Xposed模块2

发表于 | 分类于 | 作者：ESE

android studio之Xposed模块开发2

准备

如果你看过前面一篇，那么你对xposed模块的有一定的了解。接着继续来了解更多。

创建一个apk程序

MainActivity

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
package com.ctf.test.xposedlab2;
import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.view.View;
import android.widget.Button;
import android.widget.Toast;
public class MainActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        final Button ok = (Button) findViewById(R.id.ModifystaticVar);
        final Button ok2 = (Button) findViewById(R.id.ModifyResult);
        final Button ok1 = (Button) findViewById(R.id.Modifyparam);
        
        //hook 静态变量
        ok.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                String st = String.valueOf(demo.ModifystaticVar());
                Toast.makeText(MainActivity.this, st, Toast.LENGTH_SHORT).show();
            }
        });
        //hook 方法返回值
        ok2.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                String st = String.valueOf(demo.modifyResult());
                Toast.makeText(MainActivity.this, st, Toast.LENGTH_SHORT).show();
            }
        });
        //hook 方法的传入参数，修改参数
        ok1.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                String st = String.valueOf(demo.Modifyparam(2,3));
                Toast.makeText(MainActivity.this, st, Toast.LENGTH_SHORT).show();
            }
        });
    }
}

demo

创建一个demo类

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
package com.ctf.test.xposedlab2;
public class demo {
    private static  int staticInt = 20;
    public static int ModifystaticVar(){
       return staticInt;
    }
    public static int modifyResult(){
        int a = 5;
        int b = 6;
        return a*b;
    }
    public static int Modifyparam(int a,int b){
        return a+b;
    }
}

actvity_main.xml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 <Button
    android:id="@+id/ModifystaticVar"
    android:layout_width="170dp"
    android:layout_height="45dp"
    android:layout_marginBottom="356dp"
    android:layout_marginEnd="8dp"
    android:layout_marginLeft="8dp"
    android:layout_marginRight="8dp"
    android:layout_marginStart="8dp"
    android:text="ModifystaticVar"
    app:layout_constraintBottom_toBottomOf="parent"
    app:layout_constraintEnd_toEndOf="parent"
    app:layout_constraintHorizontal_bias="0.458"
    app:layout_constraintStart_toStartOf="parent"
    tools:ignore="MissingConstraints" />
<Button
    android:id="@+id/ModifyResult"
    android:layout_width="170dp"
    android:layout_height="45dp"
    android:layout_marginBottom="276dp"
    android:layout_marginEnd="8dp"
    android:layout_marginLeft="8dp"
    android:layout_marginRight="8dp"
    android:layout_marginStart="8dp"
    android:text="ModifyResult"
    app:layout_constraintBottom_toBottomOf="parent"
    app:layout_constraintEnd_toEndOf="parent"
    app:layout_constraintHorizontal_bias="0.458"
    app:layout_constraintStart_toStartOf="parent"
    tools:ignore="MissingConstraints" />
<Button
    android:id="@+id/Modifyparam"
    android:layout_width="170dp"
    android:layout_height="45dp"
    android:layout_marginBottom="196dp"
    android:layout_marginEnd="8dp"
    android:layout_marginLeft="8dp"
    android:layout_marginRight="8dp"
    android:layout_marginStart="8dp"
    android:text="Modifyparam"
    app:layout_constraintBottom_toBottomOf="parent"
    app:layout_constraintEnd_toEndOf="parent"
    app:layout_constraintHorizontal_bias="0.458"
    app:layout_constraintStart_toStartOf="parent"
    tools:ignore="MissingConstraints" />

编写hook

创建一个xModule.java

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
package com.ctf.test.xposed2;
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
public class xModule  implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        String MethodName2 = "modifyResult";
        String MethodName3 = "Modifyparam";
        Log.d("Xposed","packname---------------------" );
        if(loadPackageParam.packageName.equals("com.ctf.test.xposedlab2")) {
            Log.d("Xposed","inHook" );
            XposedBridge.log("Xposed" + loadPackageParam.packageName);
            Class clazz = loadPackageParam.classLoader.loadClass("com.ctf.test.xposedlab2.demo");
            //hook 静态变量 不需要获取类对象，即可直接修改类中的私有静态变量staticInt
            XposedHelpers.setStaticIntField(clazz, "staticInt", 33);
            //hook 修改返回值
            XposedHelpers.findAndHookMethod(clazz, MethodName2, new XC_MethodReplacement() {
                @Override
                protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                    return 55;
                }
            });
            //hook 修改传入参数  需要连参数一起 int.class int.class
            XposedHelpers.findAndHookMethod(clazz, MethodName3, int.class,int.class, new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(XC_MethodHook.MethodHookParam param) throws Throwable {
                    Log.d("Xposed", String.valueOf(param.args[0]));
                    Log.d("Xposed", String.valueOf(param.args[1]));
                    param.args[0] = 9;
                    param.args[1] = 9;
   
                }
            });
        }
    }
}

在main->创建一个assets目录，并在之下创建xposed_init(声明xposed入口)

1
com.ctf.test.xposedtest1.xModule   //包名+类名

将这个工程，编译，打包，安装到已经支持Xposed的手机中。
需要注意的是，要关闭instant run功能(File->Settings->instant run->去掉打钩)

报错

1
java.lang.IllegalAccessError: Class ref in pre-verified class resolved to unexpected implementation

dependencies配置，Android studio修改成上面那样

运行

将xopsed打钩，重启xposed框架，在运行xposedLab1,会出现->“我已经被劫”
这是已经hook成功啦。

参考:
https://www.jianshu.com/p/1c8d7682b630

Donate
-------------本文结束感谢您的阅读-------------