1.手机必须先root,然后安装xposed
2.创建一个被劫持的app,写一个activity,很简单
public class MainActivity extends AppCompatActivity { @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); Button button = findViewById(R.id.change); final TextView textView = findViewById(R.id.hello); button.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View view) { textView.setText("哈哈"); } }); } }
3.创建一个xposed插件项目,删除项目自带的activity
将xposedapi-87.jar导入项目libs目录下
app的build.gradle下 添加依赖
provided files('libs/XposedBridgeApi-87.jar')
修改依赖方式compile files修改为providedfiles,原因是Xposed里已有该jar包内容,再次打包进去会冲突。
provided fileTree(include: ['*.jar'], dir: 'libs')在Application标签里面加三个meta-data
<!-- 是否是xposed模块,xposed根据这个来判断是否是模块 --> <meta-data android:name="xposedmodule" android:value="true" /> <!-- 模块描述,显示在xposed模块列表那里第二行 --> <meta-data android:name="xposeddescription" android:value="测试Xposed模块" /> <!-- 最低xposed版本号(lib文件名可知) --> <meta-data android:name="xposedminversion" android:value="87" />
编写hook类,实现IXposedHookLoadPackage接口,重写handleLoadPackage方法,我这里创建了一个Main类
public class Main implements IXposedHookLoadPackage { @Override public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) { XposedBridge.log("start"); if(loadPackageParam.packageName.equals("com.example.sj.myapplication")){ XposedHelpers.findAndHookMethod(TextView.class, "setText", CharSequence.class, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { super.beforeHookedMethod(param); param.args[0] = "hhj"; } @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { super.afterHookedMethod(param); } }); } } }在main目录下创建assets目录,在assets目录下创建xposed_init文件,不要后缀名。
这个就是模块的入口,只有一行代码,就是说明入口类
打包apk插件,不要直接运行,安装xposed apk插件,
打开Xposed,勾选刚刚安装的插件。重启手机。
打开测试程序,点击按钮就能发现文字改变了