Xposed API使用大全

Xposed常用HOOK方法

不讲废话

hook修改静态方法

XposedHelpers.setBooleanField("对象", "名称", false);
XposedHelpers.setIntField("对象", "名称", 1);
XposedHelpers.setObjectField("对象", "名称", "值");

hook 构造函数

// 找到类名方法
Class<?> clazz = XposedHelpers.findClass("xxx.xxx.类名", lpparam.classLoader);
XposedHelpers.findAndHookConstructor(clazz, new XC_MethodHook() {
   @Override
   protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
      super.beforeHookedMethod(param);
   }
});
XposedHelpers.findAndHookConstructor(clazz, String.class, new XC_MethodHook() {
   @Override
   protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
      super.beforeHookedMethod(param);
   }
});

hook 普通方法

// 找到类名方法
Class<?> clazz = XposedHelpers.findClass("xxx.xxx.类名", lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "方法名", new XC_MethodHook() {
    @Override
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        super.beforeHookedMethod(param);
    }

    @Override
    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        super.afterHookedMethod(param);
    }
});

hook 复杂函数

// 找到类名方法
Class<?> clazz = XposedHelpers.findClass("xxx.xxx.类名", lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "方法名",
        String[][].class,
        String.class,
        Map.class,
        ArrayList.class,
        new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
            }

            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
            }
        }
);

或者

// 找到类名方法
 
XposedHelpers.findAndHookMethod(clazz, "方法名",
        "[[Ljava.lang.String",
        "java.lang.String",
        Class.forName("java.utils.Map"),
        Class.forName("java.util.ArrayList"),
        new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
            }

            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
            }
        }
);

hook 自定义类参数

获取类的方式

1. 类名.class
2. 对象.getClass()
3. class.forName()
4. xposedHelpers.findClass(“”,””)
5. new DexClassLoader(“”,””,””,””).loadClass() .// 加载类 用于脱壳加固

// 类名.class  对象.getClass()  class.forName()  xposedHelpers.findClass("","")
Class<?> JiaZaiClazz = lpparam.classLoader.loadClass("xxxx.xxx.xxx.类名");
Class<?> clazz = XposedHelpers.findClass("xxx.xxx.类名", lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "方法名", 
        "[[Ljava.lang.String",
        "java.lang.String",
        JiaZaiClazz,// 加载的自定义类
        Class.forName("java.utils.Map"),
        Class.forName("java.util.ArrayList"),
        new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
            }
        }
);

或者用上面的前四种的方法。

简单示例

Class<?> JiaZaiClazz = Class.forName("xxxx.xxx.xxx.类名", // 路径类名
                                     false,// 是否初始化，一般都是false
                                     lpparam.classLoader// 这个意思是用哪个加载器加载这个类
                                    );

Class<?> JiaZaiClazz = XposedHelpers.findClass("xxxx.xxx.xxx.类名","lpparam.classLoader");

还有一种特殊的

"xxxx.xxx.xxx.类名" // 直接输入即可

hook 替换函数

即改掉整个函数，不在提前或者之后hook

Class<?> clazz = XposedHelpers.findClass("xxx.xxx.类名", lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz, "方法名", new XC_MethodReplacement() {
    @Override
    protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
        Log.d(TAG, "替换的函数输出");
        return null;
    }
});

hook内部类

XposedHelpers.findAndHookMethod(XposedHelpers.findClass("xxx.xxx.xxx.类名$内部类名", lpparam.classLoader),
                "内部类的方法名",
                String.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                    }
                }
        );

主动调用

final Class<?> clazz = XposedHelpers.findClass("xxx.xxx.类名", lpparam.classLoader);
XposedHelpers.findAndHookMethod(XposedHelpers.findClass("xxx.xxx.xxx.类名$内部类名", lpparam.classLoader),
        "内部类的方法名",
        String.class,
        new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                XposedHelpers.callMethod(clazz.newInstance(),"具体方法","值");
                super.beforeHookedMethod(param);
            }
        }
);

Java 反射大法