最近在借助Xposed写一个改机工具来测试公司的安全产品的有效性,发现DeviceInfoHw这个App获取到的分辨率,用网上已有的方法怎么都Hook不掉。
通过Jadx反编译发现,DeviceInfoHw创新性地调用了Display类的getSupportedModes方法。由于涉及到私有成员变量,我使用反射成功实现了Hook。
在谷歌和Github上搜了下,这应该是全网第一个研究出这个方法的:)
为大家总结出了工具函数如下:
public void hookResolution2(XC_LoadPackage.LoadPackageParam lpparam, int width, int height) {
// 反编译DeviceInfoHw后,发现的获取分辨率的新方法。需要用到反射
// 1. 目标函数:getSupportedModes()
if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M) {
XposedHelpers.findAndHookMethod(Display.class, "getSupportedModes", new XC_MethodHook(XCallback.PRIORITY_LOWEST) {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Display.Mode[] modes = (Display.Mode[]) param.getResult();
if (modes.length > 0) {
Display.Mode firstMode = modes[0];
Field mWidthField = Display.Mode.class.getDeclaredField("mWidth");
Field mHeightField = Display.Mode.class.getDeclaredField("mHeight");
mWidthField.setAccessible(true);
mHeightField.setAccessible(true);
mWidthField.set(firstMode, width);
mHeightField.set(firstMode, height);
modes[0] = firstMode;
}
param.setResult(modes);
}
});
}
// 2. 目标函数:getMetrics(DisplayMetrics outMetrics)
XposedHelpers.findAndHookMethod(Display.class, "getMetrics", DisplayMetrics.class, new XC_MethodHook(XCallback.PRIORITY_LOWEST) {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
DisplayMetrics metrics = (DisplayMetrics) param.args[0];
metrics.widthPixels = width;
metrics.heightPixels = height;
}
});
// 3. 目标函数:getRealMetrics(DisplayMetrics outMetrics)
XposedHelpers.findAndHookMethod(Display.class, "getRealMetrics", DisplayMetrics.class, new XC_MethodHook(XCallback.PRIORITY_LOWEST) {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
DisplayMetrics metrics = (DisplayMetrics) param.args[0];
metrics.widthPixels = width;
metrics.heightPixels = height;
}
});
// 4. 目标函数:getSize(Point outSize)
XposedHelpers.findAndHookMethod(Display.class, "getSize", Point.class, new XC_MethodHook(XCallback.PRIORITY_LOWEST) {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Point mPoint = (Point) param.args[0];
mPoint.x = width;
mPoint.y = height;
}
});
// 5. 目标函数:getWidth()、getHeight()、
XposedHelpers.findAndHookMethod(Display.class, "getWidth", new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
param.setResult(width);
}
});
XposedHelpers.findAndHookMethod(Display.class, "getHeight", new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
param.setResult(height);
}
});
}
部分代码(2-5)参考自:https://github.com/Dovar66/FakerMobile/blob/master/app/src/main/java/com/dovar/fakermobile/fms/Resolution.java
网友评论