = (String) param.args[0];
int args2 = (int) param.args[1];
Log.d("xiaojianbangXposed", "Money Constructor afterHookedMethod" + args1 + " " + args2);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Log.d("xiaojianbangXposed", "Money Constructor beforeHookedMethod");
}
});
Class<?> aClass = XposedHelpers.findClass("com.xiaojianbang.hook.Wallet", loadPackageParam.classLoader);
XposedHelpers.findAndHookConstructor(aClass,
String.class,
String.class,
int.class,
new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
param.args[0] = "ruyi";
param.args[2] = 10000;
Log.d("xiaojianbangXposed", "Wallet Constructor beforeHookedMethod");
}
});
XposedHelpers.findAndHookMethod("com.xiaojianbang.hook.Money", loadPackageParam.classLoader,
"getInfo",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Class<?> aClass1 = XposedHelpers.findClass("com.xiaojianbang.hook.Money", loadPackageParam.classLoader);
String flag = (String)XposedHelpers.getStaticObjectField(aClass1, "flag");
Log.d("xiaojianbangXposed", "Money flag getStaticObjectField " + flag);
XposedHelpers.setStaticObjectField(aClass1, "flag", "QQ285092564");
String currency = (String) XposedHelpers.getObjectField(param.thisObject, "currency");
int amount = XposedHelpers.getIntField(param.thisObject, "amount");
String retval = (String) param.getResult();
Log.d("xiaojianbangXposed", "Money getInfo afterHookedMethod " + retval + " " + currency + " " + amount);
}
}
);
XposedHelpers.findAndHookMethod("com.xiaojianbang.hook.Utils", loadPackageParam.classLoader,
"getCalc",
int.class,
int.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
param.setResult(10000);
Log.d("xiaojianbangXposed", "Utils getCalc afterHookedMethod");
}
}
);
}catch (Exception e){
e.printStackTrace();
}
}
}
|
注意：获取静态字段的时候要注意时机，太早了会获取不到
hook自定义类参数
XposedHelpers.findAndHookMethod("com.xiaojianbang.hook.Wallet", loadPackageParam.classLoader,
"deposit",
Class.forName("com.xiaojianbang.hook.Money", false, loadPackageParam.classLoader),
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Log.d("xiaojianbangXposed", "Wallet deposit afterHookedMethod 111");
}
});
|
hook匿名类与内部类
匿名类用$加数字，内部类$加名字
XposedHelpers.findAndHookMethod("com.xiaojianbang.app.MainActivity$1", loadPackageParam.classLoader,
"getInfo",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Class<?> aClass = XposedHelpers.findClass("com.xiaojianbang.app.MainActivity$1", loadPackageParam.classLoader);
String result = (String) param.getResult();
Log.d("xiaojianbangXposed", "MainActivity getInfo afterHookedMethod " + result);
}
});
|
替换函数
XposedHelpers.findAndHookMethod("com.xiaojianbang.hook.Wallet", loadPackageParam.classLoader,
"deposit",
"com.xiaojianbang.hook.Money",
new XC_MethodReplacement() {
@Override
protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
Log.d("xiaojianbangXposed", "Money getInfo replaceHookedMethod " + methodHookParam.args[0]);
return true;
}
});
|
打印函数堆栈
Log.e("xiaojianbangXposed", "", new Throwable("stack dump"));
|
主动调用
静态方法
int result = (int)XposedHelpers.callStaticMethod(
XposedHelpers.findClass("com.xiaojianbang.hook.Utils", loadPackageParam.classLoader),
"getCalc", 1, 1);
Log.d("xiaojianbangXposed", "Utils callStaticMethod " + result);
|
实例方法
XposedHelpers.findAndHookMethod("com.xiaojianbang.hook.Money", loadPackageParam.classLoader,
"getInfo",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
String currency =(String) XposedHelpers.callMethod(param.thisObject, "getCurrency");
Log.d("xiaojianbangXposed", "callMethod "+ currency);
}
});
|
反射主动调用
Class<?> aClass = Class.forName("com.xiaojianbang.hook.Utils", false, loadPackageParam.classLoader);
Method getCalc = aClass.getDeclaredMethod("getCalc", int.class, int.class);
Object invoke = getCalc.invoke(null, 100, 200);
Log.d("xiaojianbangXposed", "invoke: " + invoke);
Log.d("xiaojianbangXposed", "invoke int : " + (int)invoke);
|
hook方法的所有重载
XposedBridge.hookAllMethods(XposedHelpers.findClass("com.xiaojianbang.hook.Utils", loadPackageParam.classLoader)
, "getCalc", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
for (int i = 0; i < param.args.length; i++) {
Log.d("xiaojianbangXposed", "Utils getCalc: " + param.args[i]);
}
Log.d("xiaojianbangXposed", "====================================");
}
});
XposedBridge.hookAllMethods(XposedHelpers.findClass("com.xiaojianbang.hook.Utils", loadPackageParam.classLoader)
, "myPrint", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
for (int i = 0; i < param.args.length; i++) {
Log.d("xiaojianbangXposed", "Utils getCalc: " + param.args[i] + " type: " + param.args[i].getClass().getName());
}
Log.d("xiaojianbangXposed", "====================================");
}
});
XposedHelpers.findAndHookMethod(XposedHelpers.findClass("com.xiaojianbang.hook.Utils", loadPackageParam.classLoader),
"myPrint",
"[Ljava.lang.Object;", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
Log.d("xiaojianbangXposed", "Utils getCalc: " + param.args[0] + " type: " + param.args[0].getClass().getName());
}
});
|
hook类的所有方法
Class<?> aClass = XposedHelpers.findClass("com.xiaojianbang.hook.Utils", loadPackageParam.classLoader);
Method[] declaredMethods = aClass.getDeclaredMethods();
for (int i = 0; i < declaredMethods.length; i++) {
Method method = declaredMethods[i];
int modifier = method.getModifiers();
if (!Modifier.isAbstract(modifier) &&
!Modifier.isNative(modifier) &&
!Modifier.isInterface(modifier)) {
XposedBridge.hookMethod(method, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
Log.d("xiaojianbangXposed", "Utils declaredMethods is hooked : " + method);
}
});
}
}
|
