package com.example.myxposed;
import android.util.Log;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.Map;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
public class Hook implements IXposedHookLoadPackage{
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
Log.d("xiaojianbang", "hook...");
if (!loadPackageParam.packageName.equals("com.xingin.xhs")) return;
Log.d("xiaojianbang", "hooking...");
// Hook 静态变量
Class<?> clazz = XposedHelpers.findClass("com.xiaojianbang.xposeddemo.Demo", loadPackageParam.classLoader);
XposedHelpers.setStaticIntField(clazz, "staticInt", 10000);
XposedHelpers.setStaticObjectField(clazz,"Tag", "dajianbang");
// Hook 构造函数
XposedHelpers.findAndHookConstructor(clazz, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.d("xiaojianbang", "这个是调用无参构造方法前");
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.d("xiaojianbang", "这个是调用无参构造方法后");
}
});
XposedHelpers.findAndHookConstructor(clazz, String.class,new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.d("xiaojianbang", "这个是调用有参构造方法前");
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.d("xiaojianbang", "这个是调用有参构造方法后");
}
});
// Hook复杂参数
XposedHelpers.findAndHookMethod(clazz,"myTest", String.class, "java.lang.String","[[Ljava.lang.String", Map.class,Class.forName("java.util.ArrayList"),new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.d("xiaojianbang", "这个是调用有参构造方法前");
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.d("xiaojianbang", "这个是调用有参构造方法后");
}
});
// Hook自定义参数
// 1.Class.forName()
// 2."java.lang.String"
// 3."XposedHelpers.findClass"
// Class aniclass = loadPackageParam.classLoader.loadClass("com.xiaojianbang.xposeddemo.Animal");
// Class aniclass = XposedHelpers.findClass("com.xiaojianbang.xposeddemo.Animal", loadPackageParam.classLoader);
Class aniclass = Class.forName("com.xiaojianbang.xposeddemo.Animal", false, loadPackageParam.classLoader);
XposedHelpers.findAndHookMethod(clazz,"myTest", aniclass,new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.d("xiaojianbang", "这个是调用有参构造方法前");
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.d("xiaojianbang", "这个是调用有参构造方法后");
}
});
// Hook 替换函数
XposedHelpers.findAndHookMethod(clazz, "myTest", aniclass, new XC_MethodReplacement() {
@Override
protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
return null;
}
});
// Hook 内部类
XposedHelpers.findAndHookMethod(XposedHelpers.findClass("com.xiaojianbang.Demo$InnerClass", loadPackageParam.classLoader), "innerFunc",
String.class,
new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
int aa = XposedHelpers.getIntField(param.thisObject, "innerPublicInt");
Log.d("xiaojianbang", ""+aa);
}
});
// Hook 主动调用
XposedHelpers.findAndHookMethod(XposedHelpers.findClass("com.xiaojianbang.Demo$InnerClass", loadPackageParam.classLoader), "innerFunc",
String.class,
new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
// 主动调用必须要有实例化对象的时候才能调用
Log.d("xiaojianbang", "beforeHookedMethod");
XposedHelpers.callMethod(clazz.newInstance(), "ref1");
Log.d("xiaojianbang", "afterHookedMethod");
int aa = XposedHelpers.getIntField(param.thisObject, "innerPublicInt");
Log.d("xiaojianbang", ""+aa);
}
});
// Hook 打印函数调用栈
XposedHelpers.findAndHookMethod(XposedHelpers.findClass("com.xiaojianbang.Demo$InnerClass", loadPackageParam.classLoader), "innerFunc",
String.class,
new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
// 打印调用堆栈信息
Log.e("xiaojianbang", "Stack:", new Throwable("Stack dump"));
// 主动调用必须要有实例化对象的时候才能调用
Log.d("xiaojianbang", "beforeHookedMethod");
XposedHelpers.callMethod(clazz.newInstance(), "ref1");
Log.d("xiaojianbang", "afterHookedMethod");
int aa = XposedHelpers.getIntField(param.thisObject, "innerPublicInt");
Log.d("xiaojianbang", ""+aa);
}
});
// Hook 反射大法(获取方法)
XposedHelpers.findAndHookMethod(XposedHelpers.findClass("com.xiaojianbang.Demo$InnerClass", loadPackageParam.classLoader), "innerFunc",
String.class,
new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
//1、找到类
//2、找到字段或方法 设定访问权限
//3、修改字段或调用方法
//Class.forName("com.xiaojianbang.app", false, ClassLoader);
//Class.forName("com.xiaojianbang.app");
//类名.class
//对象.getClass()
//xp的findClass
//classloader的loadClass
Object o = clazz.newInstance();
Class democlazz = Class.forName("com.xiaojianbang.xposeddemo.Demo", false, loadPackageParam.classLoader);
// 获取属性
Field reflect = democlazz.getDeclaredField("reflect");
// reflect.getType();
// reflect.getName();
// reflect.getModifiers();
reflect.setAccessible(true);
String str = (String)reflect.get(o);
Log.d("xiaojianbang", "这是放射获取的字段: "+str);
// 通过放射设置字段的值
reflect.set(o, "fangshedafa");
str = (String)reflect.get(o);
Log.d("xiaojianbang", "这是放射设置后获取的字段: "+str);
/* // 可以获取公有或受保护的方法
democlazz.getMethod();
// 可以获取全部的方法，包括私有的
democlazz.getDeclaredMethod();
democlazz.getField();
democlazz.getDeclaredField();*/
Method ref1 = democlazz.getDeclaredMethod("ref1");
ref1.setAccessible(true);
//invoke来调用方法
ref1.invoke(o);
}
});
// 遍历所有方法和字段
Class aClazz = XposedHelpers.findClass("com.xiaojianbang.xposeddemo.Demo", loadPackageParam.classLoader);
Method[] md = aClazz.getDeclaredMethods();
for (int i = 0; i < md.length; i++) {
Log.d("xiaojianbang", md[i].toString());
}
Field[] fd = aClazz.getDeclaredFields();
for (int i = 0; i < fd.length; i++) {
Log.d("xiaojianbang", fd[i].toString());
}
// 遍历所有内部类
Class[] declaredClasses = aClazz.getDeclaredClasses();
for (int i = 0; i < declaredClasses.length; i++) {
Log.d("xiaojianbang", declaredClasses[i].toString());
Method[] mds = declaredClasses[i].getDeclaredMethods();
for (int j = 0; j < mds.length; j++) {
Log.d("xiaojianbang", mds[j].toString());
}
Field[] fds = declaredClasses[i].getDeclaredFields();
for (int j = 0; j < fds.length; j++) {
Log.d("xiaojianbang", fds[j].toString());
}
}
// 遍历所有的类
XposedHelpers.findAndHookMethod(ClassLoader.class,
"loadClass",
String.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Class result = (Class)param.getResult();
Log.d("xiaojianbang", "LoadClass: "+result.getName());
}
});
// 遍历所有类的所有方法
// XposedBridge.hookAllMethods();
// XposedBridge.hookAllConstructors();
// XposedBridge.hookMethod();
XposedHelpers.findAndHookMethod(ClassLoader.class,
"loadClass",
String.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Class result = (Class)param.getResult();
Log.d("xiaojianbang", "LoadClass: "+result.getName());
Method[] declaredMethods = result.getDeclaredMethods();
for (int i = 0; i < declaredMethods.length; i++) {
XposedBridge.hookMethod(declaredMethods[i], new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.d("dajianbang", "Hook Method: " + param.args.length);
}
});
}
// Method[] mds = result.getDeclaredMethods();
// for (int j = 0; j < mds.length; j++) {
// Log.d("xiaojianbang", mds[j].toString());
// }
//
// Field[] fds = result.getDeclaredFields();
// for (int j = 0; j < fds.length; j++) {
// Log.d("xiaojianbang", fds[j].toString());
// }
}
});
}
}
发表回复