基于Xposed修改微信运动步数

转载 2016年08月31日 16:31:19
<div id="article_content" class="article_content">


<p><span style="font-size:14px; color:#009900">&nbsp; &nbsp; &nbsp; </span><span style="font-size:14px; color:#009900">前言:<span style="font-family:宋体; line-height:28px; text-indent:28px; background-color:rgb(249,249,249)">Zygote 是 <a href="http://lib.csdn.net/base/15" class="replace_word" title="undefined" target="_blank" style="color:#df3434; font-weight:bold;">Android</a> 的核心,每打开一个 app,Zygote 就会 fork 一个虚拟机实例来运行
 app,基于Xposed我们可以使用Android hook技术对APK中的方法进行调试、关键API拦截、外挂等。</span></span></p>
<p style="text-indent:28px"><span style="font-family:宋体; font-size:14px; color:#ff0000"><span style="line-height:28px; background-color:rgb(249,249,249)">这篇文章建立在Xposed模块开发的基础之上,没有开发过Xposed模块的请先看这篇入门教程《<a target="_blank" href="http://blog.csdn.net/chenhao0428/article/details/51360554" style="text-decoration:none; font-family:'Microsoft YaHei'; line-height:30px">Xposed模块开发入门教程</a>》</span></span></p>
<p style="text-indent:28px"><span style="line-height:28px; font-family:宋体; font-size:24px; background-color:rgb(249,249,249)"><span style="color:#3366ff">一、微信运动修改步数原理</span></span></p>
<p style="text-indent:28px"><span style="line-height:28px; font-family:宋体; background-color:rgb(249,249,249)"><span style="font-size:18px"><span style="color:#009900">当点击微信运动排行榜的时候微信APP会获取手机上计数传感器的数值,然后传感器会返回我们行走的步数。此时我们使用Xposed框架来hook计数传感器的队列函数dispatchSensorEvent(),该函数在android.hardware.SystemSensorManager$SensorEventQueue这个类中。当询问传感器的时候我们在数值上加上相应步数返回给微信运动达到欺骗效果。<span style="font-family:Menlo,Monaco,Consolas,'Courier New',monospace; line-height:28px; background-color:rgb(249,242,244)"></span></span></span></span></p>
<p style="text-indent:28px"><span style="line-height:28px; font-family:宋体; background-color:rgb(249,249,249)"><span style="font-size:24px; color:#3366ff">二、开发Xposed模块</span></span></p>
<p style="text-indent:28px"><span style="line-height:28px; font-family:宋体; background-color:rgb(249,249,249)"><span style="font-size:18px; color:#009900">1.新建一个类WeixinSport,具体代码如下:</span></span></p>
<p style="text-indent:28px"><span style="line-height:28px; font-family:宋体; background-color:rgb(249,249,249)"></span></p><div class="dp-highlighter bg_java"><div class="bar"><div class="tools"><b>[java]</b> <a href="#" class="ViewSource" title="view plain" onclick="dp.sh.Toolbar.Command('ViewSource',this);return false;">view plain</a><span data-mod="popu_168"> <a href="#" class="CopyToClipboard" title="copy" onclick="dp.sh.Toolbar.Command('CopyToClipboard',this);return false;">copy</a><div style="position: absolute; left: 444px; top: 767px; width: 18px; height: 18px; z-index: 99;"><embed id="ZeroClipboardMovie_1" src="http://static.blog.csdn.net/scripts/ZeroClipboard/ZeroClipboard.swf" loop="false" menu="false" quality="best" bgcolor="#ffffff" width="18" height="18" name="ZeroClipboardMovie_1" align="middle" allowscriptaccess="always" allowfullscreen="false" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" flashvars="id=1&amp;width=18&amp;height=18" wmode="transparent"></div></span><span data-mod="popu_169"> <a href="#" class="PrintSource" title="print" onclick="dp.sh.Toolbar.Command('PrintSource',this);return false;">print</a></span><a href="#" class="About" title="?" onclick="dp.sh.Toolbar.Command('About',this);return false;">?</a></div></div><ol start="1" class="dp-j"><li class="alt"><span><span class="keyword">package</span><span>&nbsp;com.example.administrator.weixinsport;&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;</span></li><li class="alt"><span><span class="keyword">import</span><span>&nbsp;</span><span class="keyword">static</span><span>&nbsp;de.robv.android.xposed.XposedHelpers.findClass;&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;</span></li><li class="alt"><span><span class="keyword">import</span><span>&nbsp;java.lang.reflect.Field;&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;</span></li><li class="alt"><span><span class="keyword">import</span><span>&nbsp;android.hardware.Sensor;&nbsp;&nbsp;</span></span></li><li class=""><span><span class="keyword">import</span><span>&nbsp;android.util.SparseArray;&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;</span></li><li class=""><span><span class="keyword">import</span><span>&nbsp;de.robv.android.xposed.IXposedHookLoadPackage;&nbsp;&nbsp;</span></span></li><li class="alt"><span><span class="keyword">import</span><span>&nbsp;de.robv.android.xposed.XC_MethodHook;&nbsp;&nbsp;</span></span></li><li class=""><span><span class="keyword">import</span><span>&nbsp;de.robv.android.xposed.XposedBridge;&nbsp;&nbsp;</span></span></li><li class="alt"><span><span class="keyword">import</span><span>&nbsp;de.robv.android.xposed.callbacks.XC_LoadPackage;&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;</span></li><li class="alt"><span><span class="comment">/**</span>&nbsp;</span></li><li class=""><span><span class="comment">&nbsp;*&nbsp;Created&nbsp;by&nbsp;Administrator&nbsp;on&nbsp;2016/5/11.</span>&nbsp;</span></li><li class="alt"><span><span class="comment">&nbsp;*/</span><span>&nbsp;&nbsp;</span></span></li><li class=""><span><span class="keyword">public</span><span>&nbsp;</span><span class="keyword">class</span><span>&nbsp;WeixinSport&nbsp;</span><span class="keyword">implements</span><span>&nbsp;IXposedHookLoadPackage&nbsp;{&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;</span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;<span class="keyword">private</span><span>&nbsp;</span><span class="keyword">static</span><span>&nbsp;</span><span class="keyword">int</span><span>&nbsp;stepCount&nbsp;=&nbsp;</span><span class="number">1</span><span>;&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;</span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;<span class="annotation">@Override</span><span>&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;<span class="keyword">public</span><span>&nbsp;</span><span class="keyword">void</span><span>&nbsp;handleLoadPackage(XC_LoadPackage.LoadPackageParam&nbsp;loadPackageParam)&nbsp;</span><span class="keyword">throws</span><span>&nbsp;Throwable&nbsp;{&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;</span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="comment">//&nbsp;filter</span><span>&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="keyword">if</span><span>&nbsp;(!loadPackageParam.packageName.equals(</span><span class="string">"com.tencent.mm"</span><span>))&nbsp;{&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="keyword">return</span><span>;&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;</span></li><li class="alt"><span>&nbsp;&nbsp;</span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="keyword">final</span><span>&nbsp;Class&lt;?&gt;&nbsp;sensorEL&nbsp;=&nbsp;findClass(</span><span class="string">"android.hardware.SystemSensorManager$SensorEventQueue"</span><span>,&nbsp;loadPackageParam.classLoader);&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;</span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;XposedBridge.hookAllMethods(sensorEL,&nbsp;<span class="string">"dispatchSensorEvent"</span><span>,&nbsp;</span><span class="keyword">new</span><span>&nbsp;XC_MethodHook()&nbsp;{&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;</span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="annotation">@Override</span><span>&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="keyword">protected</span><span>&nbsp;</span><span class="keyword">void</span><span>&nbsp;beforeHookedMethod(MethodHookParam&nbsp;param)&nbsp;</span><span class="keyword">throws</span><span>&nbsp;Throwable&nbsp;{&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((<span class="keyword">float</span><span>[])&nbsp;param.args[</span><span class="number">1</span><span>])[</span><span class="number">0</span><span>]&nbsp;=&nbsp;((</span><span class="keyword">float</span><span>[])&nbsp;param.args[</span><span class="number">1</span><span>])[</span><span class="number">0</span><span>]&nbsp;+&nbsp;</span><span class="number">1168</span><span>&nbsp;*&nbsp;stepCount;&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;stepCount++;&nbsp;&nbsp;</span></li><li class=""><span>&nbsp;&nbsp;</span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Field&nbsp;field&nbsp;=&nbsp;param.thisObject.getClass().getEnclosingClass().getDeclaredField(<span class="string">"sHandleToSensor"</span><span>);&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;field.setAccessible(<span class="keyword">true</span><span>);&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;</span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="keyword">int</span><span>&nbsp;handle&nbsp;=&nbsp;(Integer)&nbsp;param.args[</span><span class="number">0</span><span>];&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Sensor&nbsp;sensor&nbsp;=&nbsp;((SparseArray&lt;Sensor&gt;)&nbsp;field.get(<span class="number">0</span><span>)).get(handle);&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;XposedBridge.log(<span class="string">"sensor&nbsp;=&nbsp;"</span><span>&nbsp;+&nbsp;sensor);&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;</span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;});&nbsp;&nbsp;</span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;</span></li><li class=""><span>}&nbsp;&nbsp;</span></li></ol><div class="save_code tracking-ad" data-mod="popu_249" style="display: none;"><a href="javascript:;" target="_blank"><img src="http://static.blog.csdn.net/images/save_snippets.png"></a></div></div><pre name="code" class="java" style="color: rgb(0, 153, 0); font-size: 18px; display: none;">package com.example.administrator.weixinsport;


import static de.robv.android.xposed.XposedHelpers.findClass;


import java.lang.reflect.Field;


import android.hardware.Sensor;
import android.util.SparseArray;


import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.callbacks.XC_LoadPackage;


/**
 * Created by Administrator on 2016/5/11.
 */
public class WeixinSport implements IXposedHookLoadPackage {


    private static int stepCount = 1;


    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {


        // filter
        if (!loadPackageParam.packageName.equals("com.tencent.mm")) {
            return;
        }


        final Class&lt;?&gt; sensorEL = findClass("android.hardware.SystemSensorManager$SensorEventQueue", loadPackageParam.classLoader);


        XposedBridge.hookAllMethods(sensorEL, "dispatchSensorEvent", new XC_MethodHook() {


            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                ((float[]) param.args[1])[0] = ((float[]) param.args[1])[0] + 1168 * stepCount;
                stepCount++;


                Field field = param.thisObject.getClass().getEnclosingClass().getDeclaredField("sHandleToSensor");
                field.setAccessible(true);


                int handle = (Integer) param.args[0];
                Sensor sensor = ((SparseArray&lt;Sensor&gt;) field.get(0)).get(handle);
                XposedBridge.log("sensor = " + sensor);
            }
        });
    }
}</pre><p></p>
<p style="color:rgb(0,153,0); font-size:18px">这段代码中我们首先通过equals("com.tencent.mm")过滤出了来自微信的请求:</p>
<p></p><div class="dp-highlighter bg_java"><div class="bar"><div class="tools"><b>[java]</b> <a href="#" class="ViewSource" title="view plain" onclick="dp.sh.Toolbar.Command('ViewSource',this);return false;">view plain</a><span data-mod="popu_168"> <a href="#" class="CopyToClipboard" title="copy" onclick="dp.sh.Toolbar.Command('CopyToClipboard',this);return false;">copy</a><div style="position: absolute; left: 444px; top: 1744px; width: 18px; height: 18px; z-index: 99;"><embed id="ZeroClipboardMovie_2" src="http://static.blog.csdn.net/scripts/ZeroClipboard/ZeroClipboard.swf" loop="false" menu="false" quality="best" bgcolor="#ffffff" width="18" height="18" name="ZeroClipboardMovie_2" align="middle" allowscriptaccess="always" allowfullscreen="false" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" flashvars="id=2&amp;width=18&amp;height=18" wmode="transparent"></div></span><span data-mod="popu_169"> <a href="#" class="PrintSource" title="print" onclick="dp.sh.Toolbar.Command('PrintSource',this);return false;">print</a></span><a href="#" class="About" title="?" onclick="dp.sh.Toolbar.Command('About',this);return false;">?</a></div></div><ol start="1" class="dp-j"><li class="alt"><span><span class="keyword">if</span><span>&nbsp;(!loadPackageParam.packageName.equals(</span><span class="string">"com.tencent.mm"</span><span>))&nbsp;{&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="keyword">return</span><span>;&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;</span></li></ol><div class="save_code tracking-ad" data-mod="popu_249"><a href="javascript:;" target="_blank"><img src="http://static.blog.csdn.net/images/save_snippets.png"></a></div></div><pre name="code" class="java" style="color: rgb(0, 153, 0); font-size: 18px; display: none;">if (!loadPackageParam.packageName.equals("com.tencent.mm")) {
            return;
        }</pre><p></p>
<p style="color:rgb(0,153,0); font-size:18px">然后<code style="font-family:Menlo,Monaco,Consolas,'Courier New',monospace; padding:2px 4px; line-height:28px; background-color:rgb(249,242,244)">hook了android.hardware.SystemSensorManager$SensorEventQueue</code><span style="font-family:Helvetica,Arial,'Hiragino Sans GB',sans-serif; line-height:28px">这个类中的</span><code style="font-family:Menlo,Monaco,Consolas,'Courier New',monospace; padding:2px 4px; line-height:28px; background-color:rgb(249,242,244)">dispatchSensorEvent()</code><span style="font-family:Helvetica,Arial,'Hiragino Sans GB',sans-serif; line-height:28px">函数:</span></p>
<p style="color:rgb(0,153,0); font-size:18px"><span style="font-family:Helvetica,Arial,'Hiragino Sans GB',sans-serif; line-height:28px"></span></p><div class="dp-highlighter bg_java"><div class="bar"><div class="tools"><b>[java]</b> <a href="#" class="ViewSource" title="view plain" onclick="dp.sh.Toolbar.Command('ViewSource',this);return false;">view plain</a><span data-mod="popu_168"> <a href="#" class="CopyToClipboard" title="copy" onclick="dp.sh.Toolbar.Command('CopyToClipboard',this);return false;">copy</a><div style="position: absolute; left: 444px; top: 1923px; width: 18px; height: 18px; z-index: 99;"><embed id="ZeroClipboardMovie_3" src="http://static.blog.csdn.net/scripts/ZeroClipboard/ZeroClipboard.swf" loop="false" menu="false" quality="best" bgcolor="#ffffff" width="18" height="18" name="ZeroClipboardMovie_3" align="middle" allowscriptaccess="always" allowfullscreen="false" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" flashvars="id=3&amp;width=18&amp;height=18" wmode="transparent"></div></span><span data-mod="popu_169"> <a href="#" class="PrintSource" title="print" onclick="dp.sh.Toolbar.Command('PrintSource',this);return false;">print</a></span><a href="#" class="About" title="?" onclick="dp.sh.Toolbar.Command('About',this);return false;">?</a></div></div><ol start="1" class="dp-j"><li class="alt"><span><span class="keyword">final</span><span>&nbsp;Class&lt;?&gt;&nbsp;sensorEL&nbsp;=&nbsp;findClass(</span><span class="string">"android.hardware.SystemSensorManager$SensorEventQueue"</span><span>,&nbsp;loadPackageParam.classLoader);&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;</span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;XposedBridge.hookAllMethods(sensorEL,&nbsp;<span class="string">"dispatchSensorEvent"</span><span>,&nbsp;</span><span class="keyword">new</span><span>&nbsp;XC_MethodHook()&nbsp;&nbsp;</span></span></li></ol><div class="save_code tracking-ad" data-mod="popu_249"><a href="javascript:;" target="_blank"><img src="http://static.blog.csdn.net/images/save_snippets.png"></a></div></div><pre name="code" class="java" style="display: none;">final Class&lt;?&gt; sensorEL = findClass("android.hardware.SystemSensorManager$SensorEventQueue", loadPackageParam.classLoader);


        XposedBridge.hookAllMethods(sensorEL, "dispatchSensorEvent", new XC_MethodHook()</pre><p></p>
<p><span style="font-family:Helvetica,Arial,'Hiragino Sans GB',sans-serif; line-height:28px"></span></p>
<p style="color:rgb(0,153,0); font-size:18px">在计数传感器将步数返回微信运动之前修改步数,加上了1168步:</p>
<p></p><div class="dp-highlighter bg_java"><div class="bar"><div class="tools"><b>[java]</b> <a href="#" class="ViewSource" title="view plain" onclick="dp.sh.Toolbar.Command('ViewSource',this);return false;">view plain</a><span data-mod="popu_168"> <a href="#" class="CopyToClipboard" title="copy" onclick="dp.sh.Toolbar.Command('CopyToClipboard',this);return false;">copy</a><div style="position: absolute; left: 444px; top: 2072px; width: 18px; height: 18px; z-index: 99;"><embed id="ZeroClipboardMovie_4" src="http://static.blog.csdn.net/scripts/ZeroClipboard/ZeroClipboard.swf" loop="false" menu="false" quality="best" bgcolor="#ffffff" width="18" height="18" name="ZeroClipboardMovie_4" align="middle" allowscriptaccess="always" allowfullscreen="false" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" flashvars="id=4&amp;width=18&amp;height=18" wmode="transparent"></div></span><span data-mod="popu_169"> <a href="#" class="PrintSource" title="print" onclick="dp.sh.Toolbar.Command('PrintSource',this);return false;">print</a></span><a href="#" class="About" title="?" onclick="dp.sh.Toolbar.Command('About',this);return false;">?</a></div></div><ol start="1" class="dp-j"><li class="alt"><span><span>((</span><span class="keyword">float</span><span>[])&nbsp;param.args[</span><span class="number">1</span><span>])[</span><span class="number">0</span><span>]&nbsp;=&nbsp;((</span><span class="keyword">float</span><span>[])&nbsp;param.args[</span><span class="number">1</span><span>])[</span><span class="number">0</span><span>]&nbsp;+&nbsp;</span><span class="number">1168</span><span>&nbsp;*&nbsp;stepCount;&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;stepCount++;&nbsp;&nbsp;</span></li></ol><div class="save_code tracking-ad" data-mod="popu_249" style="display: none;"><a href="javascript:;" target="_blank"><img src="http://static.blog.csdn.net/images/save_snippets_01.png"></a></div></div><pre name="code" class="java" style="color: rgb(0, 153, 0); font-size: 18px; display: none;">((float[]) param.args[1])[0] = ((float[]) param.args[1])[0] + 1168 * stepCount;
                stepCount++;</pre><p></p>
<p style="color:rgb(0,153,0); font-size:18px">为了便于调试,将传感器的一些数据打印了出来:</p>
<p></p><div class="dp-highlighter bg_java"><div class="bar"><div class="tools"><b>[java]</b> <a href="#" class="ViewSource" title="view plain" onclick="dp.sh.Toolbar.Command('ViewSource',this);return false;">view plain</a><span data-mod="popu_168"> <a href="#" class="CopyToClipboard" title="copy" onclick="dp.sh.Toolbar.Command('CopyToClipboard',this);return false;">copy</a><div style="position: absolute; left: 444px; top: 2203px; width: 18px; height: 18px; z-index: 99;"><embed id="ZeroClipboardMovie_5" src="http://static.blog.csdn.net/scripts/ZeroClipboard/ZeroClipboard.swf" loop="false" menu="false" quality="best" bgcolor="#ffffff" width="18" height="18" name="ZeroClipboardMovie_5" align="middle" allowscriptaccess="always" allowfullscreen="false" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" flashvars="id=5&amp;width=18&amp;height=18" wmode="transparent"></div></span><span data-mod="popu_169"> <a href="#" class="PrintSource" title="print" onclick="dp.sh.Toolbar.Command('PrintSource',this);return false;">print</a></span><a href="#" class="About" title="?" onclick="dp.sh.Toolbar.Command('About',this);return false;">?</a></div></div><ol start="1" class="dp-j"><li class="alt"><span><span class="keyword">int</span><span>&nbsp;handle&nbsp;=&nbsp;(Integer)&nbsp;param.args[</span><span class="number">0</span><span>];&nbsp;&nbsp;</span></span></li><li class=""><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Sensor&nbsp;sensor&nbsp;=&nbsp;((SparseArray&lt;Sensor&gt;)&nbsp;field.get(<span class="number">0</span><span>)).get(handle);&nbsp;&nbsp;</span></span></li><li class="alt"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;XposedBridge.log(<span class="string">"sensor&nbsp;=&nbsp;"</span><span>&nbsp;+&nbsp;sensor);&nbsp;&nbsp;</span></span></li></ol><div class="save_code tracking-ad" data-mod="popu_249" style="display: none;"><a href="javascript:;" target="_blank"><img src="http://static.blog.csdn.net/images/save_snippets.png"></a></div></div><pre name="code" class="java" style="color: rgb(0, 153, 0); font-size: 18px; display: none;">int handle = (Integer) param.args[0];
                Sensor sensor = ((SparseArray&lt;Sensor&gt;) field.get(0)).get(handle);
                XposedBridge.log("sensor = " + sensor);</pre><p></p>
<p style="color:rgb(0,153,0)"><span style="font-size:18px">2.修改xposed_init</span></p>
<p></p><div class="dp-highlighter bg_java"><div class="bar"><div class="tools"><b>[java]</b> <a href="#" class="ViewSource" title="view plain" onclick="dp.sh.Toolbar.Command('ViewSource',this);return false;">view plain</a><span data-mod="popu_168"> <a href="#" class="CopyToClipboard" title="copy" onclick="dp.sh.Toolbar.Command('CopyToClipboard',this);return false;">copy</a><div style="position: absolute; left: 444px; top: 2352px; width: 18px; height: 18px; z-index: 99;"><embed id="ZeroClipboardMovie_6" src="http://static.blog.csdn.net/scripts/ZeroClipboard/ZeroClipboard.swf" loop="false" menu="false" quality="best" bgcolor="#ffffff" width="18" height="18" name="ZeroClipboardMovie_6" align="middle" allowscriptaccess="always" allowfullscreen="false" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" flashvars="id=6&amp;width=18&amp;height=18" wmode="transparent"></div></span><span data-mod="popu_169"> <a href="#" class="PrintSource" title="print" onclick="dp.sh.Toolbar.Command('PrintSource',this);return false;">print</a></span><a href="#" class="About" title="?" onclick="dp.sh.Toolbar.Command('About',this);return false;">?</a></div></div><ol start="1" class="dp-j"><li class="alt"><span><span>com.example.administrator.weixinsport.WeixinSport&nbsp;&nbsp;</span></span></li></ol><div class="save_code tracking-ad" data-mod="popu_249" style="display: none;"><a href="javascript:;" target="_blank"><img src="http://static.blog.csdn.net/images/save_snippets_01.png"></a></div></div><pre name="code" class="java" style="color: rgb(0, 153, 0); font-size: 18px; display: none;">com.example.administrator.weixinsport.WeixinSport</pre><p></p>
<p style="color:rgb(0,153,0); font-size:18px">将xposed_init的入口设定为该WeixinSport类。</p>
<p style="font-size:18px"><span style="color:#990000">注:该类中的代码参考了乌云上蒸米大神的文章,该文章地址:http://drops.wooyun.org/tips/8416</span></p>
<p><span style="font-size:24px; color:#3366ff">三、测试</span></p>
<p><span style="font-size:18px; color:#009900">将该APK安装重启后打开微信运动,行走几步后再点击排行榜,发现步数增加了1168。</span></p>
<p><span style="font-size:18px; color:#009900"><img src="http://img.blog.csdn.net/20160517172051968?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt=""><br>
</span></p>
<p><span style="font-size:18px; color:#009900"><span style="color:rgb(255,0,0); font-family:Arial; font-size:32px; line-height:26px"><br>
</span></span></p>
<p><span style="font-size:18px; color:#009900"><span style="color:rgb(255,0,0); font-family:Arial; font-size:32px; line-height:26px">完整源码下载请点击<a target="_blank" href="http://download.csdn.net/detail/chenhao0428/9521553">这里</a></span><span style="color:rgb(255,0,0); font-family:Arial; font-size:32px; line-height:26px">。</span><br>
</span></p>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
   
</div>

相关文章推荐

基于Xposed修改微信运动步数

前言:Zygote 是 Android 的核心,每打开一个 app,Zygote 就会 fork 一个虚拟机实例来运行 app,基于Xposed我们可以使用Android hook技术对APK中的...

微信运动步数修改教程

  • 2017年05月05日 03:31
  • 36.89MB
  • 下载

iPhone免越狱修改微信运动步数

相信喜欢逆向工程的小伙伴已经对微信自动抢红包插件有所耳闻了,或者可以说,已经被广泛的传播了,但笔者发现,其实只有两篇是原创的,其余均为疯狂转载.看了下网上对于微信的"喜爱"目前只有抢红包这块,所以为大...
  • landcbd
  • landcbd
  • 2017年05月03日 13:53
  • 3671

iOS 教你如何修改微信运动步数

说明: 相信喜欢逆向工程的小伙伴已经对微信自动抢红包插件有所耳闻了,或者可以说,已经被广泛的传播了,但笔者发现,其实只有两篇是原创的,其余均为疯狂转载.看了下网上对于微信的"喜爱"目前只有抢红包这块,...

iphone 教你怎么修改微信运动步数

说明: 相信喜欢逆向工程的小伙伴已经对微信自动抢红包插件有所耳闻了,或者可以说,已经被广泛的传播了,但笔者发现,其实只有两篇是原创的,其余均为疯狂转载.看了下网上对于微信的"喜爱"目前只有抢红包这块,...
  • ishuabu
  • ishuabu
  • 2017年06月15日 00:32
  • 5469

手把手教你刷微信运动的步数

  • 2017年05月02日 01:59
  • 10.82MB
  • 下载

仿微信运动步数折线统计图

完整代码如下 import android.content.Context; import android.graphics.Canvas; import android.graphics.Colo...

手把手教你刷微信运动的步数

  • 2016年03月17日 11:58
  • 1.39MB
  • 下载

微信运动改步数

  • 2017年05月11日 11:46
  • 3KB
  • 下载
内容举报
返回顶部
收藏助手
不良信息举报
您举报文章:基于Xposed修改微信运动步数
举报原因:
原因补充:

(最多只允许输入30个字)