如果是exe
MSConfig(MSFilterExecutable, "/system/bin/app_process")
b. 初始化入口:
MSInitialize
{
//TODO:模块安装后, Cydia会自动调用这里的代码,你可以在这里进行hook,也可以以后手动hook
hook();
}
(3) 进行hook, 以hook libdvm.so里的dvmCallMethodV为例:
void hook()
{
MSImageRef image = MSGetImageByName("/system/lib/libdvm.so");
if (image != NULL)
{
void * symbole = MSFindSymbol(image,
"_Z14dvmCallMethodVP6ThreadPK6MethodP6ObjectbP6JValueSt9__va_list");
if (symbole == NULL)
{
LOGE("error find _Z21dvmDexFileOpenPartialPKviPP6DvmDex ");
}
else
{
MSHookFunction(symbole, (void*) &MydvmCallMethodV,
(void **) &OriDvmCallMethodV);
LOGD("hook dvmCallMethodV ok");
}
}
else {
LOGE("error find libdvm");
}
}
4. JNI hook
与C hook基本类似, 主要区别:
(1) 把C函数hook链接的so改为libsubstrate-dvm.so
(2) 在C代码里进行hook:
MSConfig(MSFilterExecutable, "/system/bin/app_process")
static jint (*_Resources$getColor)(JNIEnv *jni, jobject _this, ...);
static jint $Resources$getColor(JNIEnv *jni, jobject _this, jint rid) {
jint color = _Resources$getColor(jni, _this, rid);
return color & ~0x0000ff00 | 0x00ff0000;
}
static void OnResources(JNIEnv *jni, jclass resources, void *data) {
jmethodID method = jni->GetMethodID(resources, "getColor", "(I)I");
if (method != NULL)
MSJavaHookMethod(jni, resources, method,
&$Resources$getColor, &_Resources$getColor);
}
MSInitialize {
MSJavaHookClassLoad(NULL, "android/content/res/Resources", &OnResources);
}