Xposed多情况Hook

超、凢脫俗 2023-10-03 13:56 49阅读 0赞

1.Xposed之遍历指定类所有内部类，但不包括匿名内部类

/**
    			 * Xposed之遍历指定类所有内部类，但不包括匿名内部类
    			 * */
    			Class<?> clszz=XposedHelpers.findClass("com.sun.ggactivity.InfoAdapter", lpparam.classLoader);
    			Class<?>[] clszzs=clszz.getDeclaredClasses();
    			XposedBridge.log("内部类个数："+clszzs.length);
    			for (int i = 0; i < clszzs.length; i++) {
        
    				XposedBridge.log("内部类："+clszzs[i].getName());
    			}
    			
    			// 遍历所有的类 解决动态加载dex文件hook不到的问题
    			XposedHelpers.findAndHookMethod(
    					ClassLoader.class, 
    					"loadClass", 
    					String.class,
    					new XC_MethodHook() {
        
    						@Override
    						protected void afterHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    							super.afterHookedMethod(param);
    							Class<?> clazz=(Class<?>) param.getResult();
    							XposedBridge.log("clazz："+clazz.getName());
    						}
    					});

2.HOOK ClassLoader类中的loadClass方法

// HOOK ClassLoader类中的loadClass方法
    			XposedHelpers.findAndHookMethod(ClassLoader.class, "loadClass", 
    					String.class, new XC_MethodHook() {
        
    							@Override
    							protected void afterHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    								super.afterHookedMethod(param);
    								// 获取类
    								Class<?> clszz=(Class<?>) param.getResult();
    								// 获取类名
    								String clszz_name=clszz.getName();
    								// 判断当前类的类名与目标的类名是否相等
    								if(clszz_name.equals("com.sun.ggactivity.InfoAdapter")){
        
    									/**
    									 * Xposed之主动调用
    									 * */
    									XposedHelpers.findAndHookMethod(clszz, "getView", int.class, View.class, 
    										ViewGroup.class, new XC_MethodHook() {
        
    											@Override
    											protected void afterHookedMethod(
    													MethodHookParam param) throws Throwable {
        
    												super.afterHookedMethod(param);
    												//调用方法
    												int num=(Integer) XposedHelpers.callMethod(param.thisObject, "getCount", new Object[0]);
    												XposedBridge.log("item："+num);
    												//获取字段
    												LayoutInflater inflater=(LayoutInflater) XposedHelpers.getObjectField(param.thisObject, "inflater");
    												XposedBridge.log("item："+inflater);
    											}
    									});			
    								}
    							}	
    						});

3.其他模板

import java.lang.reflect.Field;
    import java.lang.reflect.Method;
    import java.security.MessageDigest;
    import java.util.Map;
    
    import android.app.Application;
    import android.content.Context;
    import android.view.LayoutInflater;
    import android.view.View;
    import android.view.ViewGroup;
    import android.widget.EditText;
    import de.robv.android.xposed.IXposedHookLoadPackage;
    import de.robv.android.xposed.XC_MethodHook;
    import de.robv.android.xposed.XC_MethodReplacement;
    import de.robv.android.xposed.XposedBridge;
    import de.robv.android.xposed.XposedHelpers;
    import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
    
    public class XposedHook implements IXposedHookLoadPackage{
        
    
    	/**
    	 * xposed插件入口点
    	 * */
    	@Override
    	public void handleLoadPackage(LoadPackageParam lpparam) 
    			throws Throwable {
        
    		// pparam.processName 获取应用程序包名
    		// XposedBridge.log("当前启动的应用程序是："+pparam.processName);
    		
    		if(lpparam.packageName.equals("包名")){
        
    			XposedBridge.log("编写Xposed插件模板，开启HOOK之路！");
    			//hook 普通方法、静态方法
    			XposedHelpers.findAndHookMethod(
    					"包名.MainActivity", //包名+类名
    					lpparam.classLoader,  //类的加载器
    					"checkSN",   		//方法名
    					String.class,		//参数列表
    					String.class,
    					new XC_MethodHook() {
        
    						/**
    						 * HOOK之前
    						 * 打印参数信息、修改参数
    						 * */
    						@Override
    						protected void beforeHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    							super.beforeHookedMethod(param);
    							XposedBridge.log("userName："+param.args[0]);
    							XposedBridge.log("sn："+param.args[1]);
    
    							// 修改参数
    							//param.args[0]="new values";
    							//param.args[1]="xxx";
    							
    							/**
    							 * 打印方法调用堆栈信息
    							 * */
    							StackTraceElement[] wodelogs= new Throwable("wodelog").getStackTrace();
    							// 使用for循环打印堆栈查看调用关系
    							for(int i=0; i<wodelogs.length; i++){
        
    								XposedBridge.log("查看堆栈："+wodelogs[i].toString());
    							}
    
    						}
    						
    						/**
    						 * HOOK之后
    						 * 打印返回值信息、修改返回值
    						 * */
    						@Override
    						protected void afterHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    							super.afterHookedMethod(param);
    							XposedBridge.log("返回值："+param.getResult());
    							//修改返回值之后
    							//param.setResult(true);
    							// 获取类
    							Class<?> clazz=param.thisObject.getClass();
    							XposedBridge.log("参数："+clazz);
    							/**
    							 * 字段
    							 * */
    							// 获取用户名字段
    							Field user=clazz.getDeclaredField("edit_username");
    							// 设置可以访问
    							user.setAccessible(true);
    							// 获取组件
    							EditText ed_user=(EditText) user.get(param.thisObject);
    							// 获取内容
    							String str_name=ed_user.getText().toString().trim();
    							// 获取注册码字段
    							Field sn=clazz.getDeclaredField("edit_sn");
    							sn.setAccessible(true);
    							EditText ed_sn=(EditText) sn.get(param.thisObject);
    							String str_sn=ed_sn.getText().toString().trim();
    							XposedBridge.log("用户名："+str_name);
    							XposedBridge.log("注册码："+str_sn);
    							
    							/**
    							 * 方法
    							 * */
    							// 指定算法为MD5
    							MessageDigest digest = MessageDigest.getInstance("MD5");
    					        // 初始化
    							digest.reset();
    					        // 更新
    					        digest.update("code".getBytes());
    							// 获取方法
    							Method method=clazz.getDeclaredMethod("toHexString", new Class[]{
        byte[].class,String.class});
    							// 设置可见
    							method.setAccessible(true);
    							// 主动调用方法
    							String hexstr=(String) method.invoke(param.thisObject, new Object[]{
        digest.digest(),""});
    							// 字符串拼接
    							StringBuilder sb = new StringBuilder();
    				            for (int i = 0; i < hexstr.length(); i += 2) {
        
    				                sb.append(hexstr.charAt(i));
    				            }
    				            // 设置编辑框的值
    				            ed_user.setText("code");
    				            ed_sn.setText(sb.toString());
    						}
    					});
    			
    			//hook 匿名内部类
    			XposedHelpers.findAndHookMethod("包名.MainActivity$1", 
    					lpparam.classLoader, "onClick", 
    					View.class,new XC_MethodHook() {
        
    						@Override
    						protected void beforeHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    							super.beforeHookedMethod(param);
    							View view=(View)param.args[0];
    							XposedBridge.log("view："+view.getId());
    						}
    					});
    		}
    		
    		if(lpparam.packageName.equals("com.sun.ggactivity")){
        
    			//获取普通字段
    			//XposedHelpers.getBooleanField(obj, fieldName)
    			//获取静态字段
    			//XposedHelpers.getStaticBooleanField(clazz, fieldName)
    			//主动调用普通方法
    			//XposedHelpers.callMethod(obj, methodName, args)
    			//主动调用静态方法
    			//XposedHelpers.callStaticMethod(clazz, methodName, args)
    			
    			// hook构造方法  不需要填写方法名
    			XposedHelpers.findAndHookConstructor(
    					"com.sun.ggactivity.Module", //包名+类名
    					lpparam.classLoader, 
    					int.class, String.class,//参数列表
    					new XC_MethodHook() {
        
    						@Override
    						protected void beforeHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    							super.beforeHookedMethod(param);
    							//XposedBridge.log("参数1："+param.args[0]);
    							//XposedBridge.log("参数2："+param.args[1]);
    						}
    					});
    			
    			// 获取类
    			Class<?> clazz=XposedHelpers.findClass("com.sun.ggactivity.Module", lpparam.classLoader);
    			// 获取指定类的所有字段
    			Field[]	fields=clazz.getDeclaredFields();
    			for (Field field : fields) {
        
    				XposedBridge.log("字段："+field.toString());
    			}
    			
    			//获取指定类的构造方法
    			//clszz.getDeclaredConstructors();	
    			
    			// 获取指定类的所有方法（普通方法、静态方法）
    			Method[] methods=clazz.getDeclaredMethods();
    			for (Method method : methods) {
        
    				XposedBridge.log("方法："+method.toString());
    			}
    			
    			/**
    			 * Xposed之遍历指定类所有内部类，但不包括匿名内部类
    			 * */
    			Class<?> clszz=XposedHelpers.findClass("com.sun.ggactivity.InfoAdapter", lpparam.classLoader);
    			Class<?>[] clszzs=clszz.getDeclaredClasses();
    			XposedBridge.log("内部类个数："+clszzs.length);
    			for (int i = 0; i < clszzs.length; i++) {
        
    				XposedBridge.log("内部类："+clszzs[i].getName());
    			}
    			
    			// 遍历所有的类 解决动态加载dex文件hook不到的问题
    			XposedHelpers.findAndHookMethod(
    					ClassLoader.class, 
    					"loadClass", 
    					String.class,
    					new XC_MethodHook() {
        
    						@Override
    						protected void afterHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    							super.afterHookedMethod(param);
    							Class<?> clazz=(Class<?>) param.getResult();
    							XposedBridge.log("clazz："+clazz.getName());
    						}
    					});
    			
    			// HOOK ClassLoader类中的loadClass方法
    			XposedHelpers.findAndHookMethod(ClassLoader.class, "loadClass", 
    					String.class, new XC_MethodHook() {
        
    							@Override
    							protected void afterHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    								super.afterHookedMethod(param);
    								// 获取类
    								Class<?> clszz=(Class<?>) param.getResult();
    								// 获取类名
    								String clszz_name=clszz.getName();
    								// 判断当前类的类名与目标的类名是否相等
    								if(clszz_name.equals("com.sun.ggactivity.InfoAdapter")){
        
    									/**
    									 * Xposed之主动调用
    									 * */
    									XposedHelpers.findAndHookMethod(clszz, "getView", int.class, View.class, 
    										ViewGroup.class, new XC_MethodHook() {
        
    											@Override
    											protected void afterHookedMethod(
    													MethodHookParam param) throws Throwable {
        
    												super.afterHookedMethod(param);
    												//调用方法
    												int num=(Integer) XposedHelpers.callMethod(param.thisObject, "getCount", new Object[0]);
    												XposedBridge.log("item："+num);
    												//获取字段
    												LayoutInflater inflater=(LayoutInflater) XposedHelpers.getObjectField(param.thisObject, "inflater");
    												XposedBridge.log("item："+inflater);
    											}
    									});			
    								}
    							}	
    						});
    		}
    		
    		if(lpparam.packageName.equals("com.yunhaoge.tanchishe.egame")){
        
    			/**
    			 * 方法替换：hook指定方法拦截逻辑
    			 * 主动调用
    			 * */
    			final Class<?> clazz=XposedHelpers.findClass("com.sun.zombie.zombie", lpparam.classLoader);
    			XposedHelpers.findAndHookMethod("com.sun.zombie.zombie$3", 
    					lpparam.classLoader, "payCancel", Map.class,
    					new XC_MethodReplacement() {
        
    						
    						@Override
    						protected Object replaceHookedMethod(MethodHookParam arg0) throws Throwable {
        
    							XposedBridge.log("方法替换成功");
    							XposedHelpers.callStaticMethod(clazz, "BuySccess");
    							return null;
    						}
    					});
    			
    			XposedHelpers.findAndHookMethod("com.sun.zombie.zombie$3", 
    					lpparam.classLoader, "payFailed", Map.class,
    					int.class, new XC_MethodReplacement() {
        
    						
    						@Override
    						protected Object replaceHookedMethod(MethodHookParam arg0) throws Throwable {
        
    							XposedBridge.log("方法替换成功");
    							XposedHelpers.callStaticMethod(clazz, "BuySccess");
    							return null;
    						}
    					});
    			
    			//hook Application中的attach方法 解决多dex文件中有些类hook不到的问题
    			XposedHelpers.findAndHookMethod(Application.class, "attach", 
    					Context.class, new XC_MethodHook() {
        
    						@Override
    						protected void beforeHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    							super.beforeHookedMethod(param);
    							Context context=(Context) param.args[0];
    							ClassLoader loader=context.getClassLoader();
    							XposedHelpers.findAndHookMethod(
    									"com.sun.zombie.zombie$3", loader, "payCancel", 
    									Map.class, new XC_MethodHook() {
        
    										@Override
    										protected void beforeHookedMethod(MethodHookParam param)
    												throws Throwable {
        
    											super.beforeHookedMethod(param);
    										}
    									});
    						}
    					});
    		}
    		
    		if(lpparam.packageName.equals("com.renren.mobile.android")){
        
    			/**
    			 * 复杂参数HOOK
    			 * */
    			Class<?> clazz=XposedHelpers.findClass("com.renren.mobile.android.loginfree.LoginStatusListener", lpparam.classLoader);
    			XposedHelpers.findAndHookMethod(
    					"com.renren.mobile.android.service.ServiceProvider", 
    					lpparam.classLoader, "m_RSA_login", String.class,
    					String.class, int.class, String.class, String.class,
    					Context.class, clazz, new XC_MethodHook() {
        
    						@Override
    						protected void beforeHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    							super.beforeHookedMethod(param);
    							XposedBridge.log("参数1："+param.args[0]);
    							XposedBridge.log("参数2："+param.args[1]);
    							XposedBridge.log("参数3："+param.args[2]);
    							XposedBridge.log("参数4："+param.args[3]);
    							XposedBridge.log("参数5："+param.args[4]);
    							XposedBridge.log("参数6："+param.args[5]);
    							XposedBridge.log("参数7："+param.args[6]);
    						}
    					});
    		}
    		
    		// 获取当前程序包名与目标程序包名进行比较
    		if (lpparam.packageName.equals("com.gameley.racercop.cm")) {
        
    			// HOOK ClassLoader类中的loadClass方法
    			XposedHelpers.findAndHookMethod(ClassLoader.class, "loadClass",
    					String.class, new XC_MethodHook() {
        
    						@Override
    						protected void afterHookedMethod(MethodHookParam param)
    								throws Throwable {
        
    							super.afterHookedMethod(param);
    							// 获取类
    							Class<?> clszz = (Class<?>) param.getResult();
    							// 获取类名
    							String clszz_name = clszz.getName();
    							// 判断当前类的类名与目标的类名是否相等
    							if (clszz_name.equals("cn.egame.terminal.paysdk.EgamePayJD$2$1$1")) {
        
    								// 如果相等就hook onResult方法
    								XposedHelpers.findAndHookMethod(clszz,"onResult", int.class, String.class,
    										Object.class, new XC_MethodHook() {
        
    											@Override
    											protected void beforeHookedMethod(MethodHookParam param)
    													throws Throwable {
        
    												super.beforeHookedMethod(param);
    												// 赋值第一个参数，也即int类型的数据为1
    												param.args[0] = 1;
    											}
    										});
    							}
    						}
    					});
    		}
    	}
    }