基于Eclipse Xposed模块开发

0x01 xposed hook原理

0x02 创建Android工程

0x03 引入Xposed-Framework-API

在Android项目中新建一个lib文件夹，将api-82-sources.jar、api-82.jar放入该文件夹中；右键api-xx.jar文件 api-XX.jar 选择Build Path -> Add to Build Path

API下载：https://jcenter.bintray.com/de/robv/android/xposed/api/

参考：https://github.com/rovo89/XposedBridge/wiki/Using-the-Xposed-Framework-API

0x04 修改AndroidManifest.xml

在Application标签中按如下添加3个meta-data标签，xposedminversion 根据上一步导入api版本号来写

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="de.robv.android.xposed.mods.tutorial"
    android:versionCode="1"
    android:versionName="1.0" >

    <uses-sdk android:minSdkVersion="15" />

    <application
        android:icon="@drawable/ic_launcher"
        android:label="@string/app_name" >
        <meta-data
            android:name="xposedmodule"
            android:value="true" />
        <meta-data
            android:name="xposeddescription"
            android:value="Easy example which makes the status bar clock red and adds a smiley" />
        <meta-data
            android:name="xposedminversion"
            android:value="53" />
    </application>
</manifest>

0x05 编写入口类

创建一个类，继承IXposedHookLoadPackage类，覆写handleLoadPackage方法，xposed的该方法在任何应用启动时都会被调用，故可以进入任何应用程序的进程，但是一般只针对某个特定的应用

package com.example.hooktest;

import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;
import android.graphics.Color;
import android.widget.TextView;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

public class Hook implements IXposedHookLoadPackage {
    public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
        if (!lpparam.packageName.equals("com.android.systemui"))
            return;
        XposedBridge.log("Loaded app: " + lpparam.packageName);
        
        findAndHookMethod("com.android.systemui.statusbar.policy.Clock", lpparam.classLoader, "updateClock", new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                // this will be called before the clock was updated by the original method
            }
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                TextView tv = (TextView) param.thisObject;
                String text = tv.getText().toString();
                tv.setText(text + " :)");
                tv.setTextColor(Color.RED);
            }
        });
    }
}

 XposedBridge.log根Log差不多，Log打印的语句会出现在控制台，而XposedBridge.log的打印会输出到xposed框架的启动程序的日志功能中，要调试的话就要到xposed的日志下查看log输出

也可以用 android.util.Log输出到logcat

0x06 指定模块入口

一个模块可以有多个继承IXposedHookLoadPackage的子类，所以要指定一个入口让xposed去执行（指定两个似乎也是可行的，未测试）。指定一个入口的步骤：
1、在assets目录下新建一个名为xposed_init的文件。
2、在xposed_init中写入某个IXposedHookLoadPackage子类的完整类名

 

参考文章：

xposed官方开发指南  https://github.com/rovo89/XposedBridge/wiki/Development-tutorial

基于xposed框架的demo   https://blog.csdn.net/zhangmiaoping23/article/details/53229565

xposed为所欲为  https://juejin.im/post/5ad9886df265da0b776f3dcb

xposed模块开发步骤总结  https://blog.csdn.net/csdn_lqr/article/details/52245132