Android逆向｜Xposed Hook（下）

admin

140350
文章

117
评论

2022年5月3日00:55:32评论186 views字数 4200阅读14分0秒阅读模式

本篇是《Android逆向入门教程》的第八章第1.4节，具体课程详情可点击下方图片查看：

每一章节详细内容及实验材料可通过加入底部免费的【Android逆向成长计划】星球获得！

声明：所有实验含部分虚构，纯属技术练习，未对真实环境造成任何影响。也请勿将相关技术用于非法操作，否则责任自负。

0x01 Hook替换函数与函数置空

在我们Hook的时候，常用的回调函数是XC_MethodHook()，用来获取或者修改我们Hook的参数列表。除了这个回调函数外，还有一个XC_MethodReplacement()函数，用来替换要Hook的函数或者将Hook的函数置空。实现代码如下：

package com.xposed;

import android.util.Log;import de.robv.android.xposed.IXposedHookLoadPackage;import de.robv.android.xposed.XC_MethodReplacement;import de.robv.android.xposed.XposedHelpers;import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

public class Hook implements IXposedHookLoadPackage {public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {if (lpparam.packageName.equals("com.feichen.xposeddemo")){final Class<?> clazz = XposedHelpers.findClass("com.feichen.xposeddemo.Demo",lpparam.classLoader);XposedHelpers.findAndHookMethod(clazz,"test",new XC_MethodReplacement(){@Overrideprotected Object replaceHookedMethod(MethodHookParam param)throws Throwable {Log.d("====================", "replaceHook");return null;}});}}}

日志输出效果图如下：

Android逆向｜Xposed Hook（下）

可以发现test()函数已经被我们成功的替换掉，同理当我们什么也不写只返回Null就相当于将Hook的函数置空。

0x02 Hook内部类与匿名类

在Hook的时候，我们经常也会遇到一些内部类以及匿名内部类，我们还是以之前的案例为例进行说明。

Android逆向｜Xposed Hook（下）

然后编写我们的Hook代码如下：

package com.xposed;

import android.util.Log;import de.robv.android.xposed.IXposedHookLoadPackage;import de.robv.android.xposed.XC_MethodReplacement;import de.robv.android.xposed.XposedHelpers;import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

public class Hook implements IXposedHookLoadPackage {public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {if (lpparam.packageName.equals("com.feichen.xposeddemo")){final Class<?> clazz = XposedHelpers.findClass("com.feichen.xposeddemo.Demo$InnerClass",lpparam.classLoader);XposedHelpers.findAndHookMethod(clazz,"innerFunc",String.class,new XC_MethodReplacement(){@Overrideprotected Object replaceHookedMethod(MethodHookParam param)throws Throwable {Log.d("====================", "我是被替换的内部类");return null;}});final Class<?> clazz1 = XposedHelpers.findClass("com.feichen.xposeddemo.Demo$1",lpparam.classLoader);XposedHelpers.findAndHookMethod(clazz1,"eatFunc",String.class,new XC_MethodReplacement(){@Overrideprotected Object replaceHookedMethod(MethodHookParam param)throws Throwable {Log.d("====================", "我是被替换的匿名内部类");return null;}});}}}

Hook日志如下：

Android逆向｜Xposed Hook（下）

我们通过编写的Hook代码可以发现，Hook内部类的字节码为：类路径$类名

Hook匿名内部类的字节码为：类路径$1 类路径$2 类路径$3

0x03 Xposed主动调用

在Hook的时候，我们有时候也是需要对app内部的函数进行主动调用，其中主动调用的函数为XposedHelpers.callMethod(),他的第一个参数为类的实例即clazz.newInstance()，第二个参数是方法名，第三个参数是参数列表，对于没有参数的函数可省略。那我还是以上个案例为例，找到其中的一个未被调用的函数refl（）

Android逆向｜Xposed Hook（下）

然后编写Hook代码如下：

package com.xposed;

import android.util.Log;import de.robv.android.xposed.IXposedHookLoadPackage;import de.robv.android.xposed.XC_MethodReplacement;import de.robv.android.xposed.XposedHelpers;import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

public class Hook implements IXposedHookLoadPackage {public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {if (lpparam.packageName.equals("com.feichen.xposeddemo")){final Class<?> clazz = XposedHelpers.findClass("com.feichen.xposeddemo.Demo$InnerClass",lpparam.classLoader);XposedHelpers.findAndHookMethod(clazz,"innerFunc",String.class,new XC_MethodReplacement(){@Overrideprotected Object replaceHookedMethod(MethodHookParam param)throws Throwable {Log.d("====================", "我是被替换的内部类");return null;}});final Class<?> clazz1 = XposedHelpers.findClass("com.feichen.xposeddemo.Demo$1",lpparam.classLoader);XposedHelpers.findAndHookMethod(clazz1,"eatFunc",String.class,new XC_MethodReplacement(){@Overrideprotected Object replaceHookedMethod(MethodHookParam param)throws Throwable {Log.d("====================", "我是被替换的匿名内部类");return null;}});//主动调用final Class<?> clazz2 = XposedHelpers.findClass("com.feichen.xposeddemo.Demo",lpparam.classLoader);XposedHelpers.callMethod(clazz2.newInstance(),"refl");}}}