美文网首页Android开发复习studio
Android流氓代码块(亲测可行)

Android流氓代码块(亲测可行)

作者: 越长越圆 | 来源:发表于2016-09-29 19:58 被阅读2930次

    个人博客http://blog.csdn.net/qq_22329521/article/details/52704661
    开机自启动(小米需要在安全中心设置自启动)
    --

    //在广播中声明
      String action = intent.getAction();
          if (action.equals("android.intent.action.BOOT_COMPLETED")) {
                Intent activity = new Intent(context, SecondActivity.class);
                activity.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
                context.startActivity(activity);
         } 
      <receiver android:name=".xxx.xxx">
                <intent-filter>
                    <action android:name="android.intent.action.BOOT_COMPLETED"/>
                </intent-filter>
      </receiver>
      //权限
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
    

    静默安装(需要root)

    
        public static boolean installUseRoot(String filePath) {
            if (TextUtils.isEmpty(filePath))
                throw new IllegalArgumentException("Please check apk file path!");
            boolean result = false;
            Process process = null;
            OutputStream outputStream = null;
            BufferedReader errorStream = null;
            try {
                process = Runtime.getRuntime().exec("su");
                outputStream = process.getOutputStream();
                String command = "pm install -r " + filePath + "\n";
                outputStream.write(command.getBytes());
                outputStream.flush();
                outputStream.write("exit\n".getBytes());
                outputStream.flush();
                process.waitFor();
                errorStream = new BufferedReader(new InputStreamReader(process.getErrorStream()));
                StringBuilder msg = new StringBuilder();
                String line;
                while ((line = errorStream.readLine()) != null) {
                    msg.append(line);
                }
                Log.d(TAG, "install msg is " + msg);
                if (!msg.toString().contains("Failure")) {
                    result = true;
                }
            } catch (Exception e) {
                Log.e(TAG, e.getMessage(), e);
            } finally {
                try {
                    if (outputStream != null) {
                        outputStream.close();
                    }
                    if (errorStream != null) {
                        errorStream.close();
                    }
                } catch (IOException e) {
                    outputStream = null;
                    errorStream = null;
                    process.destroy();
                }
            }
            return result;
        }
    

    关机代码块(root)

        public static void closeOs(Context context) {
            try {
                Process proc = Runtime.getRuntime().exec(new String[]{"su", "-c", "reboot -p"});  //关机
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
    

    双守护线程保活

    public class DaemonService extends Service {
        String TAG = "DaemonService";
    
        private DaemonBinder mDaemonBinder;
    
        private DaemonServiceConnection mDaemonServiceConn;
    
        public DaemonService() {
        }
    
        @Override
        public void onCreate() {
            super.onCreate();
            mDaemonBinder = new DaemonBinder();
    
            if (mDaemonServiceConn == null) {
                mDaemonServiceConn = new DaemonServiceConnection();
            }
    
            Log.i(TAG, TAG + " onCreate");
        }
    
        @Override
        public int onStartCommand(Intent intent, int flags, int startId) {
            super.onStartCommand(intent, flags, startId);
            Log.i(TAG, TAG + " onStartCommand");
            bindService(new Intent(this, RemoteService.class), mDaemonServiceConn, Context.BIND_IMPORTANT);
    
            return START_STICKY;
        }
    
        @Nullable
        @Override
        public IBinder onBind(Intent intent) {
            return mDaemonBinder;
        }
    
        /**
         * 通过AIDL实现进程间通信
         */
        class DaemonBinder extends IProcessService.Stub {
            @Override
            public String getServiceName() throws RemoteException {
                return TAG;
            }
        }
    
        /**
         * 连接远程服务
         */
        class DaemonServiceConnection implements ServiceConnection {
    
            @Override
            public void onServiceConnected(ComponentName name, IBinder service) {
                try {
                    // 与远程服务通信
                    IProcessService process = IProcessService.Stub.asInterface(service);
                    Log.i(TAG, "连接" + process.getServiceName() + "服务成功");
                } catch (RemoteException e) {
                    e.printStackTrace();
                }
            }
    
            @Override
            public void onServiceDisconnected(ComponentName name) {
                // RemoteException连接过程出现的异常,才会回调,unbind不会回调
                startService(new Intent(DaemonService.this, RemoteService.class));
                bindService(new Intent(DaemonService.this, RemoteService.class), mDaemonServiceConn, Context.BIND_IMPORTANT);
            }
        }
    }
    
    
    
    public class RemoteService extends Service {
        String TAG = "RemoteService";
        private ServiceBinder mServiceBinder;
    
        private RemoteServiceConnection mRemoteServiceConn;
    
        @Override
        public void onCreate() {
            super.onCreate();
    
            mServiceBinder = new ServiceBinder();
    
            if (mRemoteServiceConn == null) {
                mRemoteServiceConn = new RemoteServiceConnection();
            }
    
            Log.i(TAG, TAG + " onCreate");
        }
    
        @Override
        public int onStartCommand(Intent intent, int flags, int startId) {
            super.onStartCommand(intent, flags, startId);
            Log.i(TAG, TAG + " onStartCommand");
    
            bindService(new Intent(this, DaemonService.class), mRemoteServiceConn, Context.BIND_IMPORTANT);
    
            return START_STICKY;
        }
    
        @Nullable
        @Override
        public IBinder onBind(Intent intent) {
            return mServiceBinder;
        }
    
        /**
         * 通过AIDL实现进程间通信
         */
        class ServiceBinder extends IProcessService.Stub {
            @Override
            public String getServiceName() throws RemoteException {
                return "RemoteService";
            }
        }
    
     
        /**
         * 连接远程服务
         */
        class RemoteServiceConnection implements ServiceConnection {
    
            @Override
            public void onServiceConnected(ComponentName name, IBinder service) {
                try {
    
                    IProcessService process = IProcessService.Stub.asInterface(service);
                    Log.i(TAG, "连接" + process.getServiceName() + "服务成功");
                } catch (RemoteException e) {
                    e.printStackTrace();
                }
            }
    
            @Override
            public void onServiceDisconnected(ComponentName name) {
                // RemoteException连接过程出现的异常,才会回调,unbind不会回调
    
                startService(new Intent(RemoteService.this, DaemonService.class));
    
                bindService(new Intent(RemoteService.this, DaemonService.class), mRemoteServiceConn, Context.BIND_IMPORTANT);
            }
        }
    }
    

    //aidl 文件

    package com.android.process.aidl;
    interface IProcessService {
        /**
         * Demonstrates some basic types that you can use as parameters
         * and return values in AIDL.
         */
        String getServiceName();
    }
    

    非Root的智能安装(可以)

    原文链接:http://blog.csdn.net/fuchaosz/article/details/51852442

    原理是用到了android提供的AccessibilityService服务,这个服务可以获取屏幕上的节点,一个节点也就是一个view,我们写的xml文件中每个标签就是一个节点,然后可以模拟用户的操作,对这些节点进行点击、滑动等操作。我们就是利用这个原理,来自动点击安装按钮的,当然使用这个服务必须用户手动开启无障碍服务。

    创建AccessibilityService配置文件 在res目录下创建xml目录,然后在xml目录下创建一个accessibility_service_config.xml文件,内容如下 res/xml/accessibility_service_config.xml:

    <accessibility-service xmlns:android="http://schemas.android.com/apk/res/android"
                           android:accessibilityEventTypes="typeAllMask"
                           android:accessibilityFeedbackType="feedbackGeneric"
                           android:accessibilityFlags="flagDefault"
                           android:canRetrieveWindowContent="true"
                           android:description="@string/desc"
                           android:packageNames="com.android.packageinstaller"
        />
    
    • accessibilityEventTypes:指定我们在监听窗口中可以模拟哪些事件,typeAllMask表示所有的事件都能模拟.
    • accessibilityFeedbackType:指定无障碍服务的反馈方式.
    • canRetrieveWindowContent:指定是否允许我们的程序读取窗口中的节点和内容,当然是true.
    • description: 当用户手动配置服务时,会显示给用户看.
    • packageNames: 指定我们要监听哪个应用程序下的窗口活动,这里写com.android.packageinstaller表示监听Android系统的安装界面。 其余参数照写即可。 res/strings.xml:

    创建AccessibilityService服务

    public class MyAccessibilityService extends AccessibilityService {
    
        private static final String TAG = "[TAG]";
        private Map<Integer, Boolean> handleMap = new HashMap<>();
    
        @Override
        public void onAccessibilityEvent(AccessibilityEvent event) {
            AccessibilityNodeInfo nodeInfo = event.getSource();
            if (nodeInfo != null) {
                int eventType = event.getEventType();
                if (eventType == AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED || eventType == AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED) {
                    if (handleMap.get(event.getWindowId()) == null) {
                        boolean handled = iterateNodesAndHandle(nodeInfo);
                        if (handled) {
                            handleMap.put(event.getWindowId(), true);
                        }
                    }
                }
    
            }
        }
    
        @Override
        public void onInterrupt() {
    
        }
    
        //遍历节点,模拟点击安装按钮
        private boolean iterateNodesAndHandle(AccessibilityNodeInfo nodeInfo) {
            if (nodeInfo != null) {
                int childCount = nodeInfo.getChildCount();
                if ("android.widget.Button".equals(nodeInfo.getClassName())) {
                    String nodeCotent = nodeInfo.getText().toString();
                    Log.d(TAG, "content is: " + nodeCotent);
                    if ("安装".equals(nodeCotent) || "完成".equals(nodeCotent) || "确定".equals(nodeCotent)) {
                        nodeInfo.performAction(AccessibilityNodeInfo.ACTION_CLICK);
                        return true;
                    }
                }
                //遇到ScrollView的时候模拟滑动一下
                else if ("android.widget.ScrollView".equals(nodeInfo.getClassName())) {
                    nodeInfo.performAction(AccessibilityNodeInfo.ACTION_SCROLL_FORWARD);
                }
                for (int i = 0; i < childCount; i++) {
                    AccessibilityNodeInfo childNodeInfo = nodeInfo.getChild(i);
                    if (iterateNodesAndHandle(childNodeInfo)) {
                        return true;
                    }
                }
            }
            return false;
        }
    }
    

    AndroidManifest中配置服务

     <service
                android:name=".MyAccessibilityService"
                android:label="智能安装App"
                android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE"
                >
                <intent-filter>
                    <action android:name="android.accessibilityservice.AccessibilityService"/>
                </intent-filter>
                <meta-data
                    android:name="android.accessibilityservice"
                    android:resource="@xml/accessibility_service_config"
                    />
            </service>
    

    重点是后面的service标签:

    • android:label:这个就是用户看到的无障碍服务的名称
    • android:permission: 需要用到BIND_ACCESSIBILITY_SERVICE这个权限.
    • action: android.accessibilityservice.AccessibilityService 有了这个action,用户才能在设置里面看到我们的服务,否则用户无法开启我们写的服务,也就不能进到我们写的MyAccessibilityService里面了.所以,注意不要写错了,如果你发现无障碍服务里面没有我们写的服务,请检查这里.

    调用智能安装代码

       private void smartInstall() {
            Uri uri = Uri.fromFile(new File("/mnt/sdcard/test.apk"));
            Intent localIntent = new Intent(Intent.ACTION_VIEW);
            localIntent.setDataAndType(uri, "application/vnd.android.package-archive");
            startActivity(localIntent);
        }
    

    手动配置智能安装服务

    //跳转到开启智能安装服务的界面
    Intent intent = new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS);
    startActivity(intent);
    

    相关文章

      网友评论

      • 老年追梦人:够流氓
      • XCG00:保活和开机自启一直是应用厂商和手机厂商博弈的环节,如果当然,貌似越来越避免不了引导用户加白和尝试root,5.0以上的版本root的几率已经非常小了……
      • c3d7d5cc8bde:可以的
      • 槐树向北:我现在都用这方法啊,不过总结的不错:+1:兄弟,棒棒哒
      • 310bc3180d43:厉害!
      • I喵先生:现在很多手机都有黑名单和白名单功能,不加入白名单,这根本没法执行
      • 25662b9064f7:够流氓,收藏了
      • 小鸽子su:这个程序的运行结果是什么啊。???。。🤔
      • 4ffd4a3a1365:怎么破解。。
        超级无敌杜小胖:@乔家三少 这个问题我喜欢,很强势
      • Cathy赤木与森:这个执行出是什么啊?你们都是直接看这个编程就能看懂吗
        36b1d63b7d75:@影子的白日梦 这是安卓的程序,用的是java
        Cathy赤木与森: @浦蒲 额,,那它执行出来的会是什么内容呀?我刚学c语言😁
        36b1d63b7d75: @影子的白日梦 看个思路,等实际需要用的时候慢慢扣下
      • ddb15933f32d:能再流氓点吗
      • d0b346ae5c1a:握草,真流氓,不过我喜欢

      本文标题:Android流氓代码块(亲测可行)

      本文链接:https://www.haomeiwen.com/subject/srklyttx.html