本篇主要讲下hook获取 抖音账户的相关信息,直接上代码。
public class DouHook {
private static final String TAG = "DouHook";
public static void hook(XC_LoadPackage.LoadPackageParam lpparam) {
Log.e(TAG, "DouHook start");
if (lpparam == null || !lpparam.packageName.equals("com.ss.android.ugc.aweme")) {
return;
}
try {
Class<?> AccountProxyService = XposedHelpers.findClass("com.ss.android.ugc.aweme.account.AccountProxyService", lpparam.classLoader);
XposedHelpers.findAndHookMethod(AccountProxyService, "userService", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Object result = param.getResult();
if (result != null) {
Class<?> IAccountUserService = XposedHelpers.findClass("com.ss.android.ugc.aweme.account.service.IAccountUserService", lpparam.classLoader);
Method getCurUser = IAccountUserService.getMethod("getCurUser");
Object user = getCurUser.invoke(result, null);
Class<?> aClass = user.getClass();
ArrayList<Field> objects = new ArrayList<>();
objects.addAll(Arrays.asList(aClass.getDeclaredFields()));
for (Field object : objects) {
try {
object.setAccessible(true);
Log.i(TAG, "object: " + object.getName() + "=" + object.get(user));
} catch (Throwable e) {
}
}
}
}
});
} catch (Throwable e) {
Log.e(TAG, "hook: ", e);
}
Log.e(TAG, "DouHook end");
}
}
打印的输出如下: 具体可查看com.ss.android.ugc.aweme.profile.model.User类。