Android Hook Java


Android Hook Java

       
        由于项目需要,实现了一个脱离XPosed框架的Android Hook Java方法。其原理是注入某系统进程,使该进程加载某动态链接库,执行该库里的某函数,通过该函数执行某jar包里的java函数,然后执行hook该进程中的java函数操作。其中Hook Java部分提取了XPosed框架中的hook原理。

        1、进程注入
    target_pid = find_pid_of("system_server");
    if(inject_remote_process(target_pid, "/system/lib/libtest.so", "java_hook_test", "I'm parameter!", strlen("I'm parameter!")) == 0)
        LOGV("inject success");

        2、在C层执行Java方法
    JavaVM* jvm = AndroidRuntime::getJavaVM();
    JNIEnv* env;
    jvm->AttachCurrentThread(&env, NULL);

    jstring apk_path = env->NewStringUTF(INJECT_JAR_PATH);
    jstring dex_out_path = env->NewStringUTF("/data/dalvik-cache");
    jclass dexloader_claxx = env->FindClass("dalvik/system/DexClassLoader");

    snprintf(sig_buffer, 512, "(%s%s%s%s)V", JSTRING, JSTRING, JSTRING, JCLASS_LOADER);
    jmethodID dexloader_init_method = env->GetMethodID(dexloader_claxx, "<init>", sig_buffer);

    snprintf(sig_buffer, 512, "(%s)%s", JSTRING, JCLASS);
    jmethodID loadClass_method = env->GetMethodID(dexloader_claxx, "loadClass", sig_buffer);
    jclass class_loader_claxx = env->FindClass("java/lang/ClassLoader");
    snprintf(sig_buffer, 512, "()%s", JCLASS_LOADER);
    jmethodID getSystemClassLoader_method = env->GetStaticMethodID(class_loader_claxx, "getSystemClassLoader", sig_buffer);
    jobject class_loader = env->CallStaticObjectMethod(class_loader_claxx, getSystemClassLoader_method);
    check_value(class_loader);

    jobject dex_loader_obj = env->NewObject(dexloader_claxx, dexloader_init_method, apk_path, dex_out_path, NULL, class_loader);
    jstring class_name = env->NewStringUTF(CLASS_JAVA);
    jclass class_jia = static_cast<jclass>(env->CallObjectMethod(dex_loader_obj, loadClass_method, class_name));
    check_value(class_jia);

    jmethodID invoke_method = env->GetStaticMethodID(class_jia, "hook", "(I)V");
    check_value(invoke_method);
    env->CallStaticObjectMethod(class_jia, invoke_method, 0);
    LOGI("end hook java");
    jvm->DetachCurrentThread();

        3、添加你想执行hook操作的java函数,interceptKeyBeforeQueueing方法主要做一下对特殊按键的处理。
    Bridge.hookAllMethods(Helpers.findClass("com.android.internal.policy.impl.PhoneWindowManager"), "interceptKeyBeforeQueueing");

        4、类似于XPosed框架,添加你想替换的java函数cb_interceptKeyBeforeQueueing,可根据需求添加执行真正函数前与执行完后的操作。
    static XC_MethodHook cb_interceptKeyBeforeQueueing = new XC_MethodHook() {

        @Override
        protected void beforeHookedMethod(MethodHookParam param)
                throws Throwable {
            Log.v("test", "[KeyPress]" + param.args[0] + " | " + param.args[1] + " | " + param.args[2]);
        }
    };
        handleHookedMethod是真正替换的函数。
    private static Object handleHookedMethod(Member method, int originalMethodId, Object additionalInfoObj,
            Object thisObject, Object[] args) throws Throwable  {
        //Log.v("test", "enter handleHookedMethod");
		
        AdditionalHookInfo additionalInfo = (AdditionalHookInfo) additionalInfoObj;

        MethodHookParam param = new MethodHookParam();
        param.method = method;
        param.thisObject = thisObject;
        param.args = args;

        // call "before method" callbacks
        try {
            if (method.getName().equals("interceptKeyBeforeQueueing"))
                Hook.cb_interceptKeyBeforeQueueing.beforeHookedMethod(param);	
        } catch (Throwable t) {
            Log.v("test", t.getMessage());
            // reset result (ignoring what the unexpectedly exiting callback did)
            param.setResult(null);
            param.returnEarly = false;
        }

        // call original method if not requested otherwise
        if (!param.returnEarly) {
            try {
                param.setResult(invokeOriginalMethodNative(method, originalMethodId,
                    additionalInfo.parameterTypes, additionalInfo.returnType, param.thisObject, param.args));
            } catch (InvocationTargetException e) {
                param.setThrowable(e.getCause());
            }
        }
        // call "after method" callbacks
        Object lastResult =  param.getResult();
        Throwable lastThrowable = param.getThrowable();
        try {
            //<span style="white-space:pre">	</span>if (method.getName().equals("init"))
            //<span style="white-space:pre">		</span>Hook.cb_init.afterHookedMethod(param);
        } catch (Throwable t) {
            Log.v("test", t.getMessage());
            // reset to last result (ignoring what the unexpectedly exiting callback did)
            if (lastThrowable == null)
                param.setResult(lastResult);
            else
                param.setThrowable(lastThrowable);
        }

        // return
        if (param.hasThrowable())
            throw param.getThrowable();
        else
            return param.getResult();}

         整个工程已上传至github: 
 https://github.com/phoebe1990/javaHook 
        运行结果如下:
        hook类PhoneWindowManager中interceptKeyBeforeQueueing函数成功,使每次手机按键时都打印一条log信息。



评论 5
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值