安卓逆向-Xposed-Hook常用API

Xposed常用API

Hook复杂&自定义参数

如上述其中一个方法

  private final void complexParameterFunc(String str, HashMap<Object, Object> map) {
        Log.d(Tag, "这是复杂参数方法 || " + str);
    }

编写如下hook代码，使用了XposedBridge中的hookAllMethods方法避免了使用findAndHookMethod时需要输入一些复杂的或自定义的参数

        Class a = loadPackageParam.classLoader.loadClass("com.zj.wuaipojie.Demo");
        XposedBridge.hookAllMethods(a, "complexParameterFunc", new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                Log.d("zxd030116",param.args[0].toString());
            }
        });

![[Pasted image 20240821153741.png]]

Hook替换函数

 private final void repleaceFunc() {
        Log.d(Tag, "这是替换函数");
    }

hook函数使其置空,猜测可用于一些障碍方法的置空

        Class a = loadPackageParam.classLoader.loadClass("com.zj.wuaipojie.Demo");
        XposedBridge.hookAllMethods(a,"replaceFunc", new XC_MethodReplacement() {
            @Override
            protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                return "";
            }
        });

可看到无替换函数的日志输出
![[Pasted image 20240821161925.png]]

Hook加固通杀（绝大部分免杀壳）

加固后的app做hook需要
通过Application的attach方法获取classLoader传入，在进行Hook逻辑编写

        XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
                Context context = (Context) param.args[0];
                ClassLoader classLoader = context.getClassLoader();
                XposedHelpers.findAndHookMethod("com.zj.wuaipojie.Demo", classLoader, "a", String.class, new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                XposedBridge.log(param.args[0].toString());  //xp自带api
                Log.d("zxd030116", param.args[0].toString());    //安卓自带log 日志标签:参数
                String a = "pt";
                param.args[0] = a;
                Log.d("zxd030116", param.args[0].toString());
            }
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
                Log.d("zxd030116",param.getResult().toString());
               param.setResult("123456");
            }
                });


            }
        });

Hook变量

静态变量与实例变量：

• 静态变量：随着类被初始化，同步进行初始化
• 实例变量 ：类被实例化（产生一个对象的时候）进行初始化

静态变量

final class clazz = XposedHelpers.findClass("类名",cclassLoader);
xposedHelpers.setstaticIntField(clazz,"变量名",999);

实例变量

final class clazz = XposedHelpers.findClass("类名",classLoader);
XposedBridge.hookAllConstructors(clazz,new XC_MethodHook() {
	@Override
	protected void afterHookMethod(MethodHookParam param) throws Throwable{
	super.afterHookedMethodMethod(param);
	//param.thisObject获取当前所属的对象
	object ob = param.thisObject;
	xposedHelpers.setIntField(ob,"变量名",9999);
	}
});

Hook构造函数

无参构造函数

XposedHelpers.findAndHookConstructor("com.zj.wuaipojie.Demo",classLoader,new XC_MethodHook(){
	@Override
	protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
		super.beforeHookedMethod(param);
	}
	@Override
	protected void afterHookedMethod(MethodHookParam param) throws Throwable {
		super.afterHookedMethod(param);
	}
});

有参构造函数

XposedHelpers.findAndHookConstructor("com.zj.wuaipojie.Demo",classLoader,String.class,new XC_MethodHook(){
	@Override
	protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
		super.beforeHookedMethod(param);
	}
	@Override
	protected void afterHookedMethod(MethodHookParam param) throws Throwable {
		super.afterHookedMethod(param);
	}
});

Hook multiDex方法

hook多个dex方法

XposedHelpers.findAndHookMethod(Application.class,"attch",Context.class,new XC_MethodHook(){
	ClassLoader cl = ((cContext)param.args[0]).getClassLoader();
	Class<?> hookclass = null;
	try {
		hookclass = cl.loadClass("类名");
	}catch (Exception e){
		Log.e("zj2529","未找到类",e);
		return;
	}
	XposedHelpers.findAndHookMethod(hookclass,"方法名",new XC_MethodHook(){
		@Override
	protected void afterHookedMethod(MethodHookParam param) throws Throwable {
		super.afterHookedMethod(param);
	}
	});
	}
});

主动调用

静态方法

Class clazz = XposedHelpers.findClass("类名",lparam.classLoader);
xposedHelpers.callStaticMethod(clazz,"方法名",参数(非必须));

实例方法

Class clazz = XposedHelpers.findClass("类名",lparam.classLoader);
xposedHelpers.callMethod(clazz.newInstance(),"方法名",参数(非必须));

Hook内部类

内部类：类中还有一个类class
类名$内部类名

XposedHelpers.findAndHookMethod("com.zj.wuaipojie.Demo$InnerClass",Ipparam.classLoader,"innerFunc",String.class,new XC_MethodHook() {
	@Override
	protected void beforeHookMethod(MethodHookParam param)throws Throwable {
		super.beforeHookMethod(param);
	}
	});

反射大法

class clazz = XposedHelpers.findClass("com.zj.wuaipojie.Demo",Ipparam.classLoader);
XposedHelpers.findAndHookMethod("com.zj.wuaipojie.Demo$InnerClass",Ipparam.classLoader,"innerFunc",String.class,new XC_MethodHook(){
	@Override
	protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	// 第一步找到类
	// 找到方法，私有方法需要setAccessible设置访问权限
	// invoke主动调用或者set修改值（变量）
	Class democlass = Class.forName("com.zj.wuaipojie.Demo",false,Ipparam.classLoader);
	Method demomethod = democlass.getDeclaredMethod("refl");
	demomethod.setAccessible(true);
	demomethod.invoke(clazz.newInstance());
	}
});

遍历所有类下的所有方法

XposedHelpers.findAndHookMethod(ClassLoader.class,"loadClass",String.class,ne XC_MethodHook(){
	@Override
	protected void afterHookerMethod(param);
	Class clazz = (Class)param.getResult();
	String clazzName = clazz.getName();
	//排除非包名的类
	if(clazzName.contains("com.zj.wuaipojie")){
		Method[] mds = clazz.getDeclaredMethods();
		for(int i =0;i<mds.length;i++){
			final Method md = mds[i];
			int mod = mds[i].getModifiers();
			//去除抽象，native，接口方法
			if(!Modifier.isAbstract(mod)&&!Modifier.isNative(mod)&&!Modifier.isAbstract(mod)){
			XposedBridge.hookMethod(mds[i],new XC_MethodHook(){
				@Override
				protected void beforeHookedMethod(MethodHookParam param) throws Throwable{
				super.beforeHookMethod(param);
				Log.d("zj2529",md.toString());
				}
			});
			}
		}
	}
});

妙用

字符串赋值定位

XposedHelpers.findAndHookMethod("android.widget.TextView", lpparam.classLoader, "setText", CharSequence.class, new XC_MethodHook() {    
    @Override    
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {    
        super.beforeHookedMethod(param);    
        Log.d("zj2595",param.args[0].toString());    
                if(param.args[0].equals("已过期")){    
                    printStackTrace();    
                }  
    }    
});  
private static void printStackTrace() {    
    Throwable ex = new Throwable();    
    StackTraceElement[] stackElements = ex.getStackTrace();    
    for (int i = 0; i < stackElements.length; i++) {    
        StackTraceElement element = stackElements[i];    
        Log.d("zj2595","at " + element.getClassName() + "." + element.getMethodName() + "(" + element.getFileName() + ":" + element.getLineNumber() + ")");    
    }    
}

点击事件监听

Class clazz = XposedHelpers.findClass("android.view.View", lpparam.classLoader);  
XposedBridge.hookAllMethods(clazz, "performClick", new XC_MethodHook() {    
    @Override    
    protected void afterHookedMethod(MethodHookParam param) throws Throwable {    
        super.afterHookedMethod(param);    
        Object listenerInfoObject = XposedHelpers.getObjectField(param.thisObject, "mListenerInfo");    
        Object mOnClickListenerObject = XposedHelpers.getObjectField(listenerInfoObject, "mOnClickListener");    
        String callbackType = mOnClickListenerObject.getClass().getName();    
        Log.d("zj2595",callbackType);    
    }    
});

SimpleHookR使用（快捷hook）

1.安装SimpleHookR后，在LSPosed中启动

2.在MT管理器中找到wuaipojie安装包并提取，找到前文中的a方法，可hook变量值以及返回值，点击导航按钮，长按a方法复制方法签名，

在SimpleHookR中首页点添加配置

保存好后运行app
在SimpleHookR的日志中可看到记录了参返