8.1.4 Xposed Hook-下(第五十九课)
以下为图文内容：8.1.4 Xposed Hook-下
0x01 Hook替换函数与函数置空
在我们Hook的时候，常用的回调函数是XC_MethodHook()，用来获取或者修改我
们Hook的参数列表。除了这个回调函数外，还有一个XC_MethodReplacement()函数，
用来替换要Hook的函数或者将Hook的函数置空。实现代码如下：
package com.xposed;
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
public class Hook implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam lpparam) throws
Throwable {
if (lpparam.packageName.equals("com.feichen.xposeddemo")){
final Class<?> clazz =
XposedHelpers.findClass("com.feichen.xposeddemo.Demo",lpparam.classLoad
er);
XposedHelpers.findAndHookMethod(clazz,
"test",
new XC_MethodReplacement(){
@Override
protected Object replaceHookedMethod(MethodHookParam
param)
throws Throwable {
Log.d("====================",
"replaceHook");
return null;
}
});
}
}
}
日志输出效果图如下：
可以发现test()函数已经被我们成功的替换掉，同理当我们什么也不写只返回Null就相当
于将Hook的函数置空。
0x02 Hook内部类与匿名类
在Hook的时候，我们经常也会遇到一些内部类以及匿名内部类，我们还是以之前的
案例为例进行说明。
然后编写我们的Hook代码如下：
package com.xposed;
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
public class Hook implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam lpparam) throws
Throwable {
if (lpparam.packageName.equals("com.feichen.xposeddemo")){
final Class<?> clazz =
XposedHelpers.findClass("com.feichen.xposeddemo.Demo$InnerClass",lppara
m.classLoader);
XposedHelpers.findAndHookMethod(clazz,
"innerFunc",
String.class,
new XC_MethodReplacement(){
@Override
protected Object replaceHookedMethod(MethodHookParam
param)
throws Throwable {
Log.d("====================", "我是被替换
的内部类");
return null;
}
});
final Class<?> clazz1 =
XposedHelpers.findClass("com.feichen.xposeddemo.Demo$1",lpparam.classL
oader);
XposedHelpers.findAndHookMethod(clazz1,
"eatFunc",
String.class,
new XC_MethodReplacement(){
@Override
protected Object
replaceHookedMethod(MethodHookParam param)
throws Throwable {
Log.d("====================", " 我
是被替换的匿名内部类");
return null;
}
});
}
}
}
Hook日志如下：
我们通过编写的Hook代码可以发现，Hook内部类的字节码为：类路径$类名
Hook匿名内部类的字节码为：类路径$1 类路径$2 类路径$3
0x03 Xposed主动调用
在Hook的时候，我们有时候也是需要对app内部的函数进行主动调用，其中主动调
用的函数为XposedHelpers.callMethod(), 他的第一个参数为类的实例即
clazz.newInstance()，第二个参数是方法名，第三个参数是参数列表，对于没有参数的
函数可省略。那我还是以上个案例为例，找到其中的一个未被调用的函数refl（）
然后编写Hook代码如下：
package com.xposed;
import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
public class Hook implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam lpparam) throws
Throwable {
if (lpparam.packageName.equals("com.feichen.xposeddemo")){
final Class<?> clazz =
XposedHelpers.findClass("com.feichen.xposeddemo.Demo$InnerClass",lppara
m.classLoader);
XposedHelpers.findAndHookMethod(clazz,
"innerFunc",
String.class,
new XC_MethodReplacement(){
@Override
protected Object replaceHookedMethod(MethodHookParam
param)
throws Throwable {
Log.d("====================", "我是被替换
的内部类");
return null;
}
});
final Class<?> clazz1 =
XposedHelpers.findClass("com.feichen.xposeddemo.Demo$1",lpparam.classL
oader);
XposedHelpers.findAndHookMethod(clazz1,
"eatFunc",
String.class,
new XC_MethodReplacement(){
@Override
protected Object
replaceHookedMethod(MethodHookParam param)
throws Throwable {
Log.d("====================", " 我
是被替换的匿名内部类");
return null;
}
});
//主动调用
final Class<?> clazz2 =
XposedHelpers.findClass("com.feichen.xposeddemo.Demo",lpparam.classLoad
er);
XposedHelpers.callMethod(clazz2.newInstance(),"refl");
}
}
}
运行日志如下：
发现已经成功主动调用到该函数。
多谢分享 谢谢大佬分享 多谢大佬分享 [吾爱汇编论坛52HB.COM]-感谢楼主分享，支持一下！ 感谢分享！！！