Xposed学习

发表于 2023-09-08 本文字数 4.2k 字阅读时长 4 分钟

# Xposed

方法名复制为 xposed 的片段

# 1.Hook 普通方法

修改返回值

	XposedHelpers.findAndHookMethod("com.zj.wuaipojie.Demo", loadPackageParam.classLoader, "a", String.class, new XC_MethodHook() {
	@Override
	protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	super.afterHookedMethod(param);
	param.setResult(999);
	}
	});

修改参数

	XposedHelpers.findAndHookMethod("com.zj.wuaipojie.Demo", loadPackageParam.classLoader, "a", String.class, new XC_MethodHook() {
	@Override
	protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	super.beforeHookedMethod(param);
	String a = "pt";
	param.args[0] = a; }
	});

# 2.Hook 复杂 & 自定义参数

	Class a = loadPackageParam.classLoader.loadClass("类名");
	XposedBridge.hookAllMethods(a, "方法名", new XC_MethodHook() {
	@Override
	protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	super.beforeHookedMethod(param);

	}
	});// 可以免填参数

# 3.Hook 替换函数

	Class a = classLoader.loadClass("类名")
	XposedBridge.hookAllMethods(a,"方法名",new XC_MethodReplacement() {
	@Override
	protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
	return "";
	}
	});

# 4.Hook 加固通杀

	复制代码隐藏代码XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
	@Override
	protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	Context context = (Context) param.args[0];
	ClassLoader classLoader = context.getClassLoader();
	//hook 逻辑在这里面写
	}
	});

hook 加固应用第一步拿到 classloader

总的 Hook.java

	package com.sky.xposeddemo;

	import android.app.Application;
	import android.content.Context;
	import android.util.Log;

	import de.robv.android.xposed.IXposedHookLoadPackage;
	import de.robv.android.xposed.XC_MethodHook;
	import de.robv.android.xposed.XC_MethodReplacement;
	import de.robv.android.xposed.XposedBridge;
	import de.robv.android.xposed.XposedHelpers;
	import de.robv.android.xposed.callbacks.XC_LoadPackage;

	public class Hook implements IXposedHookLoadPackage {
	@Override
	public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
	if(!loadPackageParam.packageName.equals("com.zj.wuaipojie")){
	return;
	}
	/*XposedHelpers.findAndHookMethod ("com.zj.wuaipojie.Demo", loadPackageParam.classLoader, "a", String.class, new XC_MethodHook () {// 要根据实际传入参数的类型
	@Override
	protected void beforeHookedMethod (MethodHookParam param) throws Throwable {
	super.beforeHookedMethod (param);
	Log.d ("zj2595",param.args [0].toString ());
	XposedBridge.log (param.args [0].toString ());
	String a = "pt 嘿嘿嘿参数修改成功";
	param.args [0] = a;
	Log.d ("zj2595",param.args [0].toString ());
	}
	@Override
	protected void afterHookedMethod (MethodHookParam param) throws Throwable {
	super.afterHookedMethod (param);
	Log.d ("zj2595",param.getResult ().toString ());
	param.setResult ("返回值修改成功哇哈哈");
	}
	});*/
	/* Class a = loadPackageParam.classLoader.loadClass("com.zj.wuaipojie.Demo");
	XposedBridge.hookAllMethods(a, "complexParameterFunc", new XC_MethodHook() {
	@Override
	protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	super.beforeHookedMethod(param);
	Log.d("zj2595",param.args[0].toString());

	}
	});*/
	/*Class a = loadPackageParam.classLoader.loadClass ("com.zj.wuaipojie.Demo");
	XposedBridge.hookAllMethods (a,"repleaceFunc",new XC_MethodReplacement () {
	@Override
	protected Object replaceHookedMethod (MethodHookParam methodHookParam) throws Throwable {
	return "";// 可用于去弹窗
	}
	});*/
	XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
	@Override
	protected void afterHookedMethod(MethodHookParam param) throws Throwable {// 回调函数
	Context context = (Context) param.args[0];
	ClassLoader classLoader = context.getClassLoader();
	XposedHelpers.findAndHookMethod("com.zj.wuaipojie.Demo", loadPackageParam.classLoader, "a", String.class, new XC_MethodHook() {// 要根据实际传入参数的类型
	@Override
	protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	super.beforeHookedMethod(param);
	Log.d("zj2595",param.args[0].toString());
	XposedBridge.log(param.args[0].toString());
	String a = "pt嘿嘿嘿参数修改成功";
	param.args[0] = a;
	Log.d("zj2595",param.args[0].toString());
	}
	@Override
	protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	super.afterHookedMethod(param);
	Log.d("zj2595",param.getResult().toString());
	param.setResult("返回值修改成功哇哈哈");
	}
	});
	//hook 逻辑在这里面写
	}
	});



	}
	}

笔记