背景

在上一篇文章介绍了Xposed的使用，但在反编译自己编写模块的过程中，发现对于一些常用用法方面资料还是比较缺乏，在使用的过程中还得不过google，因此在这里小结了一下这个框架常用的一些方法。

查找操作

image.png

常用hook方法实现

public class CommonHookModule implements IXposedHookLoadPackage {

private String TAG = "Hook APP";
private Class clazz;
private static final String HOOK_APP_NAME = "com.example.hookdemo";


@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
    if (!loadPackageParam.packageName.equals(HOOK_APP_NAME))
        return;

    final Class<?> clazz = XposedHelpers.findClass("com.example.hookdemo.MainActivity", loadPackageParam.classLoader);

    XposedBridge.log(TAG + loadPackageParam.packageName);

    //修改静态变量staticInt的值为99
    XposedHelpers.setStaticIntField(clazz, "staticInt", 99);

    //hook构造函数
    XposedHelpers.findAndHookConstructor(clazz, new XC_MethodHook() {
        @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        }

        @Override
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        }
    });

    //Hook test方法, 修改参数
    XposedHelpers.findAndHookMethod(clazz, "test", String.class, new XC_MethodHook() {
        @Override
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
            param.args[0] = "被Hook了";
        }
    });


    //hook 匿名内部类TestClass的a方法，并替换参数，通过美元符号 $ 连接内部类
    XposedHelpers.findAndHookMethod("com.example.hookdemo.MainActivity$TestClass", clazz.getClassLoader(),
            "a", String.class, new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                }

                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    param.setResult("我被hook了");
                }
            });

    //hook 获取MainActivity的TextView控件，并修改器内容
    XposedHelpers.findAndHookMethod("com.example.hookdemo.MainActivity",
            loadPackageParam.classLoader,
            "onCreate",
            Bundle.class,
            new XC_MethodHook() {

                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    //获取到当前hook的类,这里是MainActivity
                    Class clazz = param.thisObject.getClass();
                    XposedBridge.log("class name:" + clazz.getName());
                    // 通过反射获取控件，无论parivate或者public
                    Field field = clazz.getDeclaredField("mTextView");
                    // 设置访问权限
                    field.setAccessible(true);
                    TextView textView = (TextView) field.get(param.thisObject);
                    String string = textView.getText().toString();
                    XposedBridge.log("原来的文案 " + string);
                    // 修改文案
                    textView.setText("我是被劫持修改啦");
                }
            }
    );

    //hook包org.apache.http 的所有网络请求
    final Class<?> clazz3 = XposedHelpers.findClass("org.apache.http.impl.client.AbstractHttpClient", loadPackageParam.classLoader);
    XposedBridge.hookAllMethods(clazz3, "execute", new XC_MethodHook() {

                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    print_args(param);
                }
            });

}

private void print_args(XC_MethodHook.MethodHookParam param) {
    Object arg = param.args[0];
    String argValue = "null";

    if(arg instanceof HttpPost){
        URI uri = ((HttpPost)arg).getURI();
        argValue = String.format("uri=%s ", uri.toString());
    }else if(arg instanceof HttpGet){
        URI uri = ((HttpGet)arg).getURI();
        argValue = uri.toString();
    }else if(arg instanceof HttpUriRequest){
        URI uri = ((HttpUriRequest)arg).getURI();
        argValue = uri.toString();
    } else {
        argValue = arg.toString();
    }
   Log.d(TAG, "args-->>" + argValue);
}

}