目录
【前言】自行安装
android studio
项目环境
一、xposed环境搭建
(1) 导入依赖api-82.jar 下载
(2) 修改AndroidManifest.xml(改为xposed模块)
<meta-data
android:name="xposedmodule"
android:value="true" />
<meta-data
android:name="xposeddescription"
android:value="this is a hook script" />
<meta-data
android:name="xposedminversion"
android:value="82" />
(3) 编写hook类
package com.example.myandroidstudio;
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
public class Hook implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable{
if(!lpparam.packageName.equals("com.app.acc"))return; // 过滤,只hook包名为com.app.acc的app
Log.d("yunxiao>>>","hook start...");
}
}
(3) 增加 xposed 初始化入口
新建一个名为xposed_init的text文件,填写Hook类的路径,如下即可
(4) 编译为xposed模块apk
编译完成后,找到apk手动安装即可
(5) 激活刚刚的xposed模块
打开xposed找到模块,打勾然后软重启即可
(6) 连接安卓进行调试输出
添加log信息过滤器,即可输出hook相应的app
注意事项:有可能调试输出没有找到相应app的包名,解决办法:重启手机
二、hook教学
(1) hook普通函数
package com.example.myandroidstudio;
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
import java.util.Map;
public class Hook implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
if(!lpparam.packageName.equals("com.xxx.abc")) return;
Log.d("yunxiao>>>","hook com.xxx.abc");
XposedHelpers.findAndHookMethod("abc.g$a", lpparam.classLoader, "onCallToAddSecurityFactor", String.class, Map.class, new XC_MethodHook() {
// $a 为类中类
// String.class, Map.class 为入参类型,如果入参为空则不用填,有多少个入参填多少个
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
String args0 = (String) param.args[0];
String args1 = param.args[1].toString(); // map打印输出
Log.d("yunxiao>>>","================================= hook start ==================================");
Log.d("yunxiao>>>","after args0:"+args0);
Log.d("yunxiao>>>","after args1:"+args1);
Log.d("yunxiao>>>","after result:"+param.getResult().toString());
Log.d("yunxiao>>>","================================= hook end ==================================");
super.afterHookedMethod(param);
}
});
}
}
(2) 打印调用栈
把下面代码放到
afterHookedMethod
中即可
Log.e("yunxiao>>>","Stack:",new Throwable("Stack dump"));