Xposed HOOK项目

Xposed

Xposed思维导图下载

1、新建Android项目

2、新建lib文件夹，复制XposedBridgeApi-54.jar至lib文件夹,选中右键Build Path->add

3、src下新建包+java

JAVA逻辑

• 1、类继承IXposedHookLoadPackage

• 2、实现handleLoadPackage方法

  • 单DEX

    • if (lpparam.packageName.equals(“com.xx.##”)){

    • XposedHelpers.findAndHookMethod(

      • “com.xx.##.EE”,

      • lpparam.classLoader,

      • “a”,

      • String.class,

      • String.class,

      • new XC_MethodHook(){

        • @Override
          protected void beforeHookedMethod(MethodHookParam param)
          throws Throwable {
          // Hook函数之前执行的代码
          }

        • @Override
          protected void afterHookedMethod(MethodHookParam param)
          throws Throwable {
          // Hook函数之后执行的代码

            	param.setResult(true);	
            }
          

    • });
      }
      }
      }

    • 实例：

      • public class Module implements IXposedHookLoadPackage {

  @Override
  public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
  // 判断是否是要Hook的包名(被Hook函数所在的包为com.xx.##)
  if (lpparam.packageName.equals(“com.xx.##”)){
  //查找要Hook的函数
  XposedHelpers.findAndHookMethod(
  “com.xx.##.EE”, //被Hook函数所在的类com.xx.##.EE
  lpparam.classLoader,
  “a”, //被Hook函数的名称a
  String.class, //被Hook函数的第一个参数String
  String.class, //被Hook函数的第二个参数String
  new XC_MethodHook(){
  @Override
  protected void beforeHookedMethod(MethodHookParam param)
  throws Throwable {
  // Hook函数之前执行的代码
  }

    				@Override
    				protected void afterHookedMethod(MethodHookParam param)
    						throws Throwable {
    					// Hook函数之后执行的代码
    					
    					param.setResult(true);	
    				}
    			});
    }
  

  }
  }

  • 多DEX

    • public String package_name = "com.xx.##";
      

    • public String package_class="com.xx.##.k";
      

    • public String method_name="a";
      

    ---

    • if (!package_name.equals(lpp.packageName)) return;

    • XposedHelpers.findAndHookMethod(ClassLoader.class, “loadClass”, String.class, new XC_MethodHook() {
      @Override
      protected void afterHookedMethod(MethodHookParam param) throws Throwable {
      if (param.hasThrowable()) return;
      Class<?> cls = (Class<?>) param.getResult();
      String name = cls.getName();

    • XposedHelpers.findAndHookMethod(cls,method_name , String.class, new XC_MethodHook() {

      • @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        XposedBridge.log("-------Hooking-------"+method_name+"-------Hooking-------");
        XposedBridge.log(“HOOK前”);
        XposedBridge.log(param.method + " params: " + Arrays.toString(param.args));
        }
      • @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        XposedBridge.log("HOOK后);
        XposedBridge.log(param.method + " return: " + param.getResult());
        }

    • });
      }
      }
      });
      }

    • 实例：

      • public class HookLogin implements IXposedHookLoadPackage {

  public String package_name = “com.ss.android.ugc.aweme”;
  public String package_class=“com.ss.android.common.applog.k”;
  public String method_name=“a”;

  @Override
  public void handleLoadPackage(LoadPackageParam lpp) throws Throwable {

    //判断包名
    if (!package_name.equals(lpp.packageName)) return;
  
    // 第一步：Hook方法ClassLoader#loadClass(String)
    XposedHelpers.findAndHookMethod(ClassLoader.class, "loadClass", String.class, new XC_MethodHook() {
        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
            if (param.hasThrowable()) return;
            Class<?> cls = (Class<?>) param.getResult();
            String name = cls.getName();
            
            
            if (package_class.equals(name)) {
                // 所有的类都是通过loadClass方法加载的
                // 所以这里通过判断全限定类名，查找到目标类
                // 第二步：Hook目标方法
            	XposedHelpers.findAndHookMethod(cls,method_name , String.class, new XC_MethodHook() {
                	
                	
                	
                	
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    	XposedBridge.log("-------Hooking-------"+method_name+"-------Hooking-------");
                    	XposedBridge.log("HOOK前");
                        XposedBridge.log(param.method + " params: " + Arrays.toString(param.args));
                    }
  
                    
                    
                    
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    	XposedBridge.log("HOOK后);
                        XposedBridge.log(param.method + " return: " + param.getResult());
                    }
                    
                    
                    
                    
                    
                    
                    
                    
                });
            }
        }
    });
  

  }

4、assets文件夹下xposed_init：

com.xx.##

5、配置AndroidManifest.xml文件

<application

    android:allowBackup="true"
    android:icon="@drawable/ic_launcher"
    android:label="@string/app_name"
    android:theme="@style/AppTheme" >