android流氓技术,Android流氓代码块(亲测可行)

//在广播中声明

String action = intent.getAction();

if (action.equals("android.intent.action.BOOT_COMPLETED")) {

Intent activity = new Intent(context, SecondActivity.class);

activity.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);

context.startActivity(activity);

}

//权限

静默安装(需要root)

public static boolean installUseRoot(String filePath) {

if (TextUtils.isEmpty(filePath))

throw new IllegalArgumentException("Please check apk file path!");

boolean result = false;

Process process = null;

OutputStream outputStream = null;

BufferedReader errorStream = null;

try {

process = Runtime.getRuntime().exec("su");

outputStream = process.getOutputStream();

String command = "pm install -r " + filePath + "\n";

outputStream.write(command.getBytes());

outputStream.flush();

outputStream.write("exit\n".getBytes());

outputStream.flush();

process.waitFor();

errorStream = new BufferedReader(new InputStreamReader(process.getErrorStream()));

StringBuilder msg = new StringBuilder();

String line;

while ((line = errorStream.readLine()) != null) {

msg.append(line);

}

Log.d(TAG, "install msg is " + msg);

if (!msg.toString().contains("Failure")) {

result = true;

}

} catch (Exception e) {

Log.e(TAG, e.getMessage(), e);

} finally {

try {

if (outputStream != null) {

outputStream.close();

}

if (errorStream != null) {

errorStream.close();

}

} catch (IOException e) {

outputStream = null;

errorStream = null;

process.destroy();

}

}

return result;

}

关机代码块(root)

public static void closeOs(Context context) {

try {

Process proc = Runtime.getRuntime().exec(new String[]{"su", "-c", "reboot -p"}); //关机

} catch (IOException e) {

e.printStackTrace();

}

}

双守护线程保活

public class DaemonService extends Service {

String TAG = "DaemonService";

private DaemonBinder mDaemonBinder;

private DaemonServiceConnection mDaemonServiceConn;

public DaemonService() {

}

@Override

public void onCreate() {

super.onCreate();

mDaemonBinder = new DaemonBinder();

if (mDaemonServiceConn == null) {

mDaemonServiceConn = new DaemonServiceConnection();

}

Log.i(TAG, TAG + " onCreate");

}

@Override

public int onStartCommand(Intent intent, int flags, int startId) {

super.onStartCommand(intent, flags, startId);

Log.i(TAG, TAG + " onStartCommand");

bindService(new Intent(this, RemoteService.class), mDaemonServiceConn, Context.BIND_IMPORTANT);

return START_STICKY;

}

@Nullable

@Override

public IBinder onBind(Intent intent) {

return mDaemonBinder;

}

/**

* 通过AIDL实现进程间通信

*/

class DaemonBinder extends IProcessService.Stub {

@Override

public String getServiceName() throws RemoteException {

return TAG;

}

}

/**

* 连接远程服务

*/

class DaemonServiceConnection implements ServiceConnection {

@Override

public void onServiceConnected(ComponentName name, IBinder service) {

try {

// 与远程服务通信

IProcessService process = IProcessService.Stub.asInterface(service);

Log.i(TAG, "连接" + process.getServiceName() + "服务成功");

} catch (RemoteException e) {

e.printStackTrace();

}

}

@Override

public void onServiceDisconnected(ComponentName name) {

// RemoteException连接过程出现的异常,才会回调,unbind不会回调

startService(new Intent(DaemonService.this, RemoteService.class));

bindService(new Intent(DaemonService.this, RemoteService.class), mDaemonServiceConn, Context.BIND_IMPORTANT);

}

}

}

public class RemoteService extends Service {

String TAG = "RemoteService";

private ServiceBinder mServiceBinder;

private RemoteServiceConnection mRemoteServiceConn;

@Override

public void onCreate() {

super.onCreate();

mServiceBinder = new ServiceBinder();

if (mRemoteServiceConn == null) {

mRemoteServiceConn = new RemoteServiceConnection();

}

Log.i(TAG, TAG + " onCreate");

}

@Override

public int onStartCommand(Intent intent, int flags, int startId) {

super.onStartCommand(intent, flags, startId);

Log.i(TAG, TAG + " onStartCommand");

bindService(new Intent(this, DaemonService.class), mRemoteServiceConn, Context.BIND_IMPORTANT);

return START_STICKY;

}

@Nullable

@Override

public IBinder onBind(Intent intent) {

return mServiceBinder;

}

/**

* 通过AIDL实现进程间通信

*/

class ServiceBinder extends IProcessService.Stub {

@Override

public String getServiceName() throws RemoteException {

return "RemoteService";

}

}

/**

* 连接远程服务

*/

class RemoteServiceConnection implements ServiceConnection {

@Override

public void onServiceConnected(ComponentName name, IBinder service) {

try {

IProcessService process = IProcessService.Stub.asInterface(service);

Log.i(TAG, "连接" + process.getServiceName() + "服务成功");

} catch (RemoteException e) {

e.printStackTrace();

}

}

@Override

public void onServiceDisconnected(ComponentName name) {

// RemoteException连接过程出现的异常,才会回调,unbind不会回调

startService(new Intent(RemoteService.this, DaemonService.class));

bindService(new Intent(RemoteService.this, DaemonService.class), mRemoteServiceConn, Context.BIND_IMPORTANT);

}

}

}

//aidl 文件

package com.android.process.aidl;

interface IProcessService {

/**

* Demonstrates some basic types that you can use as parameters

* and return values in AIDL.

*/

String getServiceName();

}

非Root的智能安装(可以)

原理是用到了android提供的AccessibilityService服务,这个服务可以获取屏幕上的节点,一个节点也就是一个view,我们写的xml文件中每个标签就是一个节点,然后可以模拟用户的操作,对这些节点进行点击、滑动等操作。我们就是利用这个原理,来自动点击安装按钮的,当然使用这个服务必须用户手动开启无障碍服务。

创建AccessibilityService配置文件 在res目录下创建xml目录,然后在xml目录下创建一个accessibility_service_config.xml文件,内容如下 res/xml/accessibility_service_config.xml:

android:accessibilityEventTypes="typeAllMask"

android:accessibilityFeedbackType="feedbackGeneric"

android:accessibilityFlags="flagDefault"

android:canRetrieveWindowContent="true"

android:description="@string/desc"

android:packageNames="com.android.packageinstaller"

/>

accessibilityEventTypes:指定我们在监听窗口中可以模拟哪些事件,typeAllMask表示所有的事件都能模拟.

accessibilityFeedbackType:指定无障碍服务的反馈方式.

canRetrieveWindowContent:指定是否允许我们的程序读取窗口中的节点和内容,当然是true.

description: 当用户手动配置服务时,会显示给用户看.

packageNames: 指定我们要监听哪个应用程序下的窗口活动,这里写com.android.packageinstaller表示监听Android系统的安装界面。 其余参数照写即可。 res/strings.xml:

创建AccessibilityService服务

public class MyAccessibilityService extends AccessibilityService {

private static final String TAG = "[TAG]";

private Map handleMap = new HashMap<>();

@Override

public void onAccessibilityEvent(AccessibilityEvent event) {

AccessibilityNodeInfo nodeInfo = event.getSource();

if (nodeInfo != null) {

int eventType = event.getEventType();

if (eventType == AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED || eventType == AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED) {

if (handleMap.get(event.getWindowId()) == null) {

boolean handled = iterateNodesAndHandle(nodeInfo);

if (handled) {

handleMap.put(event.getWindowId(), true);

}

}

}

}

}

@Override

public void onInterrupt() {

}

//遍历节点,模拟点击安装按钮

private boolean iterateNodesAndHandle(AccessibilityNodeInfo nodeInfo) {

if (nodeInfo != null) {

int childCount = nodeInfo.getChildCount();

if ("android.widget.Button".equals(nodeInfo.getClassName())) {

String nodeCotent = nodeInfo.getText().toString();

Log.d(TAG, "content is: " + nodeCotent);

if ("安装".equals(nodeCotent) || "完成".equals(nodeCotent) || "确定".equals(nodeCotent)) {

nodeInfo.performAction(AccessibilityNodeInfo.ACTION_CLICK);

return true;

}

}

//遇到ScrollView的时候模拟滑动一下

else if ("android.widget.ScrollView".equals(nodeInfo.getClassName())) {

nodeInfo.performAction(AccessibilityNodeInfo.ACTION_SCROLL_FORWARD);

}

for (int i = 0; i < childCount; i++) {

AccessibilityNodeInfo childNodeInfo = nodeInfo.getChild(i);

if (iterateNodesAndHandle(childNodeInfo)) {

return true;

}

}

}

return false;

}

}

AndroidManifest中配置服务

android:name=".MyAccessibilityService"

android:label="智能安装App"

android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE"

>

android:name="android.accessibilityservice"

android:resource="@xml/accessibility_service_config"

/>

重点是后面的service标签:

android:label:这个就是用户看到的无障碍服务的名称

android:permission: 需要用到BIND_ACCESSIBILITY_SERVICE这个权限.

action: android.accessibilityservice.AccessibilityService 有了这个action,用户才能在设置里面看到我们的服务,否则用户无法开启我们写的服务,也就不能进到我们写的MyAccessibilityService里面了.所以,注意不要写错了,如果你发现无障碍服务里面没有我们写的服务,请检查这里.

调用智能安装代码

private void smartInstall() {

Uri uri = Uri.fromFile(new File("/mnt/sdcard/test.apk"));

Intent localIntent = new Intent(Intent.ACTION_VIEW);

localIntent.setDataAndType(uri, "application/vnd.android.package-archive");

startActivity(localIntent);

}

手动配置智能安装服务

//跳转到开启智能安装服务的界面

Intent intent = new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS);

startActivity(intent);

  • 0
    点赞
  • 2
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值