本帖最后由 namename123 于 2025-3-31 16:49 编辑
《教我兄弟学Android逆向12 编写xposed模块》 - 吾爱破解 - 52pojie.cn
https://www.52pojie.cn/thread-1740944-1-1.html
看着这位佬和正己大佬的博客跟着学的
随便创建一个空项目
配置
进来等他配置一会,如果觉得慢,可以去.gralde/目录下设置镜像文件,网上有很多教程
下载上面博客的bridgeaPI
在这里点击到project 看得更方便
app目录下新建lib,复制我们的jar包进去
右键add as libray
然后
打开src/main目录下的AndroidManifest.xml 在application下进行编写,那xposed等工具识别这是个模块
[Asm] 纯文本查看 复制代码 <meta-data
android:name="xposedmodule"
android:value="true" />
<!-- 模块描述,显示在xposed模块列表那里第二行 -->
<meta-data
android:name="xposeddescription"
android:value="这是一个Xposed模块" />
<!-- 最低xposed版本号(lib文件名可知) -->
<meta-data
android:name="xposedminversion"
android:value="89" />
在app项目下的build.gradle进行修改
改为compileonly
6.新建-->Folder-->Assets Folder,创建xposed_init(不要后缀名):只有一行代码,就是说明入口类
7.新建Hook类,实现IXposedHookLoadPackage接口,然后在handleLoadPackage函数内编写Hook逻辑
按照正己大佬的来
导入包
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
public class Hook implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
}
}
然后在jadx中找到我们要hook的地方
复制为xposed片段
[Java] 纯文本查看 复制代码 package com.example.xposedhook;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
public class Hook implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
XposedHelpers.findAndHookMethod("com.ctf.backdoor.MainActivity", loadPackageParam.classLoader, "ooxx", "String", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
}
});
}
}
整理下来大约就是这样,大家上面几个包和参数需要大家自己改改
下面有两个方法
我们就可以开始编写xposed模块了
比如我这里,我要调用这个方法,自主传参然后输出
[Java] 纯文本查看 复制代码 public class Hook implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
if (!loadPackageParam.packageName.equals("com.ctf.backdoor")) {
return;
}
Log.d("xposed", "handleLoadPackage: ");
// 在类初始化后主动调用
XposedHelpers.findAndHookMethod("com.ctf.backdoor.MainActivity",
loadPackageParam.classLoader,
"ooxx",
String.class,
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
// 主动调用native方法
String result = (String) XposedHelpers.callStaticMethod(
param.method.getDeclaringClass(),
"ooxx",
"DWFmBkwae2inas+nZvG+Pg==" // 替换为实际要传入的字符串
);
Log.d("xposed", "主动调用结果: " + result);
XposedBridge.log("主动调用返回值: " + result);
}
});
}
}
在启动模块然后运行
去loagcat就ok了!
|