初探Xposed 插件开发

1.之前手机上要是想要使用Xposed 功能必须root,然后我们并不想root,或者麻烦，偶尔看到了下面的APP,毫不犹豫用上了xpost

http://vxposed.com/

2.详细使用指南看官网把，简单就是单独开了个沙盒，不需要在root了

3.插件开发准备

image.png

添加依赖

dependencies {
    provided fileTree(include: ['*.jar'], dir: 'libs')
    //noinspection GradleCompatible
    compile 'com.android.support:appcompat-v7:24.2.1'
}

4.写一个类实现与IXposedHookLoadPackage

public class Xp implements IXposedHookLoadPackage {

  @Override
  public void handleLoadPackage(LoadPackageParam loadPackageParam) throws Throwable {
    Log.e("handleLoadPackage",loadPackageParam.packageName);
    if ("你需要hook的包名".equals(loadPackageParam.packageName)){
      XposedBridge.log("开始hook");
      XposedHelpers.findAndHookMethod("你需要完全hook的类名", loadPackageParam.classLoader,"需要hook的方法名",“需要hook的方法的参数，没有可以空出来”, new XC_MethodHook() {
        @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
          super.beforeHookedMethod(param);

        }

        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
          Class clazz = param.thisObject.getClass();
          Field field = clazz.getDeclaredField("iv_headImage");
          field.setAccessible(true);
          Log.e("handleLoadPackage",field.getName());
          ((ImageView) field.get(param.thisObject)).setVisibility(View.GONE);
        }
      });
    }
  }
}

5. 在assets资源目录下建立一个文件

image.png

上面的例子就是简单实现hook界面的图片隐藏。

跑完毕之后我们在xpost框架中间就可以看到我们开发的插件

image.png

以上就是开发一个插件的简单步奏，开发插件主要是要看懂反编译的apk，知道他大概的流程，从而找到具体的属性，方法入手，从而改变成我们想要的结果。

6.如果有时候我们的应用是多个dex使用上面的方法就可能失效，所以推荐使用下面的方法，一下就是我屏蔽某个应用的欢迎界面的代码

public class Xp  implements IXposedHookLoadPackage {
  private static final String FILTER_PKGNAME = "cn.com.open.mooc";
  @Override
  public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
    Log.e("handleLoadPackage", loadPackageParam.packageName);

   /* XposedHelpers.findAndHookConstructor("java.net.URL", loadPackageParam.classLoader, String.class, new XC_MethodHook() {
      @Override
      protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        String url = (String) param.args[0];
        param.args[0] = "http://www.baidu.com/";
       Log.e("handleLoadPackage",url);
      }
    });*/



    if(FILTER_PKGNAME.equals(loadPackageParam.packageName)){
      //这里是为了解决app多dex进行hook的问题，Xposed默认是hook主dex
      XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
          ClassLoader cl = ((Context)param.args[0]).getClassLoader();
          Class<?> aClass = cl.loadClass("com.imooc.component.imoocmain.splash.MCSplashActivity");
          XposedHelpers.findAndHookMethod(aClass, "onCreate", Bundle.class, new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
              Log.e("handleLoadPackage","beforeHookedMethod");

              super.beforeHookedMethod(param);
            }

            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
              Log.e("handleLoadPackage","afterHookedMethod");
              Activity activity = (Activity) param.thisObject;
              Intent intent  = new Intent();
              intent.setClassName(activity,"com.imooc.component.imoocmain.index.MCMainActivity");
              activity.startActivity(intent);
              super.afterHookedMethod(param);
            }
          });
        }
      });
    }





   /* XposedHelpers.findAndHookMethod("com.squareup.okhttp.HttpUrl",
        loadPackageParam.classLoader, "openConnection", new XC_MethodHook() {
          @SuppressLint("WrongConstant")
          @Override
          protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
            super.beforeHookedMethod(param);
            URL url = (URL) param.thisObject;
            Log.e("handleLoadPackage", url.get);
          *//*  Activity activity = (Activity) param.thisObject;
            Intent intent = new Intent();
            intent.setClassName(activity, "com.imooc.component.imoocmain.index.MCMainActivity");
            activity.startActivity(intent);
            activity.finish();*//*
          }

          @Override
          protected void afterHookedMethod(MethodHookParam param) throws Throwable {
            Log.e("handleLoadPackage", "afterHookedMethod");

          }
        });*/
  }
}

上面的思路就是hook主欢迎界面的onCreate方法,然后直接跳转到首页。

7 hook微信显示Menu

package com.test.gradletask;

import android.app.Application;
import android.content.Context;
import android.util.Log;
import android.view.Menu;
import android.view.MenuItem;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

/**
 * 项目名称：GradleTask
 * 类描述：
 * 创建人：Administrator
 * 创建时间：2018/3/12 10:46
 * 修改人：Administrator
 * 修改时间：2018/3/12 10:46
 * 修改备注：
 * 联系方式：906514731@qq.com
 */
public class Man implements IXposedHookLoadPackage {

  private static final String FILTER_PKGNAME = "com.tencent.mm";

  @Override
  public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
    Log.e("handleLoadPackage", loadPackageParam.packageName);
    if (FILTER_PKGNAME.equals(loadPackageParam.packageName)) {
      //这里是为了解决app多dex进行hook的问题，Xposed默认是hook主dex
      XposedHelpers
          .findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
              final ClassLoader cl = ((Context) param.args[0]).getClassLoader();
              final Class<?> aClass = cl
                  .loadClass("com.tencent.mm.ui.LauncherUI");
              XposedHelpers
                  .findAndHookMethod(aClass, "onCreateOptionsMenu", Menu.class, new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                      Log.e("handleLoadPackage", "beforeHookedMethod");

                      super.beforeHookedMethod(param);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                      Log.e("handleLoadPackage", "afterHookedMethod");
                      Menu menu=(Menu) param.args[0];
                      menu.add(0,3,0,"1b");
                      menu.add(0,4,0,"2b");
                      menu.add(0,5,0,"3b");
                      menu.add(0,6,0,"4b");
                      menu.add(0,7,0,"5b");
                      menu.add(0,8,0,"sb");
                      for(int i=0;i<menu.size();i++){
                        menu.getItem(i).setOnMenuItemClickListener(new MenuItem.OnMenuItemClickListener() {
                          @Override
                          public boolean onMenuItemClick(MenuItem item) {
                            XposedBridge.log("你点击了");
          Toast.makeText(((Context) param.thisObject),"点击了",Toast.LENGTH_SHORT).show();
                            Log.e("handleLoadPackage","你点击了");
                            return false;
                          }
                        });
                      }
                      super.afterHookedMethod(param);
                    }
                  });

            }
          });


    }


  }
}

image.png

7.xposed如果我们调用的参数是反编译APP类型，需要这样处理

public class Man implements IXposedHookLoadPackage {

  private static final String FILTER_PKGNAME = "com.shuofeng.dl.application";

  @Override
  public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
    Log.e("handleLoadPackage", loadPackageParam.packageName);
    if (FILTER_PKGNAME.equals(loadPackageParam.packageName)) {
      //这里是为了解决app多dex进行hook的问题，Xposed默认是hook主dex
      XposedHelpers
          .findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
              ClassLoader cl = ((Context) param.args[0]).getClassLoader();
              Class<?> aClass = cl.loadClass("com.shuofeng.dl.application.sf.GetUserStatu");
              XposedHelpers
                  .findAndHookMethod(aClass, "autologin", cl.loadClass("com.shuofeng.dl.application.sf.callbackinterface"),new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                      super.beforeHookedMethod(param);
                      Log.e("handleLoadPackage","beforeHookedMethod");
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                      Log.e("handleLoadPackage", "afterHookedMethod");

                    }
                  });
            }
          });


    }
  }
}

中间参数类型，我们使用目标APP的全类名就可以了