Xposed插件开发基础篇

xposed hook java

---

官方教程:https://github.com/rovo89/XposedBridge/wiki/Development-tutorial

官网:http://repo.xposed.info/module/de.robv.android.xposed.installer

apk:http://dl-xda.xposed.info/modules/de.robv.android.xposed.installer_v33_36570c.apk

源码:https://github.com/rovo89/XposedInstaller

步骤

1.创建工程android4.0.3(api15),可以不用activity

2.修改AndroidManifest.xml

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="de.robv.android.xposed.mods.tutorial"
    android:versionCode="1"
    android:versionName="1.0" >
    <uses-sdk android:minSdkVersion="15" />
    <application
        android:icon="@drawable/ic_launcher"
        android:label="@string/app_name" >
        <meta-data
            android:name="xposedmodule"
            android:value="true" />
        <meta-data
            android:name="xposeddescription"
            android:value="Easy example" />
        <meta-data
            android:name="xposedminversion"
            android:value="54" />
    </application>
</manifest>

3.在工程目录下新建一个lib文件夹。将下载好的XposedBridgeApi-54.jar包放入其中。
在工程里 选中XposedBridgeApi-54.jar 右键–Build Path–Add to Build Path。

4.模块实现接口

package de.robv.android.xposed.mods.tutorial;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

public class Tutorial implements IXposedHookLoadPackage {
    public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
        XposedBridge.log("Loaded app: " + lpparam.packageName);
    }
}

5.入口assets/xposed_init配置,声明需要加载到 XposedInstaller 的入口类:de.robv.android.xposed.mods.tutorial.Tutorial(完整类名:包名+类名)

6.定位要hook的api

• 反编译目标程序,查看Smali代码
• 直接在AOSP(android源码)中查看

7.XposedBridge to hook it

• 指定要 hook 的包名
• 判断当前加载的包是否是指定的包
• 指定要 hook 的方法名
• 实现beforeHookedMethod方法和afterHookedMethod方法

package de.robv.android.xposed.mods.tutorial;

import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

public class Tutorial implements IXposedHookLoadPackage {
    public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
        if (!lpparam.packageName.equals("com.android.systemui"))
            return;

        findAndHookMethod("com.android.systemui.statusbar.policy.Clock", lpparam.classLoader, "updateClock", new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                // this will be called before the clock was updated by the original method
            }
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                // this will be called after the clock was updated by the original method
            }
    });
    }
}

重写XC_MethodHook的两个方法beforeHookedMethod和afterHookedMethod，这两个方法会在原始的方法的之前和之后执行.您可以使用beforeHookedMethod 方法来打印/篡改方法调用的参数(通过param.args) ,甚至阻止调用原来的方法（发送自己的结果）.afterHookedMethod 方法可以用来做基于原始方法的结果的事情.您还可以用它来操纵结果 .当然，你可以添加自己的代码,它将会准确地在原始方法的前或后执行.

0x00 关键API

IXposedHookLoadPackage

Method | Description

--- | ---

handleLoadPackage | 这个方法用于在加载应用程序的包的时候执行用户的操作

调用示例

public class XposedInterface implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
XposedBridge.log("Kevin-Loaded app: " + lpparam.packageName); }
}

参数说明|final LoadPackageParam lpparam 这个参数包含了加载的应用程序的一些基本信息。

XposedHelpers

Method|Description

--- | ---

findAndHookMethod

这是一个辅助方法,可以通过如下方式静态导入:

import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;

使用示例

findAndHookMethod("com.android.systemui.statusbar.policy.Clock", lpparam.classLoader, "handleUpdateClock", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
// this will be called before the clock was updated by the original method }
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
// this will be called after the clock was updated by the original method }
});
`

参数说明

findAndHookMethod(Class<?>clazz, //需要Hook的类名
ClassLoader, //类加载器,可以设置为 null String methodName, //需要 Hook 的方法名 Object... parameterTypesAndCallback
)

该函数的最后一个参数集,包含了:

(1)Hook 的目标方法的参数,譬如:
"com.android.internal.policy.impl.PhoneWindow.DecorView"
是方法的参数的类。

(2)回调方法:

a.XC_MethodHook b.XC_MethodReplacement

转自:http://www.codefrom.com/p/Xposed