Xposed 学习笔记

Xposed框架用法

1、配置AndroidManifest.xml

<meta-data
android:name="xposedmodule"
android:value="true" />
<meta-data
android:name="xposeddescription"
android:value="获取packageName" />
<meta-data
android:name="xposedminversion"
android:value="30" />

2、在assets目录下创建xposed_init文件声明入口类

3、gradle中引入编译时使用
provided 'de.robv.android.xposed:api:82'
provided 'de.robv.android.xposed:api:82:sources'

4.入口类实现IXposedHookLoadPackage接口即可。

5、使用方法：
XC_LoadPackage.LoadPackageParam

hook方法
XposedHelpers.findAndHookMethod
(1)、获取activity实例
Class<?> clazz=XposedHelpers.findClass(
"com.android.mms.data.WorkingMessage", lpparam.classLoader);
hook方法
findAndHookMethod("com.tencent.mm.ui.LauncherUI", loadPackageParam.classLoader, "onCreate", Bundle.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Activity activity = (Activity) param.thisObject;

//调用这个方法的类对象 param.thisObject;
//方法的返回值 param.getResult();
//方法的参数 param.args[]
}
});

对于hook没有参数的方法，就不需要参数，如onResume（）：

XposedHelpers.findAndHookMethod("com.rjb.mytest.MainActivity", loadPackageParam.classLoader, "onResume", new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {

}
});

（2）、获取field修改
field set get
1、需要Field field=clazz.getgetDeclaredField("xx");
2、需要类的实例化对象 object
3、field.set(object,value);

相关文档：http://api.xposed.info/reference/packages.html
http://www.tuicool.com/articles/aaaEfmu

获取Context
Context context = (Context) callMethod(callStaticMethod(findClass("android.app.ActivityThread", null), "currentActivityThread", new Object[0]), "getSystemContext", new Object[0]);

我的工具类

1、下载文件

private void downloadFile(String url,String path) {

try {
URLConnection connection = new URL(url).openConnection();
FileOutputStream outputStream = new FileOutputStream(path);
InputStream is = connection.getInputStream();
// 1K的数据缓冲
byte[] bs = new byte[1024];
// 读取到的数据长度
int len;
// 输出的文件流
while ((len = is.read(bs)) != -1) {
outputStream.write(bs, 0, bs.length);

}
outputStream.flush();
outputStream.close();
} catch (IOException e) {
e.printStackTrace();
}
}

2、通知栏

自定义布局要用到RemoteViews

3、反射

获取目前顶置的activity
adb shell dumpsys activity top

脱壳工具
ZjDroid
http://www.cnblogs.com/goodhacker/p/3961045.html?utm_source=tuicool&utm_medium=referral