背景

在上一篇文章介紹了Xposed的使用，但在反編譯自己編寫模塊的過程中，發(fā)現(xiàn)對于一些常用用法方面資料還是比較缺乏，在使用的過程中還得不過google，因此在這里小結了一下這個框架常用的一些方法。

查找操作

image.png

常用hook方法實現(xiàn)

public class CommonHookModule implements IXposedHookLoadPackage {

private String TAG = "Hook APP";
private Class clazz;
private static final String HOOK_APP_NAME = "com.example.hookdemo";


@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
    if (!loadPackageParam.packageName.equals(HOOK_APP_NAME))
        return;

    final Class<?> clazz = XposedHelpers.findClass("com.example.hookdemo.MainActivity", loadPackageParam.classLoader);

    XposedBridge.log(TAG + loadPackageParam.packageName);

    //修改靜態(tài)變量staticInt的值為99
    XposedHelpers.setStaticIntField(clazz, "staticInt", 99);

    //hook構造函數(shù)
    XposedHelpers.findAndHookConstructor(clazz, new XC_MethodHook() {
        @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        }

        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        }
    });

    //Hook test方法, 修改參數(shù)
    XposedHelpers.findAndHookMethod(clazz, "test", String.class, new XC_MethodHook() {
        @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
            param.args[0] = "被Hook了";
        }
    });


    //hook 匿名內部類TestClass的a方法，并替換參數(shù)，通過美元符號 $ 連接內部類
    XposedHelpers.findAndHookMethod("com.example.hookdemo.MainActivity$TestClass", clazz.getClassLoader(),
            "a", String.class, new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                }

                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    param.setResult("我被hook了");
                }
            });

    //hook 獲取MainActivity的TextView控件，并修改器內容
    XposedHelpers.findAndHookMethod("com.example.hookdemo.MainActivity",
            loadPackageParam.classLoader,
            "onCreate",
            Bundle.class,
            new XC_MethodHook() {

                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    //獲取到當前hook的類,這里是MainActivity
                    Class clazz = param.thisObject.getClass();
                    XposedBridge.log("class name:" + clazz.getName());
                    // 通過反射獲取控件，無論parivate或者public
                    Field field = clazz.getDeclaredField("mTextView");
                    // 設置訪問權限
                    field.setAccessible(true);
                    TextView textView = (TextView) field.get(param.thisObject);
                    String string = textView.getText().toString();
                    XposedBridge.log("原來的文案 " + string);
                    // 修改文案
                    textView.setText("我是被劫持修改啦");
                }
            }
    );

    //hook包org.apache.http 的所有網絡請求
    final Class<?> clazz3 = XposedHelpers.findClass("org.apache.http.impl.client.AbstractHttpClient", loadPackageParam.classLoader);
    XposedBridge.hookAllMethods(clazz3, "execute", new XC_MethodHook() {

                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    print_args(param);
                }
            });

}

private void print_args(XC_MethodHook.MethodHookParam param) {
    Object arg = param.args[0];
    String argValue = "null";

    if(arg instanceof HttpPost){
        URI uri = ((HttpPost)arg).getURI();
        argValue = String.format("uri=%s ", uri.toString());
    }else if(arg instanceof HttpGet){
        URI uri = ((HttpGet)arg).getURI();
        argValue = uri.toString();
    }else if(arg instanceof HttpUriRequest){
        URI uri = ((HttpUriRequest)arg).getURI();
        argValue = uri.toString();
    } else {
        argValue = arg.toString();
    }
   Log.d(TAG, "args-->>" + argValue);
}

}