xposed实现对okhttp拦截网络

一开始搜到有几个博客说用拦截器去实现，我也自己摸索下用拦截器

            XC_MethodHook xc_BuildHook = new XC_MethodHook() {
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    super.afterHookedMethod(param);
                    try {
                        XpLog.INSTANCE.log(getTag(), "hookAllConstructors.param.thisObject：" + param.thisObject);
                        List interceptors = handleInterceptor(param, classLoader, "interceptors");
                        if ("okhttp3.OkHttpClient$Builder".equals(param.thisObject.getClass().getName())) {
                            List networkInterceptors = handleInterceptor(param, classLoader, "networkInterceptors");
                        }
                    } catch (Throwable e) {
                        XposedBridge.log(e);
                    }

                }
            };

            //hook okhttp对象
            Class<?> builderClass = classLoader.loadClass("okhttp3.OkHttpClient$Builder");
            XposedBridge.hookAllConstructors(builderClass, xc_BuildHook);
            XposedBridge.hookAllMethods(builderClass, "build", xc_BuildHook);

通过hook以上2个方法，做得到实例的interceptors成员变量，我们就可以修改拦截器的内容，当时我发现，如果interceptors空的话，我是没办法，好像是这样编，后来我实现编不下去，放弃hook OkHttpClient

后来我发现通过hook RealInterceptorChain，这个类在okhttp源码里面虽然会多次实例化，但是只有一个入口，就算代码混淆，也方便定位找到

XposedBridge.hookAllConstructors(aClassRealInterceptorChain, xc_BuildHook);

写上这代码，我能拿到okhttp默认添加的拦截器，现在我感觉有的活力去编下去了，利用动态代理做了一个对象加进去

private List handleInterceptor(XC_MethodHook.MethodHookParam param, ClassLoader classLoader, String interceptorsStr) {
        List interceptors = (List) XposedHelpers.getObjectField(param.thisObject, interceptorsStr);
        XpLog.INSTANCE.log(getTag(), "handleInterceptor.interceptors：" + interceptors);
        if (interceptors != null) {
            if (!interceptors.isEmpty()) {
                int i = interceptors.size() - 1;
                Object interceptor = interceptors.get(i);
                XpLog.INSTANCE.log(getTag(), "handleInterceptor.interceptor：" + interceptor.getClass());
                //动态代理加进去
                InterceptorProxyHandler interceptorProxyHandler = new InterceptorProxyHandler(interceptor);
                Object mObj = Proxy.newProxyInstance(classLoader, interceptor.getClass().getInterfaces(), interceptorProxyHandler);
                XpLog.INSTANCE.log(getTag(), "handleInterceptor.mObj：" + mObj);
                if (mObj != null) {
                    //移除原本的
                    interceptors.remove(i);
                    //加在最后一个地方
                    interceptors.add(mObj);
                }
            }
            //这里输出具体拦截器的类的名字
            Field interceptorsField = XposedHelpers.findField(param.thisObject.getClass(), interceptorsStr);
            ParameterizedType type = (ParameterizedType) interceptorsField.getGenericType();
            Type[] actualTypeArguments = type.getActualTypeArguments();
            for (Type actualTypeArgument : actualTypeArguments) {
                XpLog.INSTANCE.log(getTag(), "interceptors actualTypeArgument:" + ((Class) actualTypeArgument).getName());
                break;
            }
        }
        return interceptors;
    }

后来，我开心的编，编啊编，写上我的动态代理对象先

public class InterceptorProxyHandler implements InvocationHandler {

    final static String TAG = "InterceptorProxyHandler";

    private Object mTarget;

    public InterceptorProxyHandler(Object target) {
        this.mTarget = target;
    }

    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        try {
            XpLog.INSTANCE.log(TAG, "invoke.method:" + method.getName());
            if ("intercept".equals(method.getName())) {
                //这里参考 HttpLoggingInterceptor 来实现，如果是混淆，需要自己分析类的每个方法
                if (args != null) {
                    XpLog.INSTANCE.log(TAG, "invoke.args:" + Arrays.toString(args));
                    Object realInterceptorChainObj = args[0];
                    Class<?> aClassRealInterceptorChain = realInterceptorChainObj.getClass();

                    //反射获取request对象
                    Method requestMethod = aClassRealInterceptorChain.getDeclaredMethod("request");
                    Object invokeRequest = requestMethod.invoke(realInterceptorChainObj);

                    Class<?> aClassRequest = invokeRequest.getClass();
                    //获取body
                    Method requestBodyMethod = aClassRequest.getDeclaredMethod("body");
                    Object invokeRequestBody = requestBodyMethod.invoke(invokeRequest);
                    boolean hasRequestBody = invokeRequestBody != null;

                    Method requestConnectionMethod = aClassRealInterceptorChain.getDeclaredMethod("connection");
                    Object invokeConnection = requestConnectionMethod.invoke(realInterceptorChainObj);
                    Object protocol = invokeConnection != null ? invokeConnection.getClass().getDeclaredMethod("protocol").invoke(invokeConnection) : "http/1.1";
                    Method methodMethod = aClassRequest.getDeclaredMethod("method");
                    Object invokeMethod = methodMethod.invoke(invokeRequest);

                    Method urlMethod = aClassRequest.getDeclaredMethod("url");
                    Object invokeUrl = urlMethod.invoke(invokeRequest);

                    String requestStartMessage = "--> " + invokeMethod + ' ' + invokeUrl + ' ' + protocol;

                    if (hasRequestBody) {
                        Class<?> invokeBodyClass = invokeRequestBody.getClass();
                        requestStartMessage += " (" + invokeBodyClass.getDeclaredMethod("contentLength").invoke(invokeRequestBody) + "-byte body)";
                    }
                    XpLog.INSTANCE.log(TAG, requestStartMessage);

                    if (hasRequestBody) {
                        Class<?> invokeBodyClass = invokeRequestBody.getClass();
                        // Request body headers are only present when installed as a network interceptor. Force
                        // them to be included (when available) so there values are known.
                        Method contentTypeMethod = invokeBodyClass.getDeclaredMethod("contentType");
                        Object invokeContentType = contentTypeMethod.invoke(invokeRequestBody);
                        if (invokeContentType != null) {
                            XpLog.INSTANCE.log(TAG, "Content-Type: " + invokeContentType);
                        }
                        Method contentLengthMethod = invokeBodyClass.getDeclaredMethod("contentLength");
                        Object invokeContentLength = contentLengthMethod.invoke(invokeRequestBody);
                        if (invokeContentLength != null) {
                            XpLog.INSTANCE.log(TAG, "Content-Length: " + invokeContentLength);
                        }
                        Method headersMethod = aClassRequest.getDeclaredMethod("headers");
                        Object invokeHeaders = headersMethod.invoke(invokeRequest);
                        if (invokeHeaders != null) {
                            Class<?> aClassHeaders = invokeHeaders.getClass();
                            Method sizeMethod = aClassHeaders.getDeclaredMethod("size");
                            int invokeSize = (int) sizeMethod.invoke(invokeHeaders);
                            for (int i = 0; i < invokeSize; i++) {
                                Method nameMethod = aClassHeaders.getDeclaredMethod("name", int.class);
                                String name = (String) nameMethod.invoke(invokeHeaders, i);
                                // Skip headers from the request body as they are explicitly logged above.
                                if (!"Content-Type".equalsIgnoreCase(name) && !"Content-Length".equalsIgnoreCase(name)) {
                                    XpLog.INSTANCE.log(TAG, name + ": " + aClassHeaders.getDeclaredMethod("value", int.class).invoke(invokeHeaders, i));
                                }
                            }
                            //处理结束地方
                            if (!hasRequestBody) {
                                XpLog.INSTANCE.log(TAG, "--> END " + invokeMethod);
                            } else if (bodyEncoded(invokeHeaders)) {
                                XpLog.INSTANCE.log(TAG, "--> END " + invokeMethod + " (encoded body omitted)");
                            } else {
                                //逆向看某app这里 okio做了混淆，所以要特殊处理
                                // 混淆保留了这个，所以能看出是什么类
                                // /* compiled from: Buffer */
                                Class<?> aClassBuffer = mTarget.getClass().getClassLoader().loadClass("okio.c");//okio.Buffer
                                Object objBuffer = aClassBuffer.newInstance();
                                ///* compiled from: BufferedSink */
                                Class<?> aClassBufferedSink = mTarget.getClass().getClassLoader().loadClass("okio.d");
                                Method writeToMethod = invokeBodyClass.getDeclaredMethod("writeTo", aClassBufferedSink);
                                writeToMethod.invoke(invokeRequestBody, objBuffer);
                                Method readStringMethod = aClassBuffer.getDeclaredMethod("a", Charset.class);//readString
                                String invokeReadString = (String) readStringMethod.invoke(objBuffer, Charset.forName("UTF-8"));
                                XpLog.INSTANCE.log(TAG, "request params:" + invokeReadString);
                                XpLog.INSTANCE.log(TAG, "--> END " + invokeMethod
                                        + " (" + invokeContentLength + "-byte body)");

                            }
                        }
                    }
                }
            }
        } catch (Throwable e) {
            XpLog.INSTANCE.log(e);
        }
        Object invoke = method.invoke(mTarget, args);
        return invoke;
    }

    private boolean bodyEncoded(Object invokeHeaders) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
        String contentEncoding = (String) invokeHeaders.getClass().getDeclaredMethod("get", String.class).invoke(invokeHeaders, "Content-Encoding");
        return contentEncoding != null && !contentEncoding.equalsIgnoreCase("identity");
    }
}

把请求编好，但是发现去解析响应的时候，代码突然编不下去了，okhttp里面做了判断抛了异常有点难受，我在反射proceed这个方法 ，okhttp给我抛了AssertionError，源码我找了下看，还是大哥RealInterceptorChain这个类

 public Response proceed(Request request, StreamAllocation streamAllocation, HttpCodec httpCodec, RealConnection connection) throws IOException {
        if (this.index >= this.interceptors.size()) {
            throw new AssertionError();
        } else {
            ++this.calls;
            if (this.httpCodec != null && !this.connection.supportsUrl(request.url())) {
                throw new IllegalStateException("network interceptor " + this.interceptors.get(this.index - 1) + " must retain the same host and port");
            } else if (this.httpCodec != null && this.calls > 1) {
                throw new IllegalStateException("network interceptor " + this.interceptors.get(this.index - 1) + " must call proceed() exactly once");
            } else {
                RealInterceptorChain next = new RealInterceptorChain(this.interceptors, streamAllocation, httpCodec, connection, this.index + 1, request);
                Interceptor interceptor = (Interceptor)this.interceptors.get(this.index);
                Response response = interceptor.intercept(next);
                if (httpCodec != null && this.index + 1 < this.interceptors.size() && next.calls != 1) {
                    throw new IllegalStateException("network interceptor " + interceptor + " must call proceed() exactly once");
                } else if (response == null) {
                    throw new NullPointerException("interceptor " + interceptor + " returned null");
                } else {
                    return response;
                }
            }
        }
    }

一开始想着我能不能跟拦截器那样动态代理，翻了翻代码，发现这对象每次都new，不好hook，算了，只能这样了

心想RealInterceptorChain这类，整个就唯独一个类，就算混淆也好定位，那我来hook RealInterceptorChain 的proceed方法吧

//hook RealInterceptorChain
            /**
             *     public Call newCall(Request request) {
             *         return new RealCall(this, request, false);
             *     }
             *
             *
             *     public Response getResponseWithInterceptorChain() throws IOException {
             *         ArrayList arrayList = new ArrayList();
             *         arrayList.addAll(this.client.interceptors());
             *         arrayList.add(this.retryAndFollowUpInterceptor);
             *         arrayList.add(new BridgeInterceptor(this.client.cookieJar()));
             *         arrayList.add(new CacheInterceptor(this.client.internalCache()));
             *         arrayList.add(new ConnectInterceptor(this.client));
             *         if (!this.forWebSocket) {
             *             arrayList.addAll(this.client.networkInterceptors());
             *         }
             *         arrayList.add(new CallServerInterceptor(this.forWebSocket));
             *         return new RealInterceptorChain(arrayList, null, null, null, 0, this.originalRequest, this, this.client.eventListenerFactory().create(this)).proceed(this.originalRequest);
             *     }
             */
            Class<?> aClassRealInterceptorChain = classLoader.loadClass("okhttp3.internal.http.RealInterceptorChain");
            //XposedBridge.hookAllConstructors(aClassRealInterceptorChain, xc_BuildHook);
            XposedHelpers.findAndHookMethod(
                    aClassRealInterceptorChain,
                    "proceed",
                    classLoader.loadClass("okhttp3.Request"),
                    new XC_MethodHook() {
                        @Override
                        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                            super.afterHookedMethod(param);
                            //入参
                            Object arg = param.args[0];
                            StringBuilder netStr = new StringBuilder();
                            netStr.append("\n");
                            netStr.append(">>>> start net");
                            netStr.append("\n");
                            netStr.append("procee@@@@@@arg.getClass:").append(arg.getClass());
                            netStr.append("\n");
                            netStr.append("proceed@@arg:").append(arg);

                            Class<?> aClassRequest = arg.getClass();
                            //获取body
                            Method requestBodyMethod = aClassRequest.getDeclaredMethod("body");
                            Object invokeRequestBody = requestBodyMethod.invoke(arg);
                            boolean hasRequestBody = invokeRequestBody != null;

                            Method methodMethod = aClassRequest.getDeclaredMethod("method");
                            Object invokeMethod = methodMethod.invoke(arg);

                            if (hasRequestBody) {
                                Class<?> invokeBodyClass = invokeRequestBody.getClass();
                                // Request body headers are only present when installed as a network interceptor. Force
                                // them to be included (when available) so there values are known.
                                Method contentTypeMethod = invokeBodyClass.getDeclaredMethod("contentType");
                                Object invokeContentType = contentTypeMethod.invoke(invokeRequestBody);
                                if (invokeContentType != null) {
                                    netStr.append("\n");
                                    netStr.append("Content-Type: ").append(invokeContentType);
                                }
                                Method contentLengthMethod = invokeBodyClass.getDeclaredMethod("contentLength");
                                Object invokeContentLength = contentLengthMethod.invoke(invokeRequestBody);
                                if (invokeContentLength != null) {
                                    netStr.append("\n");
                                    netStr.append("Content-Length: ").append(invokeContentLength);
                                }
                                Method headersMethod = aClassRequest.getDeclaredMethod("headers");
                                Object invokeHeaders = headersMethod.invoke(arg);
                                if (invokeHeaders != null) {
                                    Class<?> aClassHeaders = invokeHeaders.getClass();
                                    Method sizeMethod = aClassHeaders.getDeclaredMethod("size");
                                    int invokeSize = (int) sizeMethod.invoke(invokeHeaders);
                                    for (int i = 0; i < invokeSize; i++) {
                                        Method nameMethod = aClassHeaders.getDeclaredMethod("name", int.class);
                                        String name = (String) nameMethod.invoke(invokeHeaders, i);
                                        // Skip headers from the request body as they are explicitly logged above.
                                        if (!"Content-Type".equalsIgnoreCase(name) && !"Content-Length".equalsIgnoreCase(name)) {
                                            netStr.append("\n");
                                            netStr.append(name).append(": ").append(aClassHeaders.getDeclaredMethod("value", int.class).invoke(invokeHeaders, i));
                                        }
                                    }
                                    //处理结束地方
                                    if (!hasRequestBody) {
                                        netStr.append("\n");
                                        netStr.append("--> END ").append(invokeMethod);
                                    } else if (bodyEncoded(invokeHeaders)) {
                                        netStr.append("\n");
                                        netStr.append("--> END ").append(invokeMethod).append(" (encoded body omitted)");
                                    } else {
                                        //逆向看某app这里 okio做了混淆，所以要特殊处理
                                        // 混淆保留了这个，所以能看出是什么类
                                        // /* compiled from: Buffer */
                                        Class<?> aClassBuffer = null;
                                        try {
                                            aClassBuffer = classLoader.loadClass("okio.Buffer");//okio.Buffer
                                        } catch (Exception e) {
                                            aClassBuffer = classLoader.loadClass("okio.c");//okio.Buffer
                                        }
                                        Object objBuffer = aClassBuffer.newInstance();
                                        ///* compiled from: BufferedSink */
                                        Class<?> aClassBufferedSink = null;
                                        try {
                                            aClassBufferedSink = classLoader.loadClass("okio.BufferedSink");//okio.BufferedSink
                                        } catch (Exception e) {
                                            aClassBufferedSink = classLoader.loadClass("okio.d");//okio.BufferedSink
                                        }
                                        Method writeToMethod = invokeBodyClass.getDeclaredMethod("writeTo", aClassBufferedSink);
                                        writeToMethod.invoke(invokeRequestBody, objBuffer);
                                        Method readStringMethod;
                                        try {
                                            readStringMethod = aClassBuffer.getDeclaredMethod("readString", Charset.class);//readString
                                        } catch (Exception e) {
                                            readStringMethod = aClassBuffer.getDeclaredMethod("a", Charset.class);//readString
                                        }
                                        String invokeReadString = (String) readStringMethod.invoke(objBuffer, Charset.forName("UTF-8"));
                                        netStr.append("\n");
                                        netStr.append("request params:").append(invokeReadString);
                                        netStr.append("\n");
                                        netStr.append("--> END ").append(invokeMethod).append(" (").append(invokeContentLength).append("-byte body)");

                                    }
                                }
                            }

                            //出参
                            Object result = param.getResult();
                            if (result != null) {
                                netStr.append("\n");
                                netStr.append("proceed@@result:").append(result);
                                Class<?> aClassResponse = result.getClass();
                                Method headersMethod = aClassResponse.getDeclaredMethod("headers");
                                Object invokeHeaders = headersMethod.invoke(result);
                                boolean isGzip = false;
                                if (invokeHeaders != null) {
                                    Class<?> aClassHeaders = invokeHeaders.getClass();
                                    Method sizeMethod = aClassHeaders.getDeclaredMethod("size");
                                    int invokeSize = (int) sizeMethod.invoke(invokeHeaders);
                                    for (int i = 0; i < invokeSize; i++) {
                                        Method nameMethod = aClassHeaders.getDeclaredMethod("name", int.class);
                                        String name = (String) nameMethod.invoke(invokeHeaders, i);
                                        String value = (String) aClassHeaders.getDeclaredMethod("value", int.class).invoke(invokeHeaders, i);
                                        if ("Content-Encoding".equalsIgnoreCase(name) && "gzip".equals(value)) {
                                            //标记下数据是否压缩
                                            isGzip = true;
                                        }
                                        netStr.append("\n");
                                        netStr.append(name).append(": ").append(value);
                                    }
                                }
                                Method bodyResponseMethod = aClassResponse.getDeclaredMethod("body");
                                Object invokeResponseBody = bodyResponseMethod.invoke(result);
                                Class<?> aClassResponseBody = invokeResponseBody.getClass();
                                Method sourceMethod = aClassResponseBody.getDeclaredMethod("source");
                                Object invokeBufferedSource = sourceMethod.invoke(invokeResponseBody);
                                //okio.e  BufferedSource
                                Class<?> aClassBufferedSource = invokeBufferedSource.getClass();
                                //b request
                                Method requestMethod;//request
                                try {
                                    requestMethod = aClassBufferedSource.getDeclaredMethod("request", long.class);//request
                                } catch (Exception e) {
                                    requestMethod = aClassBufferedSource.getDeclaredMethod("b", long.class);//request
                                }
                                requestMethod.invoke(invokeBufferedSource, Long.MAX_VALUE);
                                // c b() buffer
                                Method bufferMethod;//buffer
                                try {
                                    bufferMethod = aClassBufferedSource.getDeclaredMethod("buffer");//buffer
                                } catch (Exception e) {
                                    bufferMethod = aClassBufferedSource.getDeclaredMethod("b");//buffer
                                }
                                Object invokeBuffer = bufferMethod.invoke(invokeBufferedSource);
                                Class<?> aClassBuffer = invokeBuffer.getClass();
                                Method cloneMethod = aClassBuffer.getDeclaredMethod("clone");
                                Object invoke = cloneMethod.invoke(invokeBuffer);
                                Class<?> aClass = invoke.getClass();
                                Method readString = null;//readString
                                try {
                                    readString = aClass.getDeclaredMethod("readString", Charset.class);//readString
                                } catch (Exception e) {
                                    readString = aClass.getDeclaredMethod("a", Charset.class);//readString
                                }
                                String repResult = (String) readString.invoke(invoke, Charset.forName("UTF-8"));

                                netStr.append("\n");
                                netStr.append("rep result:").append(isGzip ? new String(uncompress(repResult.getBytes())) : repResult);
                            }

                            netStr.append("\n");
                            netStr.append(">>>> end net");

                            XpLog.INSTANCE.log(getTag(), netStr.toString());
                        }
                    });

这样一hook，我对所有app只要用okhttp我都能正常输出出入参数了，方便分析人家app，但是存在一个问题，出入的参数可能会加密或者压缩之类，这个就自己研究吧

最后会用到这2个方法

private boolean bodyEncoded(Object invokeHeaders) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
        String contentEncoding = (String) invokeHeaders.getClass().getDeclaredMethod("get", String.class).invoke(invokeHeaders, "Content-Encoding");
        return contentEncoding != null && !contentEncoding.equalsIgnoreCase("identity");
    }

    public static byte[] uncompress(byte[] bytes) {
        if (bytes == null || bytes.length == 0) {
            return null;
        }
        ByteArrayOutputStream out = new ByteArrayOutputStream();
        ByteArrayInputStream in = new ByteArrayInputStream(bytes);
        try {
            GZIPInputStream ungzip = new GZIPInputStream(in);
            byte[] buffer = new byte[256];
            int n;
            while ((n = ungzip.read(buffer)) >= 0) {
                out.write(buffer, 0, n);
            }
            return out.toByteArray();
        } catch (Exception e) {
            //e.printStackTrace();
            return bytes;
        }
    }