Legend是一款免root的开源框架,作者Lody,github地址:https://github.com/asLody/legend,直接下载下来就能运行。
项目包含主工程sample,library工程legendCore以及Native方法。sample中很简单,MainActivity.java中三个按钮分别实现获取sim卡iccid,弹出toast提示,调用startActivity方法,APP.java分别对这三个方法hook!
@Hook("android.telephony.TelephonyManager::getSimSerialNumber")
public static String TelephonyManager_getSimSerialNumber(TelephonyManager thiz) {
return "110";
}
@Hook("android.widget.Toast::show")
public static void Toast_show(Toast toast) {
if (ENABLE_TOAST) {
HookManager.getDefault().callSuper(toast);
}
}
@Hook("android.app.Activity::startActivity@android.content.Intent")
public static void Activity_startActivity(Activity activity, Intent intent)
@Hook怎么使用了?来看下源码!
public void applyHooks(Class<?> holdClass) {
for (Method hookMethod : holdClass.getDeclaredMethods()) {
Hook hook = hookMethod.getAnnotation(Hook.class);
if (hook != null) {
String statement = hook.value();
String[] splitValues = statement.split("::");
if (splitValues.length == 2) {
String className = splitValues[0];
String[] methodNameWithSignature = splitValues[1].split("@");
if (methodNameWithSignature.length <= 2) {
String methodName = methodNameWithSignature[0];
String signature = methodNameWithSignature.length == 2 ? methodNameWithSignature[1] : "";
String[] paramList = signature.split("#");
if (paramList[0].equals("")) {
paramList = new String[0];
}
try {
Class<?> clazz = Class.forName(className);
boolean isResolve = false;
for (Method method : clazz.getDeclaredMethods()) {
if (method.getName().equals(methodName)) {
Class<?>[] types = method.getParameterTypes();
if (paramList.length == types.length) {
boolean isMatch = true;
for (int N = 0; N < types.length; N++) {
if (!types[N].getName().equals(paramList[N])) {
isMatch = false;
break;
}
}
if (isMatch) {
hookMethod(method, hookMethod);
isResolve = true;
Logger.d("[+++] %s have hooked.", method.getName());
}
}
}
if (isResolve) {
break;
}
}
if (!isResolve) {
Logger.e("[---] Cannot resolve Method : %s.", Arrays.toString(methodNameWithSignature));
}
} catch (Throwable e) {
Logger.e("[---] Error to Load Hook Method From : %s." , hookMethod.getName());
e.printStackTrace();
}
}else {
Logger.e("[---] Can't split method and signature : %s.", Arrays.toString(methodNameWithSignature));
}
}else {
Logger.e("[---] Can't understand your statement : [%s].", statement);
}
}
}
}
从代码逻辑看,@Hook(“具体类名::方法名@参数类型1#参数类型2…”)。
用法搞懂了,来自定义一个方法并hook吧!!
- 定义一个简单的login方法。
public void login(int name,int pass){
if(name==111&pass==222){
Toast.makeText(this, "success", Toast.LENGTH_SHORT).show();
}
}
- 点击button调用login
public void onClick(View view) {
switch (view.getId()){
case R.id.startActivity:
int name=111,pass=222;
login(name,pass);
break;
default:
break;
}
}
- 在APP.java中hook,打印出name和pass值
@Hook("com.legend.demo.MainActivity::login@int#int")
public static void MainActivity_login(MainActivity activity,int a,int b){
Toast.makeText(activity, "参数:"+a+b, Toast.LENGTH_SHORT).show();
HookManager.getDefault().callSuper(activity,a,b);
}
至此Legend框架基本使用就完成了,具体的内部如何实现的,有兴趣的可以阅读源码!!