Android-Hook

Hook_Android

Cydia HOOK

1. 新建工程

2. 在工程中找到 libs 文件夹，将 jar 包拷贝到文件夹中

1. 设置 jar 包为依赖(类似在 c++中导入一个 lib,写了一个 #param comment(lib,”user32”))

1. 在清单文件中指定权限和入口类

<?xml version="1.0" encoding="utf-8"?><manifest xmlns:android="http://schemas.android.com/apk/res/android"    package="com.bluelesson.cydia34">     <!-- 这句 -->    <uses-permission android:name="cydia.permission.SUBSTRATE"></uses-permission>?    <application        android:allowBackup="true"        android:icon="@mipmap/ic_launcher"        android:label="@string/app_name"        android:roundIcon="@mipmap/ic_launcher_round"        android:supportsRtl="true"        android:theme="@style/AppTheme">        <activity android:name=".MainActivity">            <intent-filter>                <action android:name="android.intent.action.MAIN" />?                <category android:name="android.intent.category.LAUNCHER" />            </intent-filter>        </activity>?        <!-- app的导出变量,指定插件的入口类 android:value 是类名 -->        <meta-data android:name="com.saurik.substrate.main"            android:value=".Main"></meta-data>??    </application>?</manifest>

1. 新建入口类，实现回调函数

package com.bluelesson.cydia34;?import android.content.res.Resources;?import com.saurik.substrate.MS;?import java.lang.reflect.Method;?public class Main {    // 指定回调函数    static void initialize() {        // hook代码        // hook系统的资源类，将获取颜色的函数hook，让其返回指定颜色        // hook信息        // 类名： android.content.res.Resources        // 函数原型：public int getColor(int id)        // hook或者写一些巧妙的代码时候，需要用到一个类中的方法        // 这个类就是Class,通过这个类的对象，可以获取对应类中的方法、字段等等信息        // 这个类的使用就是Java反射机制的应用,实际上就是运行时修改或访问类中信息?        // hook class        MS.hookClassLoad("android.content.res.Resources", new MS.ClassLoadHook() {            @Override            public void classLoaded(Class<?> aClass) {                // hook method                // 1.获取老的方法                Method method = null;                try {                    method = aClass.getDeclaredMethod("getColor", int.class);               } catch (NoSuchMethodException e) {                    e.printStackTrace();               }?                // 2. hook                final MS.MethodPointer old = new MS.MethodPointer();                MS.hookMethod(aClass, method, new MS.MethodHook() {                    @Override                    public Object invoked(Object o, Object... objects) throws Throwable {                        // 先调用老的方法，获取返回值                        int color = (int) old.invoke(o,objects);                        // 修改返回值，返回                        return color & ~0x0000ff00 | 0x00ff0000;                   }               }, old);           }       });   }}?

1. 编译完成，安装到手机中

1. 在手机中安装 hook 框架，插件才能有效

安装完之后，打开激活插件

如果重启不可以，可以关机之后再重启 最后的效果

Xposed hook

简述：

0.新建项目，文件所在路径不要有中文

1.选择Project-app文件夹添加一个文件夹lib，把xposed那个jar放到文件夹。注意是新建lib不是放到libs里面。

2.选择Project-app文件夹F4按一下，进入Project Stucture，选择app，选择依赖，按下添加，选择文件的路径jar结尾那个，Scope在新版本内要手打成compileOnly，因为没有这个选项。点ok。

3.清单文件添加那三行，在android里面会添加模块。并且成功的话，通知栏那里会跳出来。

4.src文件夹main文件夹添加一个新的assets文件夹。里面添加一个文件名字为xposed_init。里面写入口类的全名。注意是添加文件。

5.在入口类写代码

6.安装xposed框架apk，一直下一步，安装好，重启

7.点运行，弹出程序。状态栏会提示有模块。勾上。然后重启。正常就ok了。

1. 新建工程

2. 导入 jar 包

1. 在清单文件里设置信息

<?xml version="1.0" encoding="utf-8"?><manifest xmlns:android="http://schemas.android.com/apk/res/android"package="com.bluelesson.xposedhook"><application…><activity android:name=".MainActivity">…</activity>?<meta-data android:name="xposedmodule" android:value="true"></meta-data><meta-data android:name="xposeddescription" android:value="XX  神器"></meta-data><meta-data android:name="xposedminversion" android:value="54"></meta-data></application></manifest>

1. 指定入口类

xposed_init是个文件。

1. 在入口类中写代码

package com.example.myxposedhook;?import android.telephony.TelephonyManager;?import de.robv.android.xposed.IXposedHookLoadPackage;import de.robv.android.xposed.XC_MethodReplacement;import de.robv.android.xposed.XposedBridge;import de.robv.android.xposed.XposedHelpers;import de.robv.android.xposed.callbacks.XC_LoadPackage;// 添加一个IXposeddHookLoadPackage接口public class Main implements IXposedHookLoadPackage {    // 重写    @Override    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {        // hook程序的包名:com.bluelesson.testphoneinfo        // hook类名: android.telephony.TelephonyManager        // hook方法原型: public String getDeviceId()        XposedBridge.log("Main");        // hook 系统类的方法        // 刷单需要手机号接收短信验证码，注册时一般会获取手机硬件信息        // 改机就是模拟多台手机        // 根据包名判断在Android机上运行的程序是不是要hook的程序。        if(!loadPackageParam.packageName.equals("com.bluelesson.testphoneinfo")){            return;       }        // xposed日志函数,显示hook框架中的日志模块中        XposedBridge.log("hook com.bluelesson.testphoneinfo");        // hook系统类        XposedHelpers.findAndHookMethod(                TelephonyManager.class,      // 系统类可以指定类类型                "getDeviceId", // hook的方法名                new XC_MethodReplacement() { // 直接替换原有方法                    @Override                    protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {                        return "我就是序列号";                   }               });??   }}?

1. 写完代码，编译，安装

1. 在模拟器或是真机中安装 hook 框架

成功hook的效果

Xposed Hook 用户类

package com.example.myxposedhook;import de.robv.android.xposed.IXposedHookLoadPackage;import de.robv.android.xposed.XC_MethodHook;import de.robv.android.xposed.XposedBridge;import de.robv.android.xposed.XposedHelpers;import de.robv.android.xposed.callbacks.XC_LoadPackage;?public class Main implements IXposedHookLoadPackage {?    @Override    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {        // hook代码        // 三个信息        // hook程序的包名: com.bluelesson.crackme002        // hook类名:  com.bluelesson.crackme002.MainActivity        // hook方法原型: boolean CheckRegister(String src, String dest)        XposedBridge.log("Main");?        if(!loadPackageParam.packageName.equals("com.bluelesson.crackme002")){            return;       }        XposedBridge.log("hook com.bluelesson.crackme002");        // 获取类类型        Class cls=XposedHelpers.findClass("com.bluelesson.crackme002.MainActivity", loadPackageParam.classLoader);        //hook        // 根据名字找方法，传入方法的参数，添加一个接口        XposedHelpers.findAndHookMethod(cls, "CheckRegister", String.class, String.class, new XC_MethodHook() {            @Override                //接口实现hook前跟hook后的操作。            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                super.beforeHookedMethod(param);                // 打印参数                XposedBridge.log("参数1："+param.args[0]);                XposedBridge.log("参数2："+param.args[1]);                // 修改参数                param.args[0] = "hello";                param.args[1] = "hello123";           }?            @Override            protected void afterHookedMethod(MethodHookParam param) throws Throwable {                super.afterHookedMethod(param);                // 打印参数                XposedBridge.log("参数1：" + param.args[0]);                XposedBridge.log("参数2：" + param.args[1]);                // 修改返回值                param.setResult(true);           }       });   }}?

效果

Xposed HooK 构造函数

package com.example.myxposedhook;import de.robv.android.xposed.IXposedHookLoadPackage;import de.robv.android.xposed.XC_MethodHook;import de.robv.android.xposed.XposedBridge;import de.robv.android.xposed.XposedHelpers;import de.robv.android.xposed.callbacks.XC_LoadPackage;?public class Main implements IXposedHookLoadPackage {?    @Override    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {        // hook代码        // 三个信息        // hook程序的包名: com.bluelesson.ndk001        // hook类名:  com.bluelesson.ndk001.Person        // hook方法原型:  public Person(String str, int i)        XposedBridge.log("Main");?        if(!loadPackageParam.packageName.equals("com.bluelesson.ndk001")){            return;       }        XposedBridge.log("hook com.bluelesson.ndk001");        // 获取类类型        Class cls=XposedHelpers.findClass("com.bluelesson.ndk001.Person", loadPackageParam.classLoader);        // hook        // 根据类找构造函数，因为构造函数默认了，所以不用输入方法的名字，但是要传入参数类型。        XposedHelpers.findAndHookConstructor(cls, //类类型                String.class,//参数类型                int.class,                new XC_MethodHook() {// 回调            @Override            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                super.beforeHookedMethod(param);                // 打印参数                XposedBridge.log("参数1：" + param.args[0]);                XposedBridge.log("参数2：" + param.args[1]);                // 修改参数                param.args[0] = "hello";                param.args[1] = 123;           }?            @Override            protected void afterHookedMethod(MethodHookParam param) throws Throwable {                super.afterHookedMethod(param);                // 打印参数                XposedBridge.log("参数1：" + param.args[0]);                XposedBridge.log("参数2：" + param.args[1]);           }       });   }}?

效果

HOOK 匿名类方法

private void hook4(XC_LoadPackage.LoadPackageParam param) {        // hook代码        // 三个信息        // hook程序的包名: com.bluelesson.helloapp        // hook类名: com.bluelesson.helloapp.MainActivity$1        // hook方法原型: public void onClick(View view)        if(!param.packageName.equals("com.bluelesson.helloapp")){            return;       }        XposedBridge.log("hook com.bluelesson.helloapp");        // 获取类类型        Class clz = XposedHelpers.findClass("com.bluelesson.helloapp.MainActivity$1",param.classLoader);        //hook        XposedHelpers.findAndHookMethod(clz,                "onClick", View.class,                new XC_MethodHook() {                    @Override                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                        super.beforeHookedMethod(param);                        XposedBridge.log("hook onClick事件");?                   }               });   }

HOOK 匿名类方法的具体实现

    Context mObject = null;    private void hook5(XC_LoadPackage.LoadPackageParam param) {        // hook代码        // 三个信息        // hook程序的包名: com.bluelesson.helloapp        // hook类名: com.bluelesson.helloapp.MainActivity$1        // hook方法原型: public void onClick(View view)        if(!param.packageName.equals("com.bluelesson.helloapp")){            return;       }        XposedBridge.log("hook com.bluelesson.helloapp");        // 获取类类型        Class clz = XposedHelpers.findClass("com.bluelesson.helloapp.MainActivity$1",param.classLoader);        Class clz1 = XposedHelpers.findClass("com.bluelesson.helloapp.MainActivity",param.classLoader);        // hook        // 用找构造函数的方法获取到父类的this。        XposedHelpers.findAndHookConstructor(clz1,//类类型                new XC_MethodHook() { // 回调                    @Override                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                        super.beforeHookedMethod(param);                        // 保存this                        mObject = (Context) param.thisObject;                   }               }       );?        XposedHelpers.findAndHookMethod(clz, "onClick", View.class,                new XC_MethodReplacement() {                    @Override                    protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {//                       Toast.makeText(MainActivity.this, "测试", 0).show();                        if(mObject != null){                            Toast.makeText(mObject, "测试成功", Toast.LENGTH_SHORT).show();                       }                        return null;                   }               });   }

原文地址：https://www.cnblogs.com/ltyandy/p/11601188.html