|
|
注册登录后全站资源免费查看下载
您需要 登录 才可以下载或查看，没有账号？立即注册
×
转载自吾爱破/解精华帖正已手下的文章
一、课程目标
1.了解Xposed常用API
2.借助lspatch实现免root注入
3.SimpleHook快速钩 二、工具
1.教程演示（更新）
2.MT 管理器/NP管理器
3.算法助手
4.jadx-gui
5.simplehook
6.安卓工作室 三、课程内容
Xposed常用API1.钩子变量静态变量与实例变量： - 静态变量（static）：类被初始化，同步进行初始化
- 非静态变量：类被实例化（产生一个对象的时候），进行初始化
静态变量 复制代码 隐藏代码
final Class clazz = XposedHelpers.findClass("类名", classLoader); XposedHelpers.setStaticIntField(clazz, "变量名", 999);实例变量 复制代码 隐藏代码
final Class clazz = XposedHelpers.findClass("类名", classLoader); XposedBridge.hookAllConstructors(clazz, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { super.afterHookedMethod(param); //param.thisObject获取当前所属的对象 Object ob = param.thisObject; XposedHelpers.setIntField(ob,"变量名",9999); } });2.钩构造函数无参构造函数 复制代码 隐藏代码
XposedHelpers.findAndHookConstructor("com.zj.wuaipojie.Demo", classLoader, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { super.beforeHookedMethod(param); } @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { super.afterHookedMethod(param); }});有参构造函数 复制代码 隐藏代码
XposedHelpers.findAndHookConstructor("com.zj.wuaipojie.Demo", classLoader, String.class, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { super.beforeHookedMethod(param); } @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { super.afterHookedMethod(param); }});3.钩多晶硅 复制代码 隐藏代码
XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { ClassLoader cl= ((Context)param.args[0]).getClassLoader(); Class<?> hookclass=null; try { hookclass=cl.loadClass("类名"); }catch (Exception e){ Log.e("zj2595","未找到类",e); return; } XposedHelpers.findAndHookMethod(hookclass, "方法名", new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { } }); } });4.主动调用静态方法: 复制代码 隐藏代码
Class clazz = XposedHelpers.findClass("类名",lpparam.classLoader);XposedHelpers.callStaticMethod(clazz,"方法名",参数(非必须));实例方法: 复制代码 隐藏代码
Class clazz = XposedHelpers.findClass("类名",lpparam.classLoader);XposedHelpers.callMethod(clazz.newInstance(),"方法名",参数(非必须));5.Hook内部类内部类:类里还有一个类class 复制代码 隐藏代码
XposedHelpers.findAndHookMethod("com.zj.wuaipojie.Demo$InnerClass", lpparam.classLoader, "innerFunc",String.class, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { super.beforeHookedMethod(param); } });6.反射大法 复制代码 隐藏代码
Class clazz = XposedHelpers.findClass("com.zj.wuaipojie.Demo", lpparam.classLoader);XposedHelpers.findAndHookMethod("com.zj.wuaipojie.Demo$InnerClass", lpparam.classLoader, "innerFunc",String.class, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { super.beforeHookedMethod(param); //第一步找到类 //找到方法，如果是私有方法就要setAccessible设置访问权限 //invoke主动调用或者set修改值(变量) Class democlass = Class.forName("com.zj.wuaipojie.Demo",false,lpparam.classLoader); Method demomethod = democlass.getDeclaredMethod("refl"); demomethod.setAccessible(true); demomethod.invoke(clazz.newInstance()); } });7.遍历所有类下的所有方法 复制代码 隐藏代码
XposedHelpers.findAndHookMethod(ClassLoader.class, "loadClass", String.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { super.afterHookedMethod(param); Class clazz = (Class) param.getResult(); String clazzName = clazz.getName(); //排除非包名的类 if(clazzName.contains("com.zj.wuaipojie")){ Method[] mds = clazz.getDeclaredMethods(); for(int i =0;i<mds.length;i++){ final Method md = mds; int mod = mds.getModifiers(); //去除抽象、native、接口方法 if(!Modifier.isAbstract(mod) && !Modifier.isNative(mod) &&!Modifier.isAbstract(mod)){ XposedBridge.hookMethod(mds, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { super.beforeHookedMethod(param); Log.d("zj2595",md.toString()); } }); } } } } });8.Xposed妙用字符串赋值定位: 复制代码 隐藏代码
XposedHelpers.findAndHookMethod("android.widget.TextView", lpparam.classLoader, "setText", CharSequence.class, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { super.beforeHookedMethod(param); Log.d("zj2595",param.args[0].toString()); if(param.args[0].equals("已过期")){ printStackTrace(); } } });private static void printStackTrace() { Throwable ex = new Throwable(); StackTraceElement[] stackElements = ex.getStackTrace(); for (int i = 0; i < stackElements.length; i++) { StackTraceElement element = stackElements; Log.d("zj2595","at " + element.getClassName() + "." + element.getMethodName() + "(" + element.getFileName() + ":" + element.getLineNumber() + ")"); } }点击事件监听: 复制代码 隐藏代码
Class clazz = XposedHelpers.findClass("android.view.View", lpparam.classLoader);XposedBridge.hookAllMethods(clazz, "performClick", new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { super.afterHookedMethod(param); Object listenerInfoObject = XposedHelpers.getObjectField(param.thisObject, "mListenerInfo"); Object mOnClickListenerObject = XposedHelpers.getObjectField(listenerInfoObject, "mOnClickListener"); String callbackType = mOnClickListenerObject.getClass().getName(); Log.d("zj2595",callbackType); } });改写布局: 复制代码 隐藏代码
XposedHelpers.findAndHookMethod("com.zj.wuaipojie.ui.ChallengeSixth", lpparam.classLoader, "onCreate", Bundle.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { super.afterHookedMethod(param); View img = (View)XposedHelpers.callMethod(param.thisObject, "findViewById", 0x7f0800de); img.setVisibility(View.GONE); } });Xposed模块补丁
PS：最低支持安卓9
Xposed快速钩子
杰舒克
Xpsoed源码四、课后小作业
让我想想 五、答疑
提一嘴，我感觉肯定会有人问我的as怎么跟他的不一样，那是因为我用了一些插件。插件入口：左上角File->Settings->Plugins，在这里可以搜索并安装你想安装的插件，以下是我用的插件
 
六、视/频及课件地址
百度云 阿里云
哔 哩哔哩
PS：解压密码都是52pj，阿里云由于不能分享压缩包，所以下载exe文件，双击自解压
|
|
名望
星币
星辰
好评
发表于 2023-7-27 20:07:29
提升卡
变色卡