Android hook初探+踩坑点

Hook英文翻译为“钩子”，而钩子就是在事件传送到终点前截获并监控事件的传输，像个钩子钩上事件一样，并且能够在钩上事件时，处理一些自己特定的事件。

先写一个hookTest的apk，作为被hook的apk：

package com.example.administrator.hooktest;

import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;

public class MainActivity extends AppCompatActivity {

    private final String ACCOUNT="ljl";
    private final String PASSWORD="123456";
    private EditText etAccount, etPassword;
    private Button btnLogin;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        etAccount=(EditText)findViewById(R.id.et_account);

        etPassword=(EditText)findViewById(R.id.et_password);

        btnLogin=(Button)findViewById(R.id.btn_login);

        btnLogin.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                if (isOK(etAccount.getText().toString(), etPassword.getText().toString())) {
                    Toast.makeText(MainActivity.this, "登录成功", Toast.LENGTH_SHORT).show();
                } else {
                    Toast.makeText(MainActivity.this, "登录失败", Toast.LENGTH_SHORT).show();
                }

            }
        });

    }
    private boolean isOK(String account, String password){
        return account.equals(ACCOUNT) && password.equals(PASSWORD);
    }
}

用来hook的apk就叫hookDemo，其中的moudle类就是hook类。java代码如下：

/**  
*包装加载时的回调  
*/   
public void handleLoadPackage(final LoadPackageParam lpparam)   
/**  
*Xposed提供的Hook方法  
*@param className 待Hook的Class  
*@param classLoader ClassLoader  
*@param methodName 待Hook的Method  
*@param paramterTypesAndClassback hook回调  
*/   
Unhook findAndHookMethod(String className,ClassLoader classLoader,String methodName,Object... parameterTypesAndCallback)   

package com.example.administrator.hookdemo;

import android.util.Log;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

/**
 * Created by Administrator on 2018/4/19.
 */

public class Moudle implements IXposedHookLoadPackage {

    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        if (loadPackageParam.packageName.equals("com.example.administrator.hooktest")) {

            XposedBridge.log("Loaded app:" + loadPackageParam.packageName);

            XposedHelpers.findAndHookMethod("com.example.administrator.hooktest.MainActivity",
                    loadPackageParam.classLoader,
                    "isOK",
                    String.class,
                    String.class,
                    new XC_MethodHook() {
                        @Override
                        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                            XposedBridge.log("username"+(String)param.args[0]+"   password:"+(String)param.args[1]);

                        }

                        @Override
                        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                            XposedBridge.log("hook end");
                        }
                    });

        }
    }

}

gradle：

dependencies {
    compile fileTree(include: ['*.jar'], dir: 'libs')
    androidTestCompile('com.android.support.test.espresso:espresso-core:2.2.2', {
        exclude group: 'com.android.support', module: 'support-annotations'
    })
    compile 'com.android.support:appcompat-v7:25.3.1'
    testCompile 'junit:junit:4.12'
    provided files('lib/XposedBridgeApi-54.jar')
}

坑一。这里注意：

provided files('lib/XposedBridgeApi-54.jar')

得是provided的，否则日志里会出现E（error）的log。

The Xposed API classes are compiled into the module's APK

坑二。build的时候：

disable Instant Run ( File -> Settings -> Build, Execution, Deployment -> Instant Run), otherwise your classes aren't included directly in the APK, but loaded via a stub application which Xposed can't handle.

否则日志中不报错，但hook不到想要的值。

把两个apk写好了以后，将hookDemo作为xposed中的模块，激活，软重启。然后再运行hookTest的时候，输入的用户名和密码就可以在xposed的日志中看到啦！

参考：

https://www.52pojie.cn/thread-682743-1-1.html

https://blog.csdn.net/qq_18870023/article/details/51753587

https://www.jianshu.com/p/0c75c3169abb