android9.0谷歌app删除列表,android 9.0 系统应用使用webview功能

由于android本身机制，系统应用禁止使用webview功能，webview容易使JS注入漏洞，从而轻易获取到app的系统权限。

解决办法：

1、验证webview的url，必须是配置过的host才允许访问。

2、绕过系统检测，通过提前实例化安检provider

/**

* 解决系统应用不能访问webview的方法，先hook拿到系统sProviderInstance实例

*/

public void hookWebView(){

int sdkInt = Build.VERSION.SDK_INT;

try {

Class> factoryClass = Class.forName("android.webkit.WebViewFactory");

Field field = factoryClass.getDeclaredField("sProviderInstance");

field.setAccessible(true);

Object sProviderInstance = field.get(null);

if (sProviderInstance != null) {

Log.i(TAG,"sProviderInstance isn't null");

return;

}

Method getProviderClassMethod;

if (sdkInt > 22) {

getProviderClassMethod = factoryClass.getDeclaredMethod("getProviderClass");

} else if (sdkInt == 22) {

getProviderClassMethod = factoryClass.getDeclaredMethod("getFactoryClass");

} else {

Log.i(TAG,"Don't need to Hook WebView");

return;

}

getProviderClassMethod.setAccessible(true);

Class> factoryProviderClass = (Class>) getProviderClassMethod.invoke(factoryClass);

Class> delegateClass = Class.forName("android.webkit.WebViewDelegate");

Constructor> delegateConstructor = delegateClass.getDeclaredConstructor();

delegateConstructor.setAccessible(true);

if(sdkInt < 26){//低于Android O版本

Constructor> providerConstructor = factoryProviderClass.getConstructor(delegateClass);

if (providerConstructor != null) {

providerConstructor.setAccessible(true);

sProviderInstance = providerConstructor.newInstance(delegateConstructor.newInstance());

}

} else {

Field chromiumMethodName = factoryClass.getDeclaredField("CHROMIUM_WEBVIEW_FACTORY_METHOD");

chromiumMethodName.setAccessible(true);

String chromiumMethodNameStr = (String)chromiumMethodName.get(null);

if (chromiumMethodNameStr == null) {

chromiumMethodNameStr = "create";

}

Method staticFactory = factoryProviderClass.getMethod(chromiumMethodNameStr, delegateClass);

if (staticFactory!=null){

sProviderInstance = staticFactory.invoke(null, delegateConstructor.newInstance());

}

}

if (sProviderInstance != null){

field.set("sProviderInstance", sProviderInstance);

Log.i(TAG,"Hook success!");

} else {

Log.i(TAG,"Hook failed!");

}

} catch (Throwable e) {

Log.w(TAG,e);

}

}