xposed安装和使用入门

因为xposed已经停止更新,高版本的android可以使用他的改良版lsposed,开发环境和xposed一致, 首先需要安装magisk + zygisk + lsposed.

xposed开发环境#

导入xposed模块开发使用的jar包#

• 通过设置jcenter (未成功)
  设置app的build.gradle, 在dependencies里加上

dependencies {
    //低版本使用provided, 但是不能使用implementation
    compileOnly 'de.robv.android.xposed:api:82'
    compileOnly 'de.robv.android.xposed:api:82:sources'
}

在setting.gradle中添加（低版本的gradle是在build.gradle中添加）jcenter() 或者maven { url 'https://maven.aliyun.com/repository/public/' }

然后sync now后就会下载对应的xposed的jar包.

但是我在导入的时候遇见个问题, 就是无法导入和使用xpoesd jar包中的任何类. 具体原因还不清楚.

• 直接导入XposedBridgeApi-82.jar

还有一种办法就是直接下载对应的jar包并导入使用, 下载的jar包放入lib目录中, 右键jar包选择Add As Library.

这样android studio会自动在build.gradle中添加implementation files('libs\\XposedBridgeApi-82.jar') , 这会使apk在编译时将jar包一起打包。因为xposed已经包含了对应的jar包, 所以在加载此xposed apk模块时会出现重复导入jar包并出错: Cannot load module。需要将implementation换成compileOnly，意思是仅在编译时有效不进行打包。

AndroidManifest.xml添加必要信息#

//告诉xposed框架这是一个xposed模块
<meta-data
      android:name="xposedmodule"
      android:value="true" />
//给模块添加描述信息
<meta-data
      android:name="xposeddescription"
      android:value="这是一个xposed demo" />
//支持的最低的xposed版本
<meta-data
      android:name="xposedminversion"
      android:value="53" />

编写hook类#

添加一个java类，此类实现IXposedHookLoadPackage接口并编写handleLoadPackage函数。handleLoadPackage回调函数会在apk加载时由xposed的在XposedInit函数调用，这里简单实现了打印当前加载apk的包名。

build后安装到手机上就可以在lsposed中看到这个xposed模块。

对指定apk启动此模块

重启apk后发现此xposed模块已经成功加载，日志也已经成功打印。

xposed插件开发#

示例类为一个student类。

public class Student {
    String student_name;
    static int school_id = 0;
    public Student(){
        Log.i("reverccqin", "student_name :" + student_name + " ,school_id :" + school_id);
    }

    public Student(String name){
        student_name = name;
        Log.i("reverccqin", "student_name :" + student_name + " ,school_id :" + school_id);
    }

    public String SetSchoolIDAndGetName(int id){
        school_id = id;
        Log.i("revrccqin", "school_id :" + school_id);
        return student_name;
    }
}

hook构造函数#

通过findAndHookConstructor函数hook无参和有参的构造函数。

public class StudentHook implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        XposedHelpers.findAndHookConstructor(
                "com.reverccqin.demo.Student",
                loadPackageParam.classLoader,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        Log.i("reverccqin", "无参构造hook success!");
                    }
                }
        );

        XposedHelpers.findAndHookConstructor(
                "com.reverccqin.demo.Student",
                loadPackageParam.classLoader,
                String.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        Log.i("reverccqin", "有参构造hook success!");
                    }
                }
        );
    }
}

运行apk并查看日志发现已经hook成功。

修改属性#

通过hook对应类的构造函数来设置其静态属性和对象属性。当然对于静态属性而言甚至不需要通过任何类函数的hook就可以设置，对象属性也可以通过hook其他函数设置（并不一定非得是构造函数）。

public class Student {
    String student_name;
    static int school_id = 0;
    public Student(){
        Log.i("reverccqin", "student_name :" + student_name + " ,school_id :" + school_id);
    }

    public Student(String name){
        student_name = name;
        Log.i("reverccqin", "student_name :" + student_name + " ,school_id :" + school_id);
    }

    public String SetSchoolIDAndGetName(int id){
        school_id = id;
        Log.i("reverccqin", "school_id :" + school_id);
        return student_name;
    }
}

分别通过反射和xposed的接口设置静态属性和对象属性。

public class StudentHook implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        XposedHelpers.findAndHookConstructor(
                "com.reverccqin.demo.Student",
                loadPackageParam.classLoader,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        Log.i("reverccqin", "无参构造hook success!");

                        //通过反射设置static属性
                        Field school_id_Field = param.thisObject.getClass().getDeclaredField("school_id");
                        school_id_Field.setAccessible(true);
                        school_id_Field.setInt(null, 1);
                        //通过反射设置对象属性
                        Field student_name_Field = param.thisObject.getClass().getDeclaredField("student_name");
                        student_name_Field.setAccessible(true);
                        student_name_Field.set(param.thisObject, "li hua");
                    }
                }
        );

        XposedHelpers.findAndHookConstructor(
                "com.reverccqin.demo.Student",
                loadPackageParam.classLoader,
                String.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        Log.i("reverccqin", "有参构造hook success!");

                        //通过xposed接口设置static属性
                        XposedHelpers.setStaticObjectField(param.thisObject.getClass(), "school_id", 1);
                        //通过xposed接口设置对象属性
                        XposedHelpers.setObjectField(param.thisObject, "student_name", new String("xiao hong"));
                    }
                }
        );
    }
}

查看hook的日志发现反射和xposed接口调用都成功设置了属性，其实xposed接口本质也是通过反射设置的属性。

hook一般函数#

hook一般函数和hook构造函数类似只不过调用的是函数findAndHookMethod函数。前面都是通过类名进行hook，这里通过另一种方式使用类类型来hook，hook函数并修改其参数和返回值。

public class StudentHook implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {

        Class StudentClass = loadPackageParam.classLoader.loadClass("com.reverccqin.demo.Student");
        XposedHelpers.findAndHookMethod(
                StudentClass,
                "SetSchoolIDAndGetName",
                int.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        //修改参数
                        Object[] objectArray = param.args;
                        objectArray[0] = 8888;
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        super.afterHookedMethod(param);
                        //设置返回值
                        String student_name = "xxxx";
                        param.setResult(student_name);
                    }
                }
        );
    }
}

查看hook后的结果，函数的参数与返回值都已经被修改。

主动调用#

和通过反射和xposed的接口设置静态属性和对象属性一样，主动调用也可以通过反射或者xposed接口（xposed接口也是通过反射调用的）。这里分别hook构造函数并在构造函数中主动调用SetSchoolIDAndGetName设置school_id。

public class StudentHook implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        XposedHelpers.findAndHookConstructor(
                "com.reverccqin.demo.Student",
                loadPackageParam.classLoader,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        Log.i("reverccqin", "无参构造hook success!");

                         */
                        //反射调用函数
                        Method SetSchoolIDAndGetNameMethod = param.thisObject.getClass().getDeclaredMethod("SetSchoolIDAndGetName", int.class);
                        SetSchoolIDAndGetNameMethod.setAccessible(true);
                        SetSchoolIDAndGetNameMethod.invoke(param.thisObject, 1111);
                    }
                }
        );

        XposedHelpers.findAndHookConstructor(
                "com.reverccqin.demo.Student",
                loadPackageParam.classLoader,
                String.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        Log.i("reverccqin", "有参构造hook success!");

                        //通过xposed接口调用函数
                        XposedHelpers.callMethod(param.thisObject, "SetSchoolIDAndGetName", 2222);
                    }
                }
        );
    }
}

查看主动调用后SetSchoolIDAndGetName并设置school_id后打印的日志，发现主动调用设置school_id成功。】

加壳apk的hook#

因为xposed hook了handlebindapplication函数并在此函数调用之前去调用所有的hook类的handleLoadPackage函数，handlebindapplication函数会进行一些初始化并调用Application的attachBaseContext函数。通常情况下壳代码是在自己的Application.attachBaseContext函数中修正classloader为自定义的classloader并动态加载源程序的dex文件。所以xposed在handlebindapplication调用之前获取的classloader并作为参数传递给handleLoadPackage函数并不是有效的classloader，所以对于加壳的apk需要通过反射获取修正后的真正的classloader。hook操作时使用此ClassLoader即可，其他操作与为加壳apk一致。

//通过反射获取LoadedApk对象
Class ActivityThreadClass = Class.forName("android.app.ActivityThread");
Method currentActivityThreadMethod = ActivityThreadClass.getDeclaredMethod("currentActivityThread");
Object ActivityThreadObject = currentActivityThreadMethod.invoke(null);
Field mPackagesField = ActivityThreadClass.getDeclaredField("mPackages");
mPackagesField.setAccessible(true);
ArrayMap mPackages = (ArrayMap) mPackagesField.get(ActivityThreadObject);
WeakReference wr = (WeakReference) mPackages.get(this.getPackageName());
//通过反射获取LoadedApk对象的mClassLoader字段
Class LoadedApkClass = Class.forName("android.app.LoadedApk");
Field mClassLoaderField = LoadedApkClass.getDeclaredField("mClassLoader");
mClassLoaderField.setAccessible(true);
ClassLoader mClassLoader = mClassLoaderField.get(wr.get());

自定义classloader加载dex文件的hook#

自定义classloader的hook和加壳apk的hook的情况很相似，重点就是找到正确的classloader。apk通过自定义classloader加载apk的dex文件，这个时候需要获取到apk自定义的classloader后才能对此自定义的classloader加载的dex文件中的java类进行hook。方法就是对DexClassLoader，PathClassLoade和InMemoryDexClassLoader的构造函数并获取到返回的classloader。

xposed对so函数的hook#

xposed本身是一个java层的hook框架，因此使用xposed的接口只能实现对apk的java层代码的hook。要想进行native层（so文件）的hook需要结合其他hook 框架，例如android-inline-hook。apk一般通过System.LoadLibrary加载自己的so库，要想在so库中函数没有执行前就进行hook的话需要在利用xposed对System.LoadLibrary函数设置hook，并在此函数调用之后调用自己的回调函数并对native层的代码进行hook。

public class XposedHookTest implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        XposedBridge.log("load apk: " + loadPackageParam.packageName);
        XposedHelpers.findAndHookMethod(
                "java.lang.System",
                loadPackageParam.classLoader,
                "loadLibrary",
                String.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        //to native hook
                    }
                }
        );
    }
}

但是发现hook失败，显示被hook的apk调用System.Loadlibrary函数无法找到so文件。

java.lang.System.LoadLibrary的代码发现此函数会获取当前函数调用者的类然后作为参数传递给java.lang.Runtime.LoadLibrary0, java.lang.Runtime.LoadLibrary0会获取此调用者类的classloader并加载so文件。结合上一部的日志就发现一个问题，因为xposed hook了java.lang.System.LoadLibrary函数，所以在xposed调用了设置的before回调函数后会通过反射去调用被hook的java.lang.System.LoadLibrary，所以现在java.lang.Runtime.LoadLibrary0函数在获取调用者类的时候实际获取的是xposed的类，并近一步获取到xposed类的classloader去加载so文件。而xposed类是通过自定义的classloader加载的，所以此classloader的native路径并不包含目标apk的so文件路径，自然系统就无法找到需要加载的so文件。

所以不能对java.lang.System.LoadLibrary进行hook，应该对java.lang.Runtime.LoadLibrary0进行hook。这样系统在加载so文件时获取到的就是目标apk自己的classloader。

public class XposedHookTest implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        XposedBridge.log("load apk: " + loadPackageParam.packageName);
        XposedHelpers.findAndHookMethod(
                "java.lang.Runtime",
                loadPackageParam.classLoader,
                "loadLibrary0",
                Class.class,
                String.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        //to native hook
                    }
                }
        );
    }
}

xposed入门实例#

一个测试apk有root检测和调试状态检测，需要输入一个正确的flag。拖入jadx中查看发现其调用sg.vantagepoint.a.c类的a,b,c函数进行root检测，调用sg.vantagepoint.a.b类的a函数进行调试状态检测。如果检测异常会调用sg.vantagepoint.uncrackable1.MainActivity类的a函数结束进程。

可以通过xposed hook类sg.vantagepoint.a.c的a,b,c函数和sg.vantagepoint.a.b类的a函数并返回FALSE来绕过检测。

//hook公共函数 sg.vantagepoint.a.c.a
XposedHelpers.findAndHookMethod(
        "sg.vantagepoint.a.c",
        loadPackageParam.classLoader,
        "a",
        new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                XposedBridge.log("call method: sg.vantagepoint.a.c.a"); 
                super.afterHookedMethod(param);
                param.setResult(false);
            }
        }
);

也可以通过xposed hook类sg.vantagepoint.uncrackable1.MainActivity的a函数并进行替换，替换的函数什么也不错。

//hook私有函数 sg.vantagepoint.uncrackable1.MainActivity.a
XposedHelpers.findAndHookMethod(
        "sg.vantagepoint.uncrackable1.MainActivity",
        loadPackageParam.classLoader,
        "a",
        String.class,
        new XC_MethodReplacement() {
            @Override
            protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                return null;
            }
        }
);

apk调用verify函数，verify函数又会调用sg.vantagepoint.uncrackable1.a类的a函数验证flag是否正确。

sg.vantagepoint.uncrackable1.a.a调用sg.vantagepoint.a.a.a函数生成flag。

通过hook函数sg.vantagepoint.a.a.a并打印返回值即可得到flag。

//hook静态函数 sg.vantagepoint.a.a.a
XposedHelpers.findAndHookMethod(
        "sg.vantagepoint.a.a",
        loadPackageParam.classLoader,
        "a",
        byte[].class,
        byte[].class,
        new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                XposedBridge.log("call method：sg.vantagepoint.a.a.a");
                super.afterHookedMethod(param);
                byte[] result = (byte[])param.getResult();
                String flag = new String(result);
                XposedBridge.log("flag : " + flag);
            }
        }
);

安装此xposed模块并对目标apk启动，通过绕过root检测并打印flag。