第一篇讲了如何创建一个Xposed插件并安装到手机激活他
第二篇讲了如何Hook自己的程序重写返回值

1.我不会分类

第一次写连续性的文章,我也不知道写的这些玩意怎么分,但是我会把每一种Hook的用法尽量写出来,方便以后观看

2.我就是写着玩

因为怕自己忘记了所以写的比较详细,如果我的帖子教会了一些人,希望不要用作非法的方面,仅供学习使用.

3.Hook 登录时的输入内容

我们创建应用的时候在\app\src\main\res\layout里会创建一个activity_main.xml
首先我们需要在activity_main.xml文件里增加二个编辑框外加一个登录按钮
这里的话我就不演示过程了

这属于基础知识,我就直接贴上activity_main.xml的代码

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto"
    xmlns:tools="http://schemas.android.com/tools"
    android:layout_width="match_parent"
    android:layout_height="match_parent"
    android:gravity="center"
    android:orientation="vertical"
    tools:context=".MainActivity">

    <EditText
        android:id="@+id/account"
        android:layout_width="match_parent"
        android:layout_height="wrap_content"
        android:hint="请输入账号" />

    <EditText
        android:id="@+id/password"
        android:layout_width="match_parent"
        android:layout_height="wrap_content"
        android:hint="请输入密码"
        android:inputType="textPassword" />

    <Button
        android:id="@+id/button"
        android:layout_width="match_parent"
        android:layout_height="wrap_content"
        android:onClick="Login"
        android:text="登录" />
</LinearLayout>

为了方便我这里直接在按钮属性里增加了onClick来执行Login函数
贴上界面图

然后在MainActivity.java里编写代码

注意:上一篇的代码我没有删除!!!

public void Login(View view) {
    EditText Account=findViewById(R.id.account);
    EditText Password=findViewById(R.id.password);
    if (isCorrectInformation(Account.getText().toString(),Password.getText().toString())) {
        Toast.makeText(this,"登录成功",Toast.LENGTH_LONG).show();
    } else {
        Toast.makeText(this,"密码错误",Toast.LENGTH_LONG).show();
    }
}
private boolean isCorrectInformation(String Account,String Password){
    if (Account == "hygzs" && Password == "12345") {
        return true;
    } else {
        return false;
    }
}

嗝~~~这边的话我为了方便就没有获取编辑框内容然后在赋值,而是直接传递的时候获取并.toString()

我在图片中用框框标注出来了
在这里插入图片描述
嗯这里犯了一个低级错误
习惯性的用了==""来判断是否一样
这里应该用.eqals()

然后在写文章拿图片的时候发现错了
这里没有改上文的原因是希望下次不要再犯
顺便贴上正确的代码

public void Login(View view) {
    EditText Account=findViewById(R.id.account);
    EditText Password=findViewById(R.id.password);
    if (isCorrectInformation(Account.getText().toString(),Password.getText().toString())) {
        Toast.makeText(this,"登录成功",Toast.LENGTH_LONG).show();
    } else {
        Toast.makeText(this,"账号或密码错误",Toast.LENGTH_LONG).show();
    }
}
private boolean isCorrectInformation(String Account,String Password){
    if (Account.equals("hygzs") && Password.equals("12345")) {
        return true;
    } else {
        return false;
    }
}

这里登录提示也改了,提示密码错误和代码逻辑不符，敲代码就应该严谨
在这里插入图片描述

Hook的目标我们已经搭建好了,接下来,我们开始写Hook的代码

这里的话为了保留上一篇的代码和为了这一篇代码写起来工整,所以改了一下判断
原来:

if (loadPackageParam.packageName.equals("com.hygzs.hook")){
}

现在:

if (!loadPackageParam.packageName.equals("com.hygzs.hook"))
    return;

这里说明是为了防止疑惑

思路

Login传递账号密码给了isCorrectInformation那么我们Hook他
获取传递的值

XposedHelpers.findAndHookMethod("com.hygzs.hook.MainActivity", loadPackageParam.classLoader, "isCorrectInformation", String.class, String.class, new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(XC_MethodHook.MethodHookParam param) throws Throwable {
                XposedBridge.log("账号 = " + (String) param.args[0]);
                XposedBridge.log("密码 = " + (String) param.args[1]);
                super.afterHookedMethod(param);
            }
        }
);

依旧在图片里添加了注解
在这里插入图片描述
这里用到的afterHookedMethod

/**
* Called before the invocation of the method.
*
*

You can use {@link MethodHookParam#setResult} and {@link MethodHookParam#setThrowable}
* to prevent the original method from being called.
*
*

Note that implementations shouldn’t call {@code super(param)}, it’s not necessary.
*
* @param param Information about the method call.
* @throws Throwable Everything the callback throws is caught and logged.
/
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {}
/*
* Called after the invocation of the method.
*
*

You can use {@link MethodHookParam#setResult} and {@link MethodHookParam#setThrowable}
* to modify the return value of the original method.
*
*

Note that implementations shouldn’t call {@code super(param)}, it’s not necessary.
*
* @param param Information about the method call.
* @throws Throwable Everything the callback throws is caught and logged.
/
protected void afterHookedMethod(MethodHookParam param) throws Throwable {}
/*
* Shortcut for replacing a method completely. Whatever is returned/thrown here is taken
* instead of the result of the original method (which will not be called).
*
*

Note that implementations shouldn’t call {@code super(param)}, it’s not necessary.
*
* @param param Information about the method call.
* @throws Throwable Anything that is thrown by the callback will be passed on to the original caller.
*/
@SuppressWarnings(“UnusedParameters”)
protected abstract Object replaceHookedMethod(MethodHookParam param) throws Throwable;