android+xposed插件,初探Xposed 插件开发

1.之前手机上要是想要使用Xposed 功能必须root,然后我们并不想root,或者麻烦，偶尔看到了下面的APP,毫不犹豫用上了xpost

2.详细使用指南看官网把，简单就是单独开了个沙盒，不需要在root了

3.插件开发准备

image.png

添加依赖

dependencies {

provided fileTree(include: ['*.jar'], dir: 'libs')

//noinspection GradleCompatible

compile 'com.android.support:appcompat-v7:24.2.1'

}

4.写一个类实现与IXposedHookLoadPackage

public class Xp implements IXposedHookLoadPackage {

@Override

public void handleLoadPackage(LoadPackageParam loadPackageParam) throws Throwable {

Log.e("handleLoadPackage",loadPackageParam.packageName);

if ("你需要hook的包名".equals(loadPackageParam.packageName)){

XposedBridge.log("开始hook");

XposedHelpers.findAndHookMethod("你需要完全hook的类名", loadPackageParam.classLoader,"需要hook的方法名",“需要hook的方法的参数，没有可以空出来”, new XC_MethodHook() {

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

super.beforeHookedMethod(param);

}

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

Class clazz = param.thisObject.getClass();

Field field = clazz.getDeclaredField("iv_headImage");

field.setAccessible(true);

Log.e("handleLoadPackage",field.getName());

((ImageView) field.get(param.thisObject)).setVisibility(View.GONE);

}

});

}

}

}

5. 在assets资源目录下建立一个文件

image.png

上面的例子就是简单实现hook界面的图片隐藏。

跑完毕之后我们在xpost框架中间就可以看到我们开发的插件

image.png

以上就是开发一个插件的简单步奏，开发插件主要是要看懂反编译的apk，知道他大概的流程，从而找到具体的属性，方法入手，从而改变成我们想要的结果。

6.如果有时候我们的应用是多个dex使用上面的方法就可能失效，所以推荐使用下面的方法，一下就是我屏蔽某个应用的欢迎界面的代码

public class Xp implements IXposedHookLoadPackage {

private static final String FILTER_PKGNAME = "cn.com.open.mooc";

@Override

public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {

Log.e("handleLoadPackage", loadPackageParam.packageName);

/* XposedHelpers.findAndHookConstructor("java.net.URL", loadPackageParam.classLoader, String.class, new XC_MethodHook() {

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

String url = (String) param.args[0];

param.args[0] = "http://www.baidu.com/";

Log.e("handleLoadPackage",url);

}

});*/

if(FILTER_PKGNAME.equals(loadPackageParam.packageName)){

//这里是为了解决app多dex进行hook的问题，Xposed默认是hook主dex

XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

ClassLoader cl = ((Context)param.args[0]).getClassLoader();

Class> aClass = cl.loadClass("com.imooc.component.imoocmain.splash.MCSplashActivity");

XposedHelpers.findAndHookMethod(aClass, "onCreate", Bundle.class, new XC_MethodHook() {

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

Log.e("handleLoadPackage","beforeHookedMethod");

super.beforeHookedMethod(param);

}

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

Log.e("handleLoadPackage","afterHookedMethod");

Activity activity = (Activity) param.thisObject;

Intent intent = new Intent();

intent.setClassName(activity,"com.imooc.component.imoocmain.index.MCMainActivity");

activity.startActivity(intent);

super.afterHookedMethod(param);

}

});

}

});

}

/* XposedHelpers.findAndHookMethod("com.squareup.okhttp.HttpUrl",

loadPackageParam.classLoader, "openConnection", new XC_MethodHook() {

@SuppressLint("WrongConstant")

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

super.beforeHookedMethod(param);

URL url = (URL) param.thisObject;

Log.e("handleLoadPackage", url.get);

*//* Activity activity = (Activity) param.thisObject;

Intent intent = new Intent();

intent.setClassName(activity, "com.imooc.component.imoocmain.index.MCMainActivity");

activity.startActivity(intent);

activity.finish();*//*

}

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

Log.e("handleLoadPackage", "afterHookedMethod");

}

});*/

}

}

上面的思路就是hook主欢迎界面的onCreate方法,然后直接跳转到首页。

7 hook微信显示Menu

package com.test.gradletask;

import android.app.Application;

import android.content.Context;

import android.util.Log;

import android.view.Menu;

import android.view.MenuItem;

import de.robv.android.xposed.IXposedHookLoadPackage;

import de.robv.android.xposed.XC_MethodHook;

import de.robv.android.xposed.XposedBridge;

import de.robv.android.xposed.XposedHelpers;

import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

/**

* 项目名称：GradleTask

* 类描述：

* 创建人：Administrator

* 创建时间：2018/3/12 10:46

* 修改人：Administrator

* 修改时间：2018/3/12 10:46

* 修改备注：

* 联系方式：906514731@qq.com

*/

public class Man implements IXposedHookLoadPackage {

private static final String FILTER_PKGNAME = "com.tencent.mm";

@Override

public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {

Log.e("handleLoadPackage", loadPackageParam.packageName);

if (FILTER_PKGNAME.equals(loadPackageParam.packageName)) {

//这里是为了解决app多dex进行hook的问题，Xposed默认是hook主dex

XposedHelpers

.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

final ClassLoader cl = ((Context) param.args[0]).getClassLoader();

final Class> aClass = cl

.loadClass("com.tencent.mm.ui.LauncherUI");

XposedHelpers

.findAndHookMethod(aClass, "onCreateOptionsMenu", Menu.class, new XC_MethodHook() {

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

Log.e("handleLoadPackage", "beforeHookedMethod");

super.beforeHookedMethod(param);

}

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

Log.e("handleLoadPackage", "afterHookedMethod");

Menu menu=(Menu) param.args[0];

menu.add(0,3,0,"1b");

menu.add(0,4,0,"2b");

menu.add(0,5,0,"3b");

menu.add(0,6,0,"4b");

menu.add(0,7,0,"5b");

menu.add(0,8,0,"sb");

for(int i=0;i

menu.getItem(i).setOnMenuItemClickListener(new MenuItem.OnMenuItemClickListener() {

@Override

public boolean onMenuItemClick(MenuItem item) {

XposedBridge.log("你点击了");

Toast.makeText(((Context) param.thisObject),"点击了",Toast.LENGTH_SHORT).show();

Log.e("handleLoadPackage","你点击了");

return false;

}

});

}

super.afterHookedMethod(param);

}

});

}

});

}

}

}

image.png

7.xposed如果我们调用的参数是反编译APP类型，需要这样处理

public class Man implements IXposedHookLoadPackage {

private static final String FILTER_PKGNAME = "com.shuofeng.dl.application";

@Override

public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {

Log.e("handleLoadPackage", loadPackageParam.packageName);

if (FILTER_PKGNAME.equals(loadPackageParam.packageName)) {

//这里是为了解决app多dex进行hook的问题，Xposed默认是hook主dex

XposedHelpers

.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

ClassLoader cl = ((Context) param.args[0]).getClassLoader();

Class> aClass = cl.loadClass("com.shuofeng.dl.application.sf.GetUserStatu");

XposedHelpers

.findAndHookMethod(aClass, "autologin", cl.loadClass("com.shuofeng.dl.application.sf.callbackinterface"),new XC_MethodHook() {

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

super.beforeHookedMethod(param);

Log.e("handleLoadPackage","beforeHookedMethod");

}

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

Log.e("handleLoadPackage", "afterHookedMethod");

}

});

}

});

}

}

}

中间参数类型，我们使用目标APP的全类名就可以了