什么是Xposed

Xposed是一款可以在不修改APK的情况下影响程序运行的框架，基于它可以制作出许多功能强大的模块，且在功能不冲突的情况下同时运作。在这个框架下，我们可以编写并加载自己编写的插件APP，实现对目标apk的注入拦截等。

过滤包名

1
2
3
4
5
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        if(!loadPackageParam.packageName.equals("com.zj.wuaipojie")){
            return;
        }
      }

常用api

修改返回值

1
2
3
4
5
6
7
8
XposedHelpers.findAndHookMethod("包名.类名", loadPackageParam.classLoader, "方法名", String.class, new XC_MethodHook() {
    @Override
    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        super.afterHookedMethod(param);
        param.setResult(999);
    }
});

修改参数

1
2
3
4
5
6
7
XposedHelpers.findAndHookMethod("包名.类名", loadPackageParam.classLoader, "方法名", String.class, new XC_MethodHook() {
    @Override
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        super.beforeHookedMethod(param);
        String a = "pt";
        param.args[0] = a;    
    }

免填参数hook复杂函数

1
2
3
4
5
6
7
8
9
10
Class a = loadPackageParam.classLoader.loadClass("包名.类名");
        XposedBridge.hookAllMethods(a, "方法名", new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                Log.e("TAG",param.args[0].toString());
                ..........

            }
        });

hook有参构造函数

1
2
3
4
5
6
7
8
9
10
11
12
XposedHelpers.findAndHookConstructor("包名.类名",loadPackageParam.classLoader, String.class,new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                param.args[0]="xsf";

            }
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
            }
        });

hook无参构造函数

1
2
3
4
5
6
7
8
9
10
11
12
13
XposedHelpers.findAndHookConstructor("包名.类名", loadPackageParam.classLoader, new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                Log.e("TAG","before change unparam:");

            }
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
                Log.e("TAG","after change unparam");
            }
        });

hook替换无参构造函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
XposedBridge.hookAllConstructors(XposedHelpers.findClass("包名.类名", loadPackageParam.classLoader), new XC_MethodReplacement() {
                    @Override
                    protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
                        Log.e(TAG","无参构造函数替换成功");

                        // 手动创建一个对象（不会调用原构造函数）
                        Object obj = XposedHelpers.newInstance(XposedHelpers.findClass("com.zj.wuaipojie.Demo", loadPackageParam.classLoader));

                        // 可以在这里初始化自定义字段
                        XposedHelpers.setObjectField(obj, "id", "hooked_id");

                        // 返回对象
                        return obj;
                    }
                }
        );

主动调用

1
2
3
4
5
6
7
8
//静态方法
Class clazz = XposedHelpers.findClass("包名.类名",loadPackageParam.classLoader);
XposedHelpers.callStaticMethod(clazz,"方法名",参数(非必须));

//实例方法

Class clazz = XposedHelpers.findClass("包名.名",loadPackageParam.classLoader);
XposedHelpers.callMethod(clazz.newInstance(),"方法名");

hook内布类

1
2
3
4
5
6
7
8
9
10
XposedHelpers.findAndHookMethod("包名.类名", loadPackageParam.classLoader, "方法名", String.class, new XC_MethodReplacement()
        {

            @Override
            protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                Log.e("	TAG	","内部类函数替换成功");
                return null;
            }
        }
        );

加固通杀

1
2
3
4
5
6
7
8
XposedHelpers.findAndHookMethod(Application.class, "方法名", Context.class, new XC_MethodHook() {
           @Override
           protected void afterHookedMethod(MethodHookParam param) throws Throwable {
               Context context = (Context) param.args[0];
               ClassLoader classLoader = context.getClassLoader();
               //hook逻辑在这里面写
           }
       });