Xposed HOOK項目

Xposed

Xposed思維導圖下載

1、新建Android項目

2、新建lib文件夾，複製XposedBridgeApi-54.jar至lib文件夾,選中右鍵Build Path->add

3、src下新建包+java

JAVA邏輯

• 1、類繼承IXposedHookLoadPackage

• 2、實現handleLoadPackage方法

  • 單DEX

    • if (lpparam.packageName.equals(“com.xx.##”)){

    • XposedHelpers.findAndHookMethod(

      • “com.xx.##.EE”,

      • lpparam.classLoader,

      • “a”,

      • String.class,

      • String.class,

      • new XC_MethodHook(){

        • @Override
          protected void beforeHookedMethod(MethodHookParam param)
          throws Throwable {
          // Hook函數之前執行的代碼
          }

        • @Override
          protected void afterHookedMethod(MethodHookParam param)
          throws Throwable {
          // Hook函數之後執行的代碼

            	param.setResult(true);	
            }
          

    • });
      }
      }
      }

    • 實例：

      • public class Module implements IXposedHookLoadPackage {

  @Override
  public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
  // 判斷是否是要Hook的包名(被Hook函數所在的包爲com.xx.##)
  if (lpparam.packageName.equals(“com.xx.##”)){
  //查找要Hook的函數
  XposedHelpers.findAndHookMethod(
  “com.xx.##.EE”, //被Hook函數所在的類com.xx.##.EE
  lpparam.classLoader,
  “a”, //被Hook函數的名稱a
  String.class, //被Hook函數的第一個參數String
  String.class, //被Hook函數的第二個參數String
  new XC_MethodHook(){
  @Override
  protected void beforeHookedMethod(MethodHookParam param)
  throws Throwable {
  // Hook函數之前執行的代碼
  }

    				@Override
    				protected void afterHookedMethod(MethodHookParam param)
    						throws Throwable {
    					// Hook函數之後執行的代碼
    					
    					param.setResult(true);	
    				}
    			});
    }
  

  }
  }

  • 多DEX

    • public String package_name = "com.xx.##";
      

    • public String package_class="com.xx.##.k";
      

    • public String method_name="a";
      

    ---

    • if (!package_name.equals(lpp.packageName)) return;

    • XposedHelpers.findAndHookMethod(ClassLoader.class, “loadClass”, String.class, new XC_MethodHook() {
      @Override
      protected void afterHookedMethod(MethodHookParam param) throws Throwable {
      if (param.hasThrowable()) return;
      Class<?> cls = (Class<?>) param.getResult();
      String name = cls.getName();

    • XposedHelpers.findAndHookMethod(cls,method_name , String.class, new XC_MethodHook() {

      • @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        XposedBridge.log("-------Hooking-------"+method_name+"-------Hooking-------");
        XposedBridge.log(“HOOK前”);
        XposedBridge.log(param.method + " params: " + Arrays.toString(param.args));
        }
      • @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        XposedBridge.log("HOOK後);
        XposedBridge.log(param.method + " return: " + param.getResult());
        }

    • });
      }
      }
      });
      }

    • 實例：

      • public class HookLogin implements IXposedHookLoadPackage {

  public String package_name = “com.ss.android.ugc.aweme”;
  public String package_class=“com.ss.android.common.applog.k”;
  public String method_name=“a”;

  @Override
  public void handleLoadPackage(LoadPackageParam lpp) throws Throwable {

    //判斷包名
    if (!package_name.equals(lpp.packageName)) return;
  
    // 第一步：Hook方法ClassLoader#loadClass(String)
    XposedHelpers.findAndHookMethod(ClassLoader.class, "loadClass", String.class, new XC_MethodHook() {
        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
            if (param.hasThrowable()) return;
            Class<?> cls = (Class<?>) param.getResult();
            String name = cls.getName();
            
            
            if (package_class.equals(name)) {
                // 所有的類都是通過loadClass方法加載的
                // 所以這裏通過判斷全限定類名，查找到目標類
                // 第二步：Hook目標方法
            	XposedHelpers.findAndHookMethod(cls,method_name , String.class, new XC_MethodHook() {
                	
                	
                	
                	
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    	XposedBridge.log("-------Hooking-------"+method_name+"-------Hooking-------");
                    	XposedBridge.log("HOOK前");
                        XposedBridge.log(param.method + " params: " + Arrays.toString(param.args));
                    }
  
                    
                    
                    
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    	XposedBridge.log("HOOK後);
                        XposedBridge.log(param.method + " return: " + param.getResult());
                    }
                    
                    
                    
                    
                    
                    
                    
                    
                });
            }
        }
    });
  

  }

4、assets文件夾下xposed_init：

com.xx.##

5、配置AndroidManifest.xml文件

<application

    android:allowBackup="true"
    android:icon="@drawable/ic_launcher"
    android:label="@string/app_name"
    android:theme="@style/AppTheme" >