android权限管理, API劫持, xposed, xprivacy

预备知识参考： 认识理解zygote

xposed code:

https://github.com/rovo89

http://blog.youkuaiyun.com/wxyyxc1992/article/details/17320911

修改版本的app_process main()

与原始版本区别如下：（原始版本分析参加“认识理解zygote"）

main()

call xposed::initialize()    //some check, add  /system/framework/XposedBridge.jar to classpath

runtime.start(de.robv.android.xposed.XposedBridge, args)

......   //与原始版本相同

startVM()

xposed::onVmCreated(env)      

load libxposed_dalvik.so or libxposed_art.so

libxposed_art.onVmCreated(env)

call register_natives_XposedBridge() to register native method

...... 

call  de.robv.android.xposed.XposedBridge.main()

XposedBridge_initNative()

initForZygote()

findAndHookMethod for some methods...

add new XC_MethodHook to callbacks

call XposedBridge_hookMethodNative to replace the mothed as native function: hookedMethodCallback

loadModules()

load modules and register hook method

com.android.internal.os.ZygoteInit. main ( )

被hook的方法调用时会调用到 hookedMethodCallback

hookedMethodCallback

xposedHandleHookedMethod -> XposedBridge::handleHookedMethod

iterate all registered methodhook, call it's beforeHookedMethod()

call orginal method,

iterate all registered methodhook,  call it's afterHookedMethod()

An example module: XPrivacy   

https://github.com/M66B/XPrivacy

初始化

in XPosed.loadModules() -> loadModule() 

XPrivacy.initZygote()

hook com.android.server.SystemServer.main to call PrivacyService.register to register PrivacyService to ServiceManager.

hookZygote()     //hook all ....

for example: hookAll(XTelephonyManager.getInstances(null, false), null, mSecret, false);

create method hook objects.

call XposedBridge.hookMethod to hook orignal method.

使用：

TelephonyManager.getDeviceId()

intercepted by XPosed

XTelephonyManager.before()          //No Op

TelephonyManager.getDeviceId()
XTelephonyManager.after()           //get value from PrivacyManager, set to result param