android web hook,WebView-骚操作03-Hook

android5.0以上，webview所在进程如果是android.uid.system，运行则会直接崩溃。

解决方法：

2个apk，由主apk做需要system权限的业务，拉起webview apk

通过hook方式解决，参考android.webkit.WebViewFactory源码，详细代码如下

public class WebViewUtils {

private static final String TAG = "WebViewUtils";

public static void hookWebView() {

final int uid = android.os.Process.myUid();

if (uid != android.os.Process.SYSTEM_UID) {

Log.e(TAG, "uid=" + uid + ";not SYSTEM_UID;need not hook");

return;

}

int sdkInt = Build.VERSION.SDK_INT;

try {

Class> factoryClass = Class.forName("android.webkit.WebViewFactory");

Field field = factoryClass.getDeclaredField("sProviderInstance");

field.setAccessible(true);

Object sProviderInstance = field.get(null);

if (sProviderInstance != null) {

Log.i(TAG, "sProviderInstance!=null;need not hook");

return;

} else {

Log.i(TAG, "sProviderInstance==null;need hook");

}

Method getProviderClassMethod;

if (sdkInt > 22) {

getProviderClassMethod = factoryClass.getDeclaredMethod("getProviderClass");

} else if (sdkInt == 22) {

getProviderClassMethod = factoryClass.getDeclaredMethod("getFactoryClass");

} else {

Log.i(TAG, "sdkInt:" + sdkInt + ";need not Hook");

return;

}

getProviderClassMethod.setAccessible(true);

Class> factoryProviderClass = (Class>) getProviderClassMethod.invoke(factoryClass);

Class> delegateClass = Class.forName("android.webkit.WebViewDelegate");

Constructor> delegateConstructor = delegateClass.getDeclaredConstructor();

delegateConstructor.setAccessible(true);

if (sdkInt < 26) {

//低于Android O版本

Constructor> providerConstructor = factoryProviderClass.getConstructor(delegateClass);

if (providerConstructor != null) {

providerConstructor.setAccessible(true);

sProviderInstance = providerConstructor.newInstance(delegateConstructor.newInstance());

}

} else {

String chromiumMethodNameStr = null;

try {

Field chromiumMethodName = factoryClass.getDeclaredField("CHROMIUM_WEBVIEW_FACTORY_METHOD");

chromiumMethodName.setAccessible(true);

chromiumMethodNameStr = (String) chromiumMethodName.get(null);

} catch (Exception e) {

Log.e(TAG, "can not found CHROMIUM_WEBVIEW_FACTORY_METHOD;use create");

}

if (chromiumMethodNameStr == null) {

chromiumMethodNameStr = "create";

}

Method staticFactory = factoryProviderClass.getMethod(chromiumMethodNameStr, delegateClass);

if (staticFactory != null) {

sProviderInstance = staticFactory.invoke(null, delegateConstructor.newInstance());

}

}

if (sProviderInstance != null) {

field.set("sProviderInstance", sProviderInstance);

Log.i(TAG, "Hook success!");

} else {

Log.i(TAG, "Hook failed!");

}

} catch (Throwable e) {

Log.w(TAG, e);

}

}

}