基于xposed实现android注册系统服务，解决跨进程共享数据问题

昨花了点时间，参考github issues 总算实现了基于xposed的系统服务注入，本文目的是为了“解决应用之间hook后数据共享，任意app ServiceManager.getService就可以直接调用aidl实现了进程通信”（比如aidl service实现socket,http server等，或者从某app获取数据传递给另外个app等场景，能做什么大家自己想吧，当然也可以实现非xposed版本的，需要通过直接smali方式。因为需快速实现，我就基于xposed的方案凑活用着用吧）

Xposed我就不介绍了，Xposed有2个重要接口，一个是针对应用级别hook：IXposedHookLoadPackage，另一个就是针对系统级别的：IXposedHookZygoteInit

这里将使用IXposedHookZygoteInit实现aidl添加到系统服务中，当然，通过IXposedHookLoadPackage也是可以实现的，但是因为我们注入的服务是希望像系统服务一样，开机启动，关机停止，另外IXposedHookZygoteInit本身就是定位在针对系统hook，所以还是建议使用IXposedHookZygoteInit。

直接进入正题：

1.创建 android.os.ICustomService.aidl

package android.os;

// Declare any non-default types here with import statements

interface ICustomService {
    String sayHello();
}

2.创建CustomService实现类

 1 public class CustomService extends ICustomService.Stub {
 2     private Context mContext;
 3     public CustomService(Context context) {
 4         mContext = context;
 5     }
 6 
 7     @Override
 8     public String sayHello() throws RemoteException {
 9         return "Just Hello World";
10     }
11 
12     //ActivityManagerService的systemReady在所有服务初始化完成后触发，这定义这个是为了实现自定义服务的初始化代码实现
13     public void systemReady() {
14         // Make your initialization here
15     }
16 }

3.创建ApplicationSocket，实现IXposedHookZygoteInit接口，这实现系统启动时候触发hook

1 public class ApplicationSocket implements IXposedHookZygoteInit{
2     public static String TAG = "ApplicationSocket";
3     @Override
4     public void initZygote(StartupParam startupParam) throws Throwable {
5         XposedBridge.hookAllMethods(ActivityThread.class, "systemMain", new SystemServiceHook());
6     }
7 }

4.创建SystemServiceHook 重写XC_MethodHook,实现注册服务，这也是最核心的类

  1 import android.content.Context;
  2 import android.os.Build;
  3 import android.os.CustomService;
  4 import android.os.ICustomService;
  5 import android.os.ServiceManager;
  6 
  7 import de.robv.android.xposed.XC_MethodHook;
  8 import de.robv.android.xposed.XposedBridge;
  9 import de.robv.android.xposed.XposedHelpers;
 10 
 11 /**
 12  * Created by bluce on 17/12/5.
 13  */
 14 
 15 public class SystemServiceHook extends XC_MethodHook {
 16     private static CustomService oInstance;
 17     private static boolean systemHooked;
 18 
 19     @Override
 20     protected void afterHookedMethod(MethodHookParam param) throws Throwable {
 21         if (systemHooked) {
 22             return;
 23         }
 24         final ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
 25         Class activityManagerServiceClazz = null;
 26         try {
 27             activityManagerServiceClazz = XposedHelpers.findClass("com.android.server.am.ActivityManagerService", classLoader);
 28         } catch (RuntimeException e) {
 29             // do nothing
 30         }
 31         if (!systemHooked && activityManagerServiceClazz!=null) {
 32             systemHooked = true;
 33             //系统服务启动完毕，通知自定义服务
 34             XposedBridge.hookAllMethods(
 35                     activityManagerServiceClazz,
 36                     "systemReady",
 37                     new XC_MethodHook() {
 38                         @Override
 39                         protected final void afterHookedMethod(final MethodHookParam param) {
 40                             oInstance.systemReady();
 41                             XposedBridge.log(">>>systemReady!!!!");
 42                         }
 43                     }
 44             );
 45             //注册自定义服务到系统服务中
 46             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
 47                 XposedBridge.hookAllConstructors(activityManagerServiceClazz, new XC_MethodHook() {
 48                     @Override
 49                     protected void afterHookedMethod(MethodHookParam param) throws Throwable {
 50                         Context context = (Context) XposedHelpers.getObjectField(param.thisObject, "mContext");
 51                         registerService(classLoader,context);
 52                     }
 53                 });
 54             }else{
 55                 XposedBridge.hookAllMethods(
 56                         activityManagerServiceClazz,
 57                         "main",
 58                         new XC_MethodHook() {
 59                             @Override
 60                             protected final void afterHookedMethod(final MethodHookParam param) {
 61                                 Context context = (Context) param.getResult();
 62                                 registerService(classLoader,context);
 63                             }
 64                         }
 65                 );
 66             }
 67         }
 68     }
 69     
 70     private static void registerService(final ClassLoader classLoader, Context context) {
 71         XposedBridge.log(">>>register service, Build.VERSION.SDK_INT"+Build.VERSION.SDK_INT);
 72         oInstance = new CustomService(context);
 73         Class<?> ServiceManager = XposedHelpers.findClass("android.os.ServiceManager",classLoader);
 74         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
 75             //避免java.lang.SecurityException错误,从5.0开始，selinux服务名称需要加前缀"user."
 76             XposedHelpers.callStaticMethod(
 77                     ServiceManager,
 78                     "addService",
 79                     "user.custom.service",
 80                     oInstance,
 81                     true
 82             );
 83         } else {
 84             XposedHelpers.callStaticMethod(
 85                     ServiceManager,
 86                     "addService",
 87                     "custom.service",
 88                     oInstance
 89             );
 90         }
 91     }
 92 
 93 
 94     //use service demo
 95     public static ICustomService mService;
 96     public static String someMethod(Context context) {
 97         try {
 98             if (mService == null) {
 99                 mService=ICustomService.Stub.asInterface(ServiceManager.getService("user.wx_custom.service"));
100                 //mService =(ICustomService)context.getSystemService("wx_custom.service");
101             }
102             return mService.sayHello();
103         } catch (Exception e) {
104             System.out.println(e.getMessage());
105             e.printStackTrace();
106         }
107         return  ">>> someMethod failed!!! ";
108     }
109 }

View Code

5.在当前应用activity中调用系统服务,service实现可以创建成单独的module,这样就实现不同项目直接使用，最重要的是在当前项目xposed hook代码中可以直接使用了，这也是本文的最初衷。

 button = (Button) findViewById(R.id.testButton);
        button.setOnClickListener(new View.OnClickListener(){
            @Override
            public  void  onClick(View v){
                if(true){
                    //testPattern();return;
                    //HookTest.registerReceiver(context);
                    String str = SystemServiceHook.someMethod(MainActivity.context);
                    if(str!=null){
                        System.out.println(">>>>:::"+str);
                    }
                    return;
                }
            }
    } ;

基于以上，CustomService整体的代码就实现了，重启系统就变成了系统服务，可以直接使用。但是以下2点需要特别注意：

1.com.android.server.am.ActivityManagerService是framework不公开的方法和类，所以项目需要导入AndroidHiddenAPI.jar这个包

2.android5.0之前SystemContext通过call ActivityManagerService的main方法就可以直接获取，但是5.0开始是通过createSystemContext方法生产，所以只能判断下版本，然后一个通过构造取获取，一个通过main返回结果获取

posted on 2017-12-05 16:00 bluce chen 阅读(3178) 评论(0) 编辑收藏举报

刷新页面返回顶部

C#交流俱乐部

公告