1.之前手機(jī)上要是想要使用Xposed 功能必須root,然后我們并不想root,或者麻煩，偶爾看到了下面的APP,毫不猶豫用上了xpost
2.詳細(xì)使用指南看官網(wǎng)把，簡單就是單獨(dú)開了個沙盒，不需要在root了
3.插件開發(fā)準(zhǔn)備
image.png
添加依賴
dependencies {
provided fileTree(include: ['*.jar'], dir: 'libs')
//noinspection GradleCompatible
compile 'com.android.support:appcompat-v7:24.2.1'
}
4.寫一個類實(shí)現(xiàn)與IXposedHookLoadPackage
public class Xp implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(LoadPackageParam loadPackageParam) throws Throwable {
Log.e("handleLoadPackage",loadPackageParam.packageName);
if ("你需要hook的包名".equals(loadPackageParam.packageName)){
XposedBridge.log("開始hook");
XposedHelpers.findAndHookMethod("你需要完全hook的類名", loadPackageParam.classLoader,"需要hook的方法名",“需要hook的方法的參數(shù)，沒有可以空出來”, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Class clazz = param.thisObject.getClass();
Field field = clazz.getDeclaredField("iv_headImage");
field.setAccessible(true);
Log.e("handleLoadPackage",field.getName());
((ImageView) field.get(param.thisObject)).setVisibility(View.GONE);
}
});
}
}
}
5. 在assets資源目錄下建立一個文件
image.png
上面的例子就是簡單實(shí)現(xiàn)hook界面的圖片隱藏。
跑完畢之后我們在xpost框架中間就可以看到我們開發(fā)的插件
image.png
以上就是開發(fā)一個插件的簡單步奏，開發(fā)插件主要是要看懂反編譯的apk，知道他大概的流程，從而找到具體的屬性，方法入手，從而改變成我們想要的結(jié)果。
6.如果有時候我們的應(yīng)用是多個dex使用上面的方法就可能失效，所以推薦使用下面的方法，一下就是我屏蔽某個應(yīng)用的歡迎界面的代碼
public class Xp implements IXposedHookLoadPackage {
private static final String FILTER_PKGNAME = "cn.com.open.mooc";
@Override
public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
Log.e("handleLoadPackage", loadPackageParam.packageName);
/* XposedHelpers.findAndHookConstructor("java.net.URL", loadPackageParam.classLoader, String.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
String url = (String) param.args[0];
param.args[0] = "http://www.baidu.com/";
Log.e("handleLoadPackage",url);
}
});*/
if(FILTER_PKGNAME.equals(loadPackageParam.packageName)){
//這里是為了解決app多dex進(jìn)行hook的問題，Xposed默認(rèn)是hook主dex
XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
ClassLoader cl = ((Context)param.args[0]).getClassLoader();
Class<?> aClass = cl.loadClass("com.imooc.component.imoocmain.splash.MCSplashActivity");
XposedHelpers.findAndHookMethod(aClass, "onCreate", Bundle.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage","beforeHookedMethod");
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage","afterHookedMethod");
Activity activity = (Activity) param.thisObject;
Intent intent = new Intent();
intent.setClassName(activity,"com.imooc.component.imoocmain.index.MCMainActivity");
activity.startActivity(intent);
super.afterHookedMethod(param);
}
});
}
});
}
/* XposedHelpers.findAndHookMethod("com.squareup.okhttp.HttpUrl",
loadPackageParam.classLoader, "openConnection", new XC_MethodHook() {
@SuppressLint("WrongConstant")
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
URL url = (URL) param.thisObject;
Log.e("handleLoadPackage", url.get);
*//* Activity activity = (Activity) param.thisObject;
Intent intent = new Intent();
intent.setClassName(activity, "com.imooc.component.imoocmain.index.MCMainActivity");
activity.startActivity(intent);
activity.finish();*//*
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage", "afterHookedMethod");
}
});*/
}
}
上面的思路就是hook主歡迎界面的onCreate方法,然后直接跳轉(zhuǎn)到首頁。
7 hook微信顯示Menu
package com.test.gradletask;
import android.app.Application;
import android.content.Context;
import android.util.Log;
import android.view.Menu;
import android.view.MenuItem;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
/**
* 項(xiàng)目名稱：GradleTask
* 類描述：
* 創(chuàng)建人：Administrator
* 創(chuàng)建時間：2018/3/12 10:46
* 修改人：Administrator
* 修改時間：2018/3/12 10:46
* 修改備注：
* 聯(lián)系方式：906514731@qq.com
*/
public class Man implements IXposedHookLoadPackage {
private static final String FILTER_PKGNAME = "com.tencent.mm";
@Override
public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
Log.e("handleLoadPackage", loadPackageParam.packageName);
if (FILTER_PKGNAME.equals(loadPackageParam.packageName)) {
//這里是為了解決app多dex進(jìn)行hook的問題，Xposed默認(rèn)是hook主dex
XposedHelpers
.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
final ClassLoader cl = ((Context) param.args[0]).getClassLoader();
final Class<?> aClass = cl
.loadClass("com.tencent.mm.ui.LauncherUI");
XposedHelpers
.findAndHookMethod(aClass, "onCreateOptionsMenu", Menu.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage", "beforeHookedMethod");
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage", "afterHookedMethod");
Menu menu=(Menu) param.args[0];
menu.add(0,3,0,"1b");
menu.add(0,4,0,"2b");
menu.add(0,5,0,"3b");
menu.add(0,6,0,"4b");
menu.add(0,7,0,"5b");
menu.add(0,8,0,"sb");
for(int i=0;i<menu.size();i++){
menu.getItem(i).setOnMenuItemClickListener(new MenuItem.OnMenuItemClickListener() {
@Override
public boolean onMenuItemClick(MenuItem item) {
XposedBridge.log("你點(diǎn)擊了");
Toast.makeText(((Context) param.thisObject),"點(diǎn)擊了",Toast.LENGTH_SHORT).show();
Log.e("handleLoadPackage","你點(diǎn)擊了");
return false;
}
});
}
super.afterHookedMethod(param);
}
});
}
});
}
}
}
image.png
7.xposed如果我們調(diào)用的參數(shù)是反編譯APP類型，需要這樣處理
public class Man implements IXposedHookLoadPackage {
private static final String FILTER_PKGNAME = "com.shuofeng.dl.application";
@Override
public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
Log.e("handleLoadPackage", loadPackageParam.packageName);
if (FILTER_PKGNAME.equals(loadPackageParam.packageName)) {
//這里是為了解決app多dex進(jìn)行hook的問題，Xposed默認(rèn)是hook主dex
XposedHelpers
.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
ClassLoader cl = ((Context) param.args[0]).getClassLoader();
Class<?> aClass = cl.loadClass("com.shuofeng.dl.application.sf.GetUserStatu");
XposedHelpers
.findAndHookMethod(aClass, "autologin", cl.loadClass("com.shuofeng.dl.application.sf.callbackinterface"),new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
Log.e("handleLoadPackage","beforeHookedMethod");
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Log.e("handleLoadPackage", "afterHookedMethod");
}
});
}
});
}
}
}
中間參數(shù)類型，我們使用目標(biāo)APP的全類名就可以了
