Android中免root的hook框架学习——whale（二）实战hook java方法

文末附项目完整代码下载地址

一、在android studio中创建一个新的项目

1. Hook Java, 把whale项目里的java文件夹的代码复制到自己的项目中。

2. 复制 built/Android 下所需的abi到自己项目的src/main/jniLibs下。

最终的目录结构如下：

二、新建一个类Test，写一个测试的方法get，用于下面的hook测试

package com.tianseyiwan008.whalehooktest;

public class Test {
    public static String get() {
        return "test";
    }
}

三、新建一个hook的类，用于写hook的方法

package com.tianseyiwan008.whalehooktest.hook;

import com.lody.whale.xposed.XC_MethodHook;
import com.lody.whale.xposed.XposedBridge;
import com.lody.whale.xposed.XposedHelpers;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;

/**
 * @author tianseyiwan008
 * @create on 2019/07/27 10:23
 * 用whale实现hook java代码
 */
public class Main  {
    //第一种方式采用反射机制hook
    private void hook_method(String className, ClassLoader classLoader, String methodName,
                             Object... parameterTypesAndCallback){
        try {
            XposedHelpers.findAndHookMethod(className, classLoader, methodName, parameterTypesAndCallback);
        } catch (Exception e) {
            XposedBridge.log(e);
        }
    }

    //第二种方式，采用查找类的方法方式hook
    private void hook_methods(String className, String methodName, XC_MethodHook xmh){
        try {
            Class<?> clazz = Class.forName(className);
            for (Method method : clazz.getDeclaredMethods())
                if (method.getName().equals(methodName)
                        && !Modifier.isAbstract(method.getModifiers())
                        && Modifier.isPublic(method.getModifiers())) {
                    XposedBridge.hookMethod(method, xmh);
                }
        } catch (Exception e) {
            XposedBridge.log(e);
        }
    }


    public void executeHook(){
        XposedBridge.log("start hook");
        hook_methods("com.tianseyiwan008.whalehooktest.Test", "get", new XC_MethodHook(){
            @Override
            protected void afterHookedMethod(XC_MethodHook.MethodHookParam param){
                XposedBridge.log("hooking...");
                Object obj = param.getResult();
                XposedBridge.log("hooked args:"+obj);
                param.setResult("hook test by first way");
            }
        });
    }

    public void executeHook2(ClassLoader classLoader){
        XposedBridge.log("start hook2");
        hook_method("com.tianseyiwan008.whalehooktest.Test", classLoader,"get", new XC_MethodHook(){
            @Override
            protected void afterHookedMethod(XC_MethodHook.MethodHookParam param){
                XposedBridge.log("hooking...");
                Object obj = param.getResult();
                XposedBridge.log("hooked args:"+obj);
                param.setResult("hook test by second way");
            }
        });
    }
}

四、将hook在程序启动的时候执行，一般可以新建一个Application或者测试的时候在MainActivity的onCreate方法里执行

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
//        new Main().executeHook();
        new Main().executeHook2(this.getClassLoader());
        Toast.makeText(this, Test.get(), Toast.LENGTH_LONG).show();
    }

五、hook成功

点击下载完整项目：https://download.csdn.net/download/tianseyiwan008/11438440