Xposed 开发

最新推荐文章于 2025-06-14 23:55:43 发布

idea studio

最新推荐文章于 2025-06-14 23:55:43 发布

阅读量908

点赞数

CC 4.0 BY-SA版权

文章标签： android

本文链接：https://blog.csdn.net/weixin_53620063/article/details/131952208

Xposed 开发

xposed jar下载地址
 Xposed 英文tutorial
Xposed Wiki

1.下载jar包

打开xposed jar下载地址下载jar包，导入工程libs
在 build.gradle 中加入 compileOnly files('libs\\api-82.jar')

2.编写代码

新建 class 实现 IXposedHookLoadPackage 接口

package com.cndlcd.testxposed;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

public class JulianXposed implements IXposedHookLoadPackage {

    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {

    }

}

3.配置

AndroidManifest.xml 中加入以下代码

        <meta-data
            android:name="xposedmodule"
            android:value="true" />
        <meta-data
            android:name="xposeddescription"
            android:value="Julian First Xposed Module" />
        <meta-data
            android:name="xposedminversion"
            android:value="53" />

新建 assets 目录，在 asset 中新建 xposed_init文件，并将 2 中创建的类名全程填入 com.cndlcd.testxposed.JulianXposed

4.运行-写代码-测试

5.案例

正己

Hook 普通方法

修改返回值


XposedHelpers.findAndHookMethod("com.cndlcd.myapplication", loadPackageParam.classLoader, "method", String.class, new XC_MethodHook() {
    @Override
    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        super.afterHookedMethod(param);
        param.setResult("result");
    }
});

修改参数


    XposedHelpers.findAndHookMethod("com.cndlcd.myapplication", loadPackageParam.classLoader, "method", String.class, new XC_MethodHook() {
        @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
            super.beforeHookedMethod(param);

            param.args[0] = "param1";
        }
    });
    });

Hook 复杂自定义参数


       Class a = loadPackageParam.classLoader.loadClass("com.cndlcd.myapplication.Class");
       XposedBridge.hookAllMethods(a, "method", new XC_MethodHook() {
           @Override
           protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
               super.beforeHookedMethod(param);

           }
       });

Hook 替换函数

  Class a = loadPackageParam.classLoader.loadClass("com.cndlcd.myapplication.Hook");
       XposedBridge.hookAllMethods(a, "method", new XC_MethodReplacement() {
           @Override
           protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
               return "";
           }
       });

Hook 变量

Hook 静态变量 public static String TAG = "Hook";


    Class clazz = XposedHelpers.findClass("com.cndlcd.myapplication.Hook", loadPackageParam.classLoader);
    XposedHelpers.setStaticObjectField(clazz, "TAG", "TAGTAG");

Hook 成员变量


    Class clazz = XposedHelpers.findClass("com.cndlcd.myapplication.Hook", loadPackageParam.classLoader);

    XposedBridge.hookAllConstructors(clazz, new XC_MethodHook() {
        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
            super.afterHookedMethod(param);
            Object thisObject = param.thisObject;  
            //param.thisObject 为当前对象
            XposedHelpers.setIntField(thisObject, "value", 10000);
        }
    });

Hook 构造函数

Hook 无参构造函数

        XposedHelpers.findAndHookConstructor("com.cndlcd.myapplication.Hook", loadPackageParam.classLoader, new XC_MethodHook() {
        @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
            super.beforeHookedMethod(param);
        }

        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
            super.afterHookedMethod(param);
        }
    });

Hook 有参构造函数


    XposedHelpers.findAndHookConstructor("com.cndlcd.myapplication.Hook", loadPackageParam.classLoader, String.class, new XC_MethodHook() {
        @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
            super.beforeHookedMethod(param);
        }

        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
            super.afterHookedMethod(param);
        }
    });

Hook multiDex 方法


        XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
                Context context = (Context) param.args[0];
                ClassLoader classLoader = context.getClassLoader();
                Class<?> aClass = null;
                try {
                    aClass = classLoader.loadClass("com.cndlcd.myapplication.Hook");
                } catch (ClassNotFoundException exception) {
                    //can't find class
                    return;
                }

                XposedHelpers.findAndHookMethod(aClass, "method", new XC_MethodHook() {
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        super.afterHookedMethod(param);
                    }
                });

            }
        });

Hook 内部类

        XposedHelpers.findAndHookMethod("com.cndlcd.myapplication.Hook$InnerHook", loadPackageParam.classLoader, "method", new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
                System.out.println("after hook inner method");
            }
        });

主动调用

静态调用


    Class clazz = XposedHelpers.findClass("com.cndlcd.myapplication.Hook", loadPackageParam.classLoader);
    XposedHelpers.findAndHookConstructor(clazz, new XC_MethodHook() {
        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
            super.afterHookedMethod(param);
            XposedHelpers.callMethod(param.thisObject, "method");
        }
    });

动态调用


    Class clazz = XposedHelpers.findClass("com.cndlcd.myapplication.Hook", loadPackageParam.classLoader);
    XposedHelpers.callStaticMethod(clazz, "method");

自己反射

Class clazz = XposedHelpers.findClass("com.zj.wuaipojie.Demo", lpparam.classLoader);
XposedHelpers.findAndHookMethod("com.zj.wuaipojie.Demo$InnerClass", lpparam.classLoader, "innerFunc",String.class,  new XC_MethodHook() {  
    @Override  
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {  
        super.beforeHookedMethod(param);  
        //第一步找到类
        //找到方法，如果是私有方法就要setAccessible设置访问权限
        //invoke主动调用或者set修改值(变量)
        Class democlass = Class.forName("com.zj.wuaipojie.Demo",false,lpparam.classLoader);  
        Method demomethod = democlass.getDeclaredMethod("refl");  
        demomethod.setAccessible(true);  
        demomethod.invoke(clazz.newInstance());  
    }  
});

遍历所有类下的所有方法

XposedHelpers.findAndHookMethod(ClassLoader.class, "loadClass", String.class, new XC_MethodHook() {  
    @Override  
    protected void afterHookedMethod(MethodHookParam param) throws Throwable {  
        super.afterHookedMethod(param);  
        Class clazz = (Class) param.getResult();  
        String clazzName = clazz.getName();  
        //排除非包名的类  
        if(clazzName.contains("com.zj.wuaipojie")){  
            Method[] mds = clazz.getDeclaredMethods();  
            for(int i =0;i<mds.length;i++){  
                final Method md = mds[i];  
                int mod = mds[i].getModifiers();  
                //去除抽象、native、接口方法  
                if(!Modifier.isAbstract(mod)  
                    && !Modifier.isNative(mod)  
                    &&!Modifier.isAbstract(mod)){  
                    XposedBridge.hookMethod(mds[i], new XC_MethodHook() {  
                        @Override  
                        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {  
                            super.beforeHookedMethod(param);  
                            Log.d("zj2595",md.toString());  
                        }  
                    });  
                }  

           }  
        }  

    }  
});

点击事件监听

XposedHelpers.findAndHookMethod("android.widget.TextView", lpparam.classLoader, "setText", CharSequence.class, new XC_MethodHook() {  
    @Override  
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {  
        super.beforeHookedMethod(param);  
        Log.d("zj2595",param.args[0].toString());  
                if(param.args[0].equals("已过期")){  
                    printStackTrace();  
                }
    }  
});
private static void printStackTrace() {  
    Throwable ex = new Throwable();  
    StackTraceElement[] stackElements = ex.getStackTrace();  
    for (int i = 0; i < stackElements.length; i++) {  
        StackTraceElement element = stackElements[i];  
        Log.d("zj2595","at " + element.getClassName() + "." + element.getMethodName() + "(" + element.getFileName() + ":" + element.getLineNumber() + ")");  
    }  
}