Xposed框架起手式

@hanq  2018年02月13日 10:54

简介

Xposed

简而言之Xposed框架是一款可以在不修改APK的情况下影响程序运行(修改系统)的框架服务,更多信息请君自行百度

准备工作

  • ROOT后的Android手机
  • 安装Xposed框架,并授权ROOT权限
  • 安装Android Studio的电脑

项目配置

  • 创建一个Android项目
  • build.gradle(Module:app)dependencies下添加依赖 provided 'de.robv.android.xposed:api:82'
  • AndroidManifest.xml <application>标记下增加元数据
    <meta-data
        android:name="xposedmodule"
        android:value="true"/>
    <meta-data
        android:name="xposeddescription"
        android:value="xposed test"/>
    <meta-data
        android:name="xposedminversion"
        android:value="82"/>

Xposed实现

  • XposedInit
    public class XposedInit implements IXposedHookLoadPackage {
        @Override
        public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam){
            //APP启动时调用此接口
            if (lpparam.packageName.equals("package_name")) {
                //判断包名为目标应用
            }
        }
    }
  • xposed_init

在assets文件夹下创建xposed_init文件并填写上面的XposedInit的信息package_name.to.XposedInit

  • XposedHelpers

HOOK目标APP某个类的方法,这里实现一个Activity.onCreate HOOK,改造如下:

    public class XposedInit implements IXposedHookLoadPackage {
        @Override
        public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
            if (lpparam.packageName.equals("package_name")) {
                XposedHelpers.findAndHookMethod("package_name.to.ActivityName", lpparam.classLoader, "onCreate", Bundle.class, new XC_MethodHook() {
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        //加载要HOOK的Activity
                        Class c = lpparam.classLoader.loadClass("package_name.to.ActivityName");
                        //获取指定名称的Activity对象
                        Field field = c.getDeclaredField("attribute");
                        field.setAccessible(true);
                        //将对象转为可操作类型
                        Object<?> targetObject = (Object<?>) field.get(param.thisObject);
                        targetObject.doSomething("param");
                    }
                });
            }
        }
    }

添加新评论