Xposed环境安装

朱雀 2023-10-03 14:19 30阅读 0赞

### 一、Xposed 框架实现 Hook 的原理介绍 ###

Zygote是Android的核心，每运行一个app，Zygote就会fork一个虚拟机实例来运行app，  
Xposed Framework深入到了Android核心机制中，通过改造Zygote来实现一些很牛逼的  
功能。Zygote的启动配置在init.rc 脚 本 中，由系统启动的时候开启此进程，对应的  
执行文件是/system/bin/app\_process，这个文件完成类库加载及一些函数调用的工作。  
当系统中安装了Xposed Framework之后，会对app\_process进行扩展，也就是说，Xposed  
Framework 会拿自己实现的app\_process覆盖掉Android原生提供的app\_process文件，  
当系统启动的时候，就会加载由 Xposed Framework 替换过的进程文件，并且，Xposed  
Framework 还定义了一个 jar 包，系统启动的时候，也会加载这个包：  
/data/data/de.robv.android.xposed.installer/bin/XposedBridge.jar

### 二、Xposed框架运行的条件 ###

1.Rooted Device / Emulator （已root的手机或者模拟器）  
2.Xposed Installer (Xposed安装程序下载)  
3.Hooking Android App （要被Hook的目标 App）

### 三、安装过程 ###

##### 1. 推荐下载 Xposed3.1.5 版本，XposedInstaller\_3.1.5.zip。 #####

下载安装后，若科学上网可以直接激活，之前http改为https需要搭梯子。  
![请添加图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg_size_16_color_FFFFFF_t_70]

##### 2.离线激活方式： #####

https://dl-xda.xposed.info/framework/ 从该网址找到自己的手机API - sdk对应的版本 （arm|x86）（32 | 64位）

eg: 雷电模拟器 4.0.43 版本 - 》 （X86 api 25）  
![请添加图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg_size_16_color_FFFFFF_t_70 1]

\-> 下载25版本https://dl-xda.xposed.info/framework/sdk25

![请添加图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg_size_16_color_FFFFFF_t_70 2]

##### 3.下载后将压缩包中的 system 解压到一个新建文件夹中，再将以下 script.sh shell脚本放置该文件中： #####

![请添加图片描述][fce49e24186c4b8683f82be28f50cc8e.png]

##########################################################################################
    #
    # Xposed framework installer zip.
    #
    # This script installs the Xposed framework files to the system partition.
    # The Xposed Installer app is needed as well to manage the installed modules.
    #
    ##########################################################################################
    
    grep_prop() {
        
      REGEX="s/^$1=//p"
      shift
      FILES=$@
      if [ -z "$FILES" ]; then
        FILES='/system/build.prop'
      fi
      cat $FILES 2>/dev/null | sed -n $REGEX | head -n 1
    }
    
    android_version() {
        
      case $1 in
        15) echo '4.0 / SDK'$1;;
        16) echo '4.1 / SDK'$1;;
        17) echo '4.2 / SDK'$1;;
        18) echo '4.3 / SDK'$1;;
        19) echo '4.4 / SDK'$1;;
        21) echo '5.0 / SDK'$1;;
        22) echo '5.1 / SDK'$1;;
        23) echo '6.0 / SDK'$1;;
        24) echo '7.0 / SDK'$1;;
        25) echo '7.1 / SDK'$1;;
        26) echo '8.0 / SDK'$1;;
        27) echo '8.1 / SDK'$1;;
        *)  echo 'SDK'$1;;
      esac
    }
    
    cp_perm() {
        
      cp -f $1 $2 || exit 1
      set_perm $2 $3 $4 $5 $6
    }
    
    set_perm() {
        
      chown $2:$3 $1 || exit 1
      chmod $4 $1 || exit 1
      if [ "$5" ]; then
        chcon $5 $1 2>/dev/null
      else
        chcon 'u:object_r:system_file:s0' $1 2>/dev/null
      fi
    }
    
    install_nobackup() {
        
      cp_perm ./$1 $1 $2 $3 $4 $5
    }
    
    install_and_link() {
        
      TARGET=$1
      XPOSED="${1}_xposed"
      BACKUP="${1}_original"
      if [ ! -f ./$XPOSED ]; then
        return
      fi
      cp_perm ./$XPOSED $XPOSED $2 $3 $4 $5
      if [ ! -f $BACKUP ]; then
        mv $TARGET $BACKUP || exit 1
        ln -s $XPOSED $TARGET || exit 1
        chcon -h 'u:object_r:system_file:s0' $TARGET 2>/dev/null
      fi
    }
    
    install_overwrite() {
        
      TARGET=$1
      if [ ! -f ./$TARGET ]; then
        return
      fi
      BACKUP="${1}.orig"
      NO_ORIG="${1}.no_orig"
      if [ ! -f $TARGET ]; then
        touch $NO_ORIG || exit 1
        set_perm $NO_ORIG 0 0 600
      elif [ -f $BACKUP ]; then
        rm -f $TARGET
        gzip $BACKUP || exit 1
        set_perm "${BACKUP}.gz" 0 0 600
      elif [ ! -f "${BACKUP}.gz" -a ! -f $NO_ORIG ]; then
        mv $TARGET $BACKUP || exit 1
        gzip $BACKUP || exit 1
        set_perm "${BACKUP}.gz" 0 0 600
      fi
      cp_perm ./$TARGET $TARGET $2 $3 $4 $5
    }
    
    ##########################################################################################
    
    echo "**************************"
    echo "Xposed framework installer"
    echo "**************************"
    
    if [ ! -f "system/xposed.prop" ]; then
      echo "! Failed: Extracted file system/xposed.prop not found!"
      exit 1
    fi
    
    echo "- Checking environment"
    API=$(grep_prop ro.build.version.sdk)
    APINAME=$(android_version $API)
    ABI=$(grep_prop ro.product.cpu.abi | cut -c-3)
    ABI2=$(grep_prop ro.product.cpu.abi2 | cut -c-3)
    ABILONG=$(grep_prop ro.product.cpu.abi)
    
    XVERSION=$(grep_prop version system/xposed.prop)
    XARCH=$(grep_prop arch system/xposed.prop)
    XMINSDK=$(grep_prop minsdk system/xposed.prop)
    XMAXSDK=$(grep_prop maxsdk system/xposed.prop)
    
    XEXPECTEDSDK=$(android_version $XMINSDK)
    if [ "$XMINSDK" != "$XMAXSDK" ]; then
      XEXPECTEDSDK=$XEXPECTEDSDK' - '$(android_version $XMAXSDK)
    fi
    
    ARCH=arm
    IS64BIT=
    if [ "$ABI" = "x86" ]; then ARCH=x86; fi;
    if [ "$ABI2" = "x86" ]; then ARCH=x86; fi;
    if [ "$API" -ge "21" ]; then
      if [ "$ABILONG" = "arm64-v8a" ]; then ARCH=arm64; IS64BIT=1; fi;
      if [ "$ABILONG" = "x86_64" ]; then ARCH=x86_64; IS64BIT=1; fi;
    fi
    
    # echo "DBG [$API] [$ABI] [$ABI2] [$ABILONG] [$ARCH] [$XARCH] [$XMINSDK] [$XMAXSDK] [$XVERSION]"
    
    echo "  Xposed version: $XVERSION"
    
    XVALID=
    if [ "$ARCH" = "$XARCH" ]; then
      if [ "$API" -ge "$XMINSDK" ]; then
        if [ "$API" -le "$XMAXSDK" ]; then
          XVALID=1
        else
          echo "! Wrong Android version: $APINAME"
          echo "! This file is for: $XEXPECTEDSDK"
        fi
      else
        echo "! Wrong Android version: $APINAME"
        echo "! This file is for: $XEXPECTEDSDK"
      fi
    else
      echo "! Wrong platform: $ARCH"
      echo "! This file is for: $XARCH"
    fi
    
    if [ -z $XVALID ]; then
      echo "! Please download the correct package"
      echo "! for your platform/ROM!"
      exit 1
    fi
    
    echo "- Placing files"
    install_nobackup /system/xposed.prop                      0    0 0644
    install_nobackup /system/framework/XposedBridge.jar       0    0 0644
    
    install_and_link  /system/bin/app_process32               0 2000 0755 u:object_r:zygote_exec:s0
    install_overwrite /system/bin/dex2oat                     0 2000 0755 u:object_r:dex2oat_exec:s0
    install_overwrite /system/bin/oatdump                     0 2000 0755
    install_overwrite /system/bin/patchoat                    0 2000 0755 u:object_r:dex2oat_exec:s0
    install_overwrite /system/lib/libart.so                   0    0 0644
    install_overwrite /system/lib/libart-compiler.so          0    0 0644
    install_overwrite /system/lib/libsigchain.so              0    0 0644
    install_nobackup  /system/lib/libxposed_art.so            0    0 0644
    if [ $IS64BIT ]; then
      install_and_link  /system/bin/app_process64             0 2000 0755 u:object_r:zygote_exec:s0
      install_overwrite /system/lib64/libart.so               0    0 0644
      install_overwrite /system/lib64/libart-compiler.so      0    0 0644
      install_overwrite /system/lib64/libart-disassembler.so  0    0 0644
      install_overwrite /system/lib64/libsigchain.so          0    0 0644
      install_nobackup  /system/lib64/libxposed_art.so        0    0 0644
    fi
    
    mkdir -p /system/priv-app/XposedInstaller
    chmod 0755 /system/priv-app/XposedInstaller
    chcon -h u:object_r:system_file:s0 /system/priv-app/XposedInstaller
    cp system/priv-app/XposedInstaller/XposedInstaller.apk /system/priv-app/XposedInstaller/XposedInstaller.apk 
    chmod 0644 /system/priv-app/XposedInstaller/XposedInstaller.apk
    chcon -h u:object_r:system_file:s0 /system/priv-app/XposedInstaller/XposedInstaller.apk
    
    if [ "$API" -ge "22" ]; then
      find /system /vendor -type f -name '*.odex.gz' 2>/dev/null | while read f; do mv "$f" "$f.xposed"; done
    fi
    
    echo "- Done"
    exit 0

##### 4.将该文件夹push进手机 system 中 ： #####

adb remount
    
    adb push 刚刚创建的文件夹 /system
    
    adb shell 
    
    chmod 777  文件夹名 
    
    chmod 777  文件夹名 /shell脚本
    
    chmod 777  文件夹名 /system

##### 5.运行script.sh脚本： #####

chmod 777  script.sh 
    
    ./script.sh

##### 6.重新手机，再打开xposed框架，成功激活： #####

![请添加图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg_size_16_color_FFFFFF_t_70 3]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/90d18962f4b44f8c8098f0577d97befc.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/12ed5566707f4f2fb1b625d6c26b0687.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/b19a79490c9d46a2ba375d68dfd22f76.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg==,size_16,color_FFFFFF,t_70
[fce49e24186c4b8683f82be28f50cc8e.png]: https://img-blog.csdnimg.cn/fce49e24186c4b8683f82be28f50cc8e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/e9003fc50b48460aace23bc4d53e92d2.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zODkyNzUyMg==,size_16,color_FFFFFF,t_70