UmVfX1BvaW50's Blog
0%

Xposed

分类于
  • Xposed

原理

插件开发

1. Androidmanifest.xml

1
2
3
4
5
6
7
8
9
<meta-data
           android:name="xposedmodule"
           android:value="true" /><!--是不是Xposed模块-->
<meta-data
           android:name="xposeddescription"
           android:value="这是一个Xposed模块" /> <!--Xposed模块介绍-->
<meta-data
           android:name="xposedminversion"
           android:value="82" /> <!--最低的Xposed版本-->

2. app/build.gradle

1
2
3
4
dependencies {
	
    compileOnly("de.robv.android.xposed:api:82")
}

3. application settings.gradle

1
2
3
4
5
6
7
8
9
10
dependencyResolutionManagement {
    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
    repositories {

        //xposed api提示
        maven {
            url = uri("https://api.xposed.info/")
        }
    }
}

做好这一切以后sync，重新分析依赖

4. 指定入口类

在assets目录下创建xposed_init文件，内容为入口类的类名

com.xposed.test.Hook

5. 入口类框架

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
package com.xposed.test;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

public class Hook implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
        if ("com.target.app".equals(lpparam.packageName)) {
            XposedBridge.log("Target app loaded: " + lpparam.packageName);

            // Hook 示例
            XposedHelpers.findAndHookMethod(
                    "com.target.app.MainActivity", // 目标类名
                    lpparam.classLoader,
                    "targetMethod",               // 目标方法名
                    String.class,                 // 方法参数类型
                    new XC_MethodHook() {
                        @Override
                        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                            XposedBridge.log("Before method: " + param.method.getName());
                            param.args[0] = "Modified Argument"; // 修改方法参数
                        }

                        @Override
                        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                            XposedBridge.log("After method: " + param.method.getName());
                            Object result = param.getResult();
                            param.setResult("Modified Result"); // 修改返回值
                        }
                    }
            );
        }
    }
}

目录结构

xposed1

效果

xposed2

功能模块

  • 千万不要指望这个直接就能用

CIP协议降级

1
2
3
4
5
6
7
8
XposedHelpers.findAndHookMethod("xxxx", GlobalCache.gClassLoader, "g", new XC_MethodHook() {
    @Override
    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        super.afterHookedMethod(param);
        Log.d("XP-DP", "xxxx -> " + param.getResult());
        param.setResult(3);
    }
});

QUIC协议降级

1
2
3
4
5
6
7
XposedHelpers.findAndHookMethod("org.chromium.CronetClient", lpparam.classLoader, "tryCreateCronetEngine", Context.class, boolean.class, boolean.class, boolean.class, boolean.class, String.class, Executor.class, boolean.class, new XC_MethodHook() {
    @Override
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        Util.xposedLog("CronetClient disable tryCreateCronetEngine");
        param.setResult(null);
    }
});

参考文章：