通过hook思想拦截系统APi（startActivity）并跳转到没注册过的Activity

最新推荐文章于 2024-04-25 22:55:04 发布

原创最新推荐文章于 2024-04-25 22:55:04 发布 · 948 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#hook #拦截startactivity方法

android 专栏收录该内容

19 篇文章

订阅专栏

本文介绍了如何通过hook技术拦截Android系统的startActivity方法，即使Activity没有注册也能启动。首先分析了startActivity的调用流程，发现关键在于ActivityManagerNative的IActivityManager接口。利用动态代理，替换单例中的mInstance对象，实现在不注册Activity的情况下启动。然后，通过傀儡Activity加载并替换目标Activity，最后在Handler中进行hook操作，确保在onFinish后恢复原状。

hook俗称钩子可以对系统api进行拦截做一些自己的操作，如何拦截我们android中的startActivity方法呢，并且在不注册activity的情况下去启动activity。首先我们先看下startActivity方法是怎样调用的吧。、

点开startActivity方法我们发现先重写了startActivity

@Override
    public void startActivity(Intent intent) {
        this.startActivity(intent, null);
    }
    @Override
    public void startActivity(Intent intent, @Nullable Bundle options) {
        if (options != null) {
            startActivityForResult(intent, -1, options);
        } else {
            // Note we want to go through this call for compatibility with
            // applications that may have overridden the method.
            startActivityForResult(intent, -1);
        }
    }

再去看startActivityForResult(intent, -1)这个源码

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode) {
        startActivityForResult(intent, requestCode, null);
    }
    还是重写了startActivityForResult
    public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);
            if (ar != null) {
                mMainThread.sendActivityResult(
                    mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                    ar.getResultData());
            }
            if (requestCode >= 0) {
                // If this start is requesting a result, we can avoid making
                // the activity visible until the result is received.  Setting
                // this code during onCreate(Bundle savedInstanceState) or onResume() will keep the
                // activity hidden during this time, to avoid flickering.
                // This can only be done when a result is requested because
                // that guarantees we will get information back when the
                // activity is finished, no matter what happens to it.
                mStartedActivity = true;
            }

            cancelInputsAndStartExitTransition(options);
            // TODO Consider clearing/flushing other event sources and events for child windows.
        } else {
            if (options != null) {
                mParent.startActivityFromChild(this, intent, requestCode, options);
            } else {
                // Note we want to go through this method for compatibility with
                // existing applications that may have overridden it.
                mParent.startActivityFromChild(this, intent, requestCode);
            }
        }
    }

关键的地方来了，这行代码好像是execStartActivity启动了activity，那我们看下Instrumentation这个类里边的execStartActivity方法都干了什么

Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);

进入Instrumentation找到execStartActivity

public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {
        IApplicationThread whoThread = (IApplicationThread) contextThread;
        Uri referrer = target != null ? target.onProvideReferrer() : null;
        if (referrer != null) {
            intent.putExtra(Intent.EXTRA_REFERRER, referrer);
        }
        if (mActivityMonitors != null) {
            synchronized (mSync) {
                final int N = mActivityMonitors.size();
                for (int i=0; i<N; i++) {
                    final ActivityMonitor am = mActivityMonitors.get(i);
                    if (am.match(who, null, intent)) {
                        am.mHits++;
                        if (am.isBlocking()) {
                            return requestCode >= 0 ? am.getResult() : null;
                        }
                        break;
                    }
                }
            }
        }
        try {
            intent.migrateExtraStreamToClipData();
            intent.prepareToLeaveProcess(who);
            int result = ActivityManagerNative.getDefault()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target != null ? target.mEmbeddedID : null,
                        requestCode, 0, null, options);
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

看下这行代码我们发现了startActivity方法，原来是ActivityManagerNative.getDefault()调用了startActivity方法。

int result = ActivityManagerNative.getDefault()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target != null ? target.mEmbeddedID : null,
                        requestCode, 0, null, options);
            checkStartActivityResult(result, intent);

我们在进入ActivityManagerNative中的getDefault方法，它返回的对象是一个IActivityManager 接口，我们先看gDefault这个对象究竟是谁，之后再去看IActivityManager有什么值得查看的方法；

static public IActivityManager getDefault() {
        return gDefault.get();
    }

进入gDefault，发现是一个Singleton类，而且泛型是IActivityManager。

private static final Singleton<IActivityManager> gDefault = new Singleton<IActivityManager>() {
        protected IActivityManager create() {
            IBinder b = ServiceManager.getService("activity");
            if (false) {
                Log.v("ActivityManager", "default service binder = " + b);
            }
            IActivityManager am = asInterface(b);
            if (false) {
                Log.v("ActivityManager", "default service = " + am);
            }
            return am;
        }
    };
}

进入Singleton（这个类是我在线查看的源码http://androidxref.com/7.1.2_r36/xref/frameworks/base/core/java/android/util/Singleton.java）类中找到了get方法，发现这是一个单例模式

7package android.util;
18
19/**
20 * Singleton helper class for lazily initialization.
21 *
22 * Modeled after frameworks/base/include/utils/Singleton.h
23 *
24 * @hide
25 */
26public abstract class Singleton<T> {
27    private T mInstance;
28
29    protected abstract T create();
30
31    public final T get() {
32        synchronized (this) {
33            if (mInstance == null) {
34                mInstance = create();
35            }
36            return mInstance;
37        }
38    }
39}
40

那么就是说是mInstance这个对象启动了activity，mInstance = ActivityManagerNative.getDefault() ；并且这个对象是ActivityManagerNative类型的，mInstance算是ActivityManagerNative的代理对象了。

public interface IActivityManager extends IInterface {
    public int startActivity(IApplicationThread caller, String callingPackage, Intent intent,
            String resolvedType, IBinder resultTo, String resultWho, int requestCode, int flags,
            ProfilerInfo profilerInfo, Bundle options) throws RemoteException;

IActivityManager 中的方法startActivity验证了mInstance启动了activity。
同时我们的hook条件也得到了满足，有单例类，有静态变量。
我们可以通过动态代理来实现hook去替换掉mInstance ，IActivityManager 这个接口也满足动态代理的条件。
我们先去得到gDefault对象，在通过gDefault对象得到mInstance对象。

 Class amnClass = Class.forName("android.app.ActivityManagerNative");
        Field gDefaultField = amnClass.getDeclaredField("gDefault");
        gDefaultField.setAccessible(true);
        gDefaultObj = gDefaultField.get(null);

得到了gDefaultObj 对象，再去得到mInstance对象；

 Class singletonClass = Class.forName("android.util.Singleton");
        mInstanceField = singletonClass.getDeclaredField("mInstance");
        mInstanceField.setAccessible(true);
        mInstanceObj = mInstanceField.get(gDefaultObj);

我们在去拿到IActivityManager这个类型的class。动态代理会用到。

Class iamClass = Class.forName("android.app.IActivityManager");

通过内部匿名类的方式实现

Object newmInstanceObj = Proxy.newProxyInstance(iamClass.getClassLoader(), new Class[]{iamClass}, new InvocationHandler() {
            @Override
            public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
                /*startActivity(IApplicationThread caller, String callingPackage, Intent intent,
                        String resolvedType, IBinder resultTo, String resultWho, int requestCode, int flags,
                ProfilerInfo profilerInfo, Bundle options) throws RemoteException;*/
                if(method.getName().equals("startActivity")){
          
                }
                return  method.invoke(mInstanceObj,args);
            }
        });

method.invoke(mInstanceObj,args)返回的对象就是一个新的mInstance。重新赋值给原来的mInstance。

mInstanceField.set(gDefaultObj,newmInstanceObj);

我们的hook就完成了，调用startActivity时就会执行。

接下来我们继续学习如何加载没有注册过的Activity。
首先我们先注册一个傀儡Activity,启动Activity时先去加载这个傀儡Activity，加载完成之后我们再把我们的目标Activity替换过来。
把动态代理改一下

Object newmInstanceObj = Proxy.newProxyInstance(iamClass.getClassLoader(), new Class[]{iamClass}, new InvocationHandler() {
            @Override
            public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
                /*startActivity(IApplicationThread caller, String callingPackage, Intent intent,
                        String resolvedType, IBinder resultTo, String resultWho, int requestCode, int flags,
                ProfilerInfo profilerInfo, Bundle options) throws RemoteException;*/
                if(method.getName().equals("startActivity")){
                    Toast.makeText(HookActivity.this,"我拦截到了startActivity方法",Toast.LENGTH_SHORT).show();
                    Intent targetIntent = (Intent)args[2];//要跳转的intent
                    Intent proxyIntent = new Intent();
                    ComponentName componentName = new ComponentName(HookActivity.this,PuppetActivity.class);
                    proxyIntent.setComponent(componentName);
                    proxyIntent.putExtra("target_intent", targetIntent);
                    args[2] = proxyIntent;
                    return  method.invoke(mInstanceObj,args);
                }
                return  method.invoke(mInstanceObj,args);
            }
        });

再去hook Handler把傀儡Activity替换成目标Activity。

 public void hookHandler() {
        try {
            Class<?> activityThreadClass = Class.forName("android.app.ActivityThread");
            Method currentActivityThreadMethod = activityThreadClass.getDeclaredMethod("currentActivityThread");
            currentActivityThreadMethod.setAccessible(true);
            Object activityThread = currentActivityThreadMethod.invoke(null);
            Field mH = activityThreadClass.getDeclaredField("mH");
            mH.setAccessible(true);
            Handler handler = (Handler) mH.get(activityThread);
            Field mCallBack = Handler.class.getDeclaredField("mCallback");
            mCallBack.setAccessible(true);
            mCallBack.set(handler, new ActivityThreadHandlerCallback(handler)) ;
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
    private class ActivityThreadHandlerCallback implements Handler.Callback {
        private Handler handler;
        private ActivityThreadHandlerCallback(Handler handler) {
            this.handler = handler;
        }
        @Override
        public boolean handleMessage(Message msg) {
            if (msg.what ==100) {
                handleLauchActivity(msg);
            }
            handler.handleMessage(msg);
            return true;
        }
        private void handleLauchActivity(Message msg) {
            Object obj = msg.obj;
            try{
                Field intentField = obj.getClass().getDeclaredField("intent");
                intentField.setAccessible(true);
                Intent proxyInent = (Intent) intentField.get(obj);
                Intent realIntent = proxyInent.getParcelableExtra("target_intent");
                if (realIntent != null) {
                    proxyInent.setComponent(realIntent.getComponent());
                }
            }catch (Exception e){
            }
        }
    }

因为mInstance是单例的，如果替换了会影响所有的Activity启动，所有要在onFinish中把修改过的值替换为原来的。

@Override
    public void finish() {
        super.finish();
        try {
            mInstanceField.set(gDefaultObj,mInstanceObj);
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
    }

完整代码：

public class HookActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_hook);
        try {
            hook();
        } catch (Exception e) {
            e.printStackTrace();
        }
        findViewById(R.id.btn).setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                startActivity(new Intent(HookActivity.this,NoRegisterXMlActivity.class));
            }
        });
    }
    @Override
    public void onAttachedToWindow() {
        super.onAttachedToWindow();

    }
    private boolean isHook = false;
    private Object mInstanceObj;
    private Field mInstanceField;
    private Object gDefaultObj;
    public void hook()throws Exception{
        //startActivity(new Intent(this,MainActivity.class));
        //先得到gDefault对象 其实是Singleton的对象。
        Class amnClass = Class.forName("android.app.ActivityManagerNative");
        Field gDefaultField = amnClass.getDeclaredField("gDefault");
        gDefaultField.setAccessible(true);
        gDefaultObj = gDefaultField.get(null);
        //通过gDefault对象拿到Singleton的成员变量mInstance。
        Class singletonClass = Class.forName("android.util.Singleton");
        mInstanceField = singletonClass.getDeclaredField("mInstance");
        mInstanceField.setAccessible(true);
        mInstanceObj = mInstanceField.get(gDefaultObj);
        //拿到实现了startActivity方法的接口类IActivityManager。
        Class iamClass = Class.forName("android.app.IActivityManager");
        //通过动态代理去拦截startActivity方法，并且返回一个IActivityManager代理对象。
        Object newmInstanceObj = Proxy.newProxyInstance(iamClass.getClassLoader(), new Class[]{iamClass}, new InvocationHandler() {
            @Override
            public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
                /*startActivity(IApplicationThread caller, String callingPackage, Intent intent,
                        String resolvedType, IBinder resultTo, String resultWho, int requestCode, int flags,
                ProfilerInfo profilerInfo, Bundle options) throws RemoteException;*/
                if(method.getName().equals("startActivity")){
                    Toast.makeText(HookActivity.this,"我拦截到了startActivity方法",Toast.LENGTH_SHORT).show();
                    Intent targetIntent = (Intent)args[2];//要跳转的intent
                    Intent proxyIntent = new Intent();
                    ComponentName componentName = new ComponentName(HookActivity.this,PuppetActivity.class);
                    proxyIntent.setComponent(componentName);
                    proxyIntent.putExtra("target_intent", targetIntent);
                    args[2] = proxyIntent;
                    return  method.invoke(mInstanceObj,args);
                }
                return  method.invoke(mInstanceObj,args);
            }
        });
        //对之前的对象进行替换。
        if(newmInstanceObj==null){
            return;
        }
        mInstanceField.set(gDefaultObj,newmInstanceObj);
        hookHandler();
        Toast.makeText(HookActivity.this,"我完成了",Toast.LENGTH_SHORT).show();
    }

    @Override
    public void finish() {
        super.finish();
        try {
            mInstanceField.set(gDefaultObj,mInstanceObj);
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
    }

    public void hookHandler() {
        try {
            Class<?> activityThreadClass = Class.forName("android.app.ActivityThread");
            Method currentActivityThreadMethod = activityThreadClass.getDeclaredMethod("currentActivityThread");
            currentActivityThreadMethod.setAccessible(true);
            Object activityThread = currentActivityThreadMethod.invoke(null);
            Field mH = activityThreadClass.getDeclaredField("mH");
            mH.setAccessible(true);
            Handler handler = (Handler) mH.get(activityThread);
            Field mCallBack = Handler.class.getDeclaredField("mCallback");
            mCallBack.setAccessible(true);
            mCallBack.set(handler, new ActivityThreadHandlerCallback(handler)) ;
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
    private class ActivityThreadHandlerCallback implements Handler.Callback {

        private Handler handler;

        private ActivityThreadHandlerCallback(Handler handler) {
            this.handler = handler;
        }

        @Override
        public boolean handleMessage(Message msg) {
            if (msg.what ==100) {
                handleLauchActivity(msg);
            }
            handler.handleMessage(msg);
            return true;
        }
        private void handleLauchActivity(Message msg) {
            Object obj = msg.obj;
            try{
                Field intentField = obj.getClass().getDeclaredField("intent");
                intentField.setAccessible(true);
                Intent proxyInent = (Intent) intentField.get(obj);
                Intent realIntent = proxyInent.getParcelableExtra("target_intent");
                if (realIntent != null) {
                    proxyInent.setComponent(realIntent.getComponent());
                }
            }catch (Exception e){
            }
        }
    }
}