Android中免root的hook框架學習——whale（二）實戰hook java方法

文末附項目完整代碼下載地址

一、在android studio中創建一個新的項目

1. Hook Java, 把whale項目裏的java文件夾的代碼複製到自己的項目中。

2. 複製 built/Android 下所需的abi到自己項目的src/main/jniLibs下。

最終的目錄結構如下：

二、新建一個類Test，寫一個測試的方法get，用於下面的hook測試

package com.tianseyiwan008.whalehooktest;

public class Test {
    public static String get() {
        return "test";
    }
}

三、新建一個hook的類，用於寫hook的方法

package com.tianseyiwan008.whalehooktest.hook;

import com.lody.whale.xposed.XC_MethodHook;
import com.lody.whale.xposed.XposedBridge;
import com.lody.whale.xposed.XposedHelpers;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;

/**
 * @author tianseyiwan008
 * @create on 2019/07/27 10:23
 * 用whale實現hook java代碼
 */
public class Main  {
    //第一種方式採用反射機制hook
    private void hook_method(String className, ClassLoader classLoader, String methodName,
                             Object... parameterTypesAndCallback){
        try {
            XposedHelpers.findAndHookMethod(className, classLoader, methodName, parameterTypesAndCallback);
        } catch (Exception e) {
            XposedBridge.log(e);
        }
    }

    //第二種方式，採用查找類的方法方式hook
    private void hook_methods(String className, String methodName, XC_MethodHook xmh){
        try {
            Class<?> clazz = Class.forName(className);
            for (Method method : clazz.getDeclaredMethods())
                if (method.getName().equals(methodName)
                        && !Modifier.isAbstract(method.getModifiers())
                        && Modifier.isPublic(method.getModifiers())) {
                    XposedBridge.hookMethod(method, xmh);
                }
        } catch (Exception e) {
            XposedBridge.log(e);
        }
    }


    public void executeHook(){
        XposedBridge.log("start hook");
        hook_methods("com.tianseyiwan008.whalehooktest.Test", "get", new XC_MethodHook(){
            @Override
            protected void afterHookedMethod(XC_MethodHook.MethodHookParam param){
                XposedBridge.log("hooking...");
                Object obj = param.getResult();
                XposedBridge.log("hooked args:"+obj);
                param.setResult("hook test by first way");
            }
        });
    }

    public void executeHook2(ClassLoader classLoader){
        XposedBridge.log("start hook2");
        hook_method("com.tianseyiwan008.whalehooktest.Test", classLoader,"get", new XC_MethodHook(){
            @Override
            protected void afterHookedMethod(XC_MethodHook.MethodHookParam param){
                XposedBridge.log("hooking...");
                Object obj = param.getResult();
                XposedBridge.log("hooked args:"+obj);
                param.setResult("hook test by second way");
            }
        });
    }
}

四、將hook在程序啓動的時候執行，一般可以新建一個Application或者測試的時候在MainActivity的onCreate方法裏執行

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
//        new Main().executeHook();
        new Main().executeHook2(this.getClassLoader());
        Toast.makeText(this, Test.get(), Toast.LENGTH_LONG).show();
    }

五、hook成功

點擊下載完整項目：https://download.csdn.net/download/tianseyiwan008/11438440