xp:
XposedHelpers.setStaticObjectField(classBuild, "SERIAL","serial")
//XposedHelpers.setStaticObjectField(classBuild, "SERIAL",
// SharedPref.getXValue("serial"))
手动修改
// 把一个字符串的第一个字母大写、效率是最高的、
private static String getMethodName(String fildeName) throws Exception{
byte[] items = fildeName.getBytes();
items[0] = (byte) ((char) items[0] - 'a' + 'A');
return new String(items);
}
public void AndroidSerial(XC_LoadPackage.LoadPackageParam loadPkgParam){
try {
//-------------------------------------2019 - 6 - 10 haidragon修改 ------------------------------------
// Class<?> classBuild = XposedHelpers.findClass("android.os.Build",
// loadPkgParam.classLoader);
final Class<?> classBuild = loadPkgParam.classLoader.loadClass("android.os.Build");
XposedHelpers.findAndHookMethod(classBuild, "getString",String.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
//打印调用堆栈
new Exception("trak").printStackTrace();
Log.i(TAG,"findAndHookMethod "+"返回值:"+param.getResult()+"参数:"+param.args[0]);
//param.setResult(false);
}
});
// XposedHelpers.setStaticObjectField(classBuild, "SERIAL",
// SharedPref.getXValue("serial")); // 串口序列号
Class<?> Class_android_os_Build=Class.forName("android.os.Build");
Field nameField =Class_android_os_Build.getDeclaredField("SERIAL");
nameField.setAccessible(true);
// Field modifiers = Field.class.getDeclaredField("modifiers");
// modifiers.setAccessible(true);
// modifiers.setInt(nameField,nameField.getModifiers() & ~Modifier.FINAL);
//nameField.set(null,SharedPref.getXValue("serial"));
nameField.set(null,"修改成功!!!"); nameField.set(Class_android_os_Build.getConstructor().newInstance(),"haidragon");
// modifiers.setAccessible(true);
// modifiers.setInt(nameField, nameField.getModifiers() & ~Modifier.FINAL);
// nameField.set(classBuild.getConstructor().newInstance(),SharedPref.getXValue("serial"));
Log.i(TAG,"test public static final String SERIAL: "+nameField.get(classBuild.getConstructor().newInstance()));
// Log.i(TAG,"test public static final String SERIAL: "+nameField.get());
// modifiers.setInt(nameField, nameField.getModifiers() & ~Modifier.FINAL);
//test public static final String SERIAL = getString("no.such.thing");
Log.i(TAG,"test public static final String SERIAL = getString");
Log.i(TAG,"test public static final String SERIAL = getString"+"类 :"+Class_android_os_Build.getName());
Method method_getString=Class_android_os_Build.getDeclaredMethod("getString",String.class);
Log.i(TAG,"test public static final String SERIAL = getString"+"方法 :"+method_getString.getName());
method_getString.setAccessible(true);//设置可访问
String retn= (String)method_getString.invoke(Class_android_os_Build.getConstructor().newInstance(),"ro.build.user");
Log.i(TAG,"test public static final String SERIAL = getString ro.build.user "+"返回值:"+retn);
String str_no_such_thing= (String)method_getString.invoke(Class_android_os_Build.getConstructor().newInstance(),"no.such.thing");
Log.i(TAG,"test public static final String SERIAL = getString no.such.thing "+"返回值:"+str_no_such_thing);
String str_ro_build_host= (String)method_getString.invoke(Class_android_os_Build.getConstructor().newInstance(),"ro.build.host");
Log.i(TAG,"test public static final String SERIAL = getString no.such.thing "+"返回值:"+str_ro_build_host);
//遍历内部类
for (final Class class1 : classBuild.getDeclaredClasses()){
//判断类是不是枚举类
if(class1.isEnum()){
//获取内部内的类名,在这里其实就是获取枚举类
String simpleName = class1.getSimpleName();
Log.i(TAG,"枚举类名:"+simpleName);
//反射获取枚举类
Class<Enum> clazz = (Class<Enum>)Class.forName("com.zr.entity.Constant$"+simpleName);
//获取所有枚举实例
Enum[] enumConstants = clazz.getEnumConstants();
//根据方法名获取方法
Method getCode = clazz.getMethod("getDesc");
for (Enum enum1 : enumConstants) {
//得到枚举实例名
String name2 = enum1.name();
//执行枚举方法获得枚举实例对应的值
Object invoke = getCode.invoke(enum1);
System.out.println(name2+":"+invoke.toString());
Log.i(TAG,"获得枚举实例对应的值:"+name2+":"+invoke.toString());
}
//其它类
}else {
Log.i(TAG,"内部内的类名:"+class1.getSimpleName());
for (final Method method:class1.getDeclaredMethods()){
Log.i(TAG,"内部内的类中的方法名:"+method.getName());
}
}
}
//遍历所有构造函数
for (final Constructor<?> constructor : classBuild.getConstructors()) {
Log.i(TAG,"构造函数:"+constructor.getName());
}
//遍历所有的方法
for (final Method method:classBuild.getDeclaredMethods()) {
Log.i(TAG, "类中的方法名:" + method.getName());
method.setAccessible(true); //设置字段访问属性
if (!Modifier.isAbstract(method.getModifiers()) && !Modifier.isNative(method.getModifiers()) && !Modifier.isInterface(method.getModifiers())){
XposedBridge.hookMethod(method, new XC_MethodHook() {
//跳过编译时的lint检查 会存在适配问题
//被hook的函数前先执行
@SuppressLint("NewApi")
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
if (param.args != null)
//if(param.args.length>0)
Log.i(TAG, "beforeHookedMethod 方法名:" + method.getName() + "返回值:" + param.getResult() + "参数:" + param.args[0]);
else
Log.i(TAG, "beforeHookedMethod 方法名:" + method.getName() + "返回值:" + param.getResult() + "参数:NULL");
}
//被hook的函数前先执行
// @SuppressLint("NewApi")
// @Override
// protected void afterHookedMethod(MethodHookParam param) throws Throwable {
// super.afterHookedMethod(param);
// if(param.args!=null)
// //if(param.args.length>0)
// Log.i(TAG,"afterHookedMethod 方法名:"+method.getName()+"返回值:"+param.getResult()+"参数:"+param.args[0]);
// else
// Log.i(TAG,"afterHookedMethod 方法名:"+method.getName()+"返回值:"+param.getResult()+"参数:null");
// }
});
}
}
//遍历所有属性
for (final Field field:classBuild.getDeclaredFields()){
// Log.i(TAG,"test public static final String SERIAL = getString");
Log.i(TAG,"类中的属性名:"+field.getName()+"类型:"+field.getGenericType().toString() +"类型修改符 :"+field.getModifiers());
// Log.i(TAG,"test public static final String SERIAL = getString");
}
for (final Field field : classBuild.getDeclaredFields()) {// --for() begin
Log.i(TAG,"类中的属性名:"+field.getName()+"类型:"+field.getGenericType().toString() +"类型修改符 :"+field.getModifiers());
// 如果类型是String
if (field.getGenericType().toString().equals(
"class java.lang.String")) { // 如果type是类类型,则前面包含"class ",后面跟类名
// 拿到该属性的gettet方法
/**
* 这里需要说明一下:他是根据拼凑的字符来找你写的getter方法的
* 在Boolean值的时候是isXXX(默认使用ide生成getter的都是isXXX)
* 如果出现NoSuchMethod异常 就说明它找不到那个gettet方法 需要做个规范
*/
Method m = (Method) classBuild.getClass().getMethod(
"get" + getMethodName(field.getName()));
String val = (String) m.invoke(classBuild);// 调用getter方法获取属性值
if (val != null) {
System.out.println("String type:" + val);
Log.i(TAG,"类中的属性名:"+field.getName()+"类型:"+field.getGenericType().toString() +"类型修改符 :"+field.getModifiers()+" val:"+val);
}
}
// 如果类型是Integer
if (field.getGenericType().toString().equals(
"class java.lang.Integer")) {
Method m = (Method) classBuild.getClass().getMethod(
"get" + getMethodName(field.getName()));
Integer val = (Integer) m.invoke(classBuild);
if (val != null) {
System.out.println("Integer type:" + val);
Log.i(TAG,"类中的属性名:"+field.getName()+"类型:"+field.getGenericType().toString() +"类型修改符 :"+field.getModifiers()+" val:"+val);
}
}
// 如果类型是Double
if (field.getGenericType().toString().equals(
"class java.lang.Double")) {
Method m = (Method) classBuild.getClass().getMethod(
"get" + getMethodName(field.getName()));
Double val = (Double) m.invoke(classBuild);
if (val != null) {
System.out.println("Double type:" + val);
Log.i(TAG,"类中的属性名:"+field.getName()+"类型:"+field.getGenericType().toString() +"类型修改符 :"+field.getModifiers()+" val:"+val);
}
}
// 如果类型是Boolean 是封装类
if (field.getGenericType().toString().equals(
"class java.lang.Boolean")) {
Method m = (Method) classBuild.getClass().getMethod(
field.getName());
Boolean val = (Boolean) m.invoke(classBuild);
if (val != null) {
System.out.println("Boolean type:" + val);
Log.i(TAG,"类中的属性名:"+field.getName()+"类型:"+field.getGenericType().toString() +"类型修改符 :"+field.getModifiers()+" val:"+val);
}
}
// 如果类型是boolean 基本数据类型不一样 这里有点说名如果定义名是 isXXX的 那就全都是isXXX的
// 反射找不到getter的具体名
if (field.getGenericType().toString().equals("boolean")) {
Method m = (Method) classBuild.getClass().getMethod(
field.getName());
Boolean val = (Boolean) m.invoke(classBuild);
if (val != null) {
System.out.println("boolean type:" + val);
Log.i(TAG,"类中的属性名:"+field.getName()+"类型:"+field.getGenericType().toString() +"类型修改符 :"+field.getModifiers()+" val:"+val);
}
}
// 如果类型是Date
if (field.getGenericType().toString().equals(
"class java.util.Date")) {
Method m = (Method) classBuild.getClass().getMethod(
"get" + getMethodName(field.getName()));
Date val = (Date) m.invoke(classBuild);
if (val != null) {
System.out.println("Date type:" + val);
Log.i(TAG,"类中的属性名:"+field.getName()+"类型:"+field.getGenericType().toString() +"类型修改符 :"+field.getModifiers()+" val:"+val);
}
}
// 如果类型是Short
if (field.getGenericType().toString().equals(
"class java.lang.Short")) {
Method m = (Method) classBuild.getClass().getMethod(
"get" + getMethodName(field.getName()));
Short val = (Short) m.invoke(classBuild);
if (val != null) {
System.out.println("Short type:" + val);
Log.i(TAG,"类中的属性名:"+field.getName()+"类型:"+field.getGenericType().toString() +"类型修改符 :"+field.getModifiers()+" val:"+val);
}
}
// 其他的类型
}//for() --end
//-------------------------------------2019 - 6 - 10 haidragon修改 ------------------------------------
Class<?> classSysProp = Class
.forName("android.os.SystemProperties");
XposedHelpers.findAndHookMethod(classSysProp, "get", String.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
// TODO Auto-generated method stub
super.afterHookedMethod(param);
String serialno = (String) param.args[0];
if (serialno.equals("gsm.version.baseband")
|| serialno.equals("no message")
) {
param.setResult(SharedPref.getXValue("getBaseband"));
}
}
});
XposedHelpers.findAndHookMethod(classSysProp, "get", String.class,
String.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
// TODO Auto-generated method stub
super.afterHookedMethod(param);
String serialno = (String) param.args[0];
if (serialno.equals("gsm.version.baseband")
|| serialno.equals("no message")
) {
param.setResult(SharedPref.getXValue("getBaseband"));
}
}
});
return;
} catch (Exception ex) {
XposedBridge.log(" AndroidSerial 错误: " + ex.getMessage());
}
}
java和android有点不同:
https://www.cnblogs.com/noKing/p/9038234.html
https://github.com/GoldArowana/K-Object/tree/master/src/test/java/reflect/field
转载于:https://blog.51cto.com/haidragon/2407216