Android逆向｜Xposed Hook（下）

辞令

发布于 2022-05-17 10:53:06

3.5K0

发布于 2022-05-17 10:53:06

文章被收录于专栏：WhITECat安全团队WhITECat安全团队

本篇是《Android逆向入门教程》的第八章第1.4节，具体课程详情可点击下方图片查看：

声明：所有实验含部分虚构，纯属技术练习，未对真实环境造成任何影响。也请勿将相关技术用于非法操作，否则责任自负。

0x01 Hook替换函数与函数置空

在我们Hook的时候，常用的回调函数是XC_MethodHook()，用来获取或者修改我们Hook的参数列表。除了这个回调函数外，还有一个XC_MethodReplacement()函数，用来替换要Hook的函数或者将Hook的函数置空。实现代码如下：

package com.xposed;


import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;


public class Hook implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
if (lpparam.packageName.equals("com.feichen.xposeddemo")){
final Class<?> clazz = XposedHelpers.findClass("com.feichen.xposeddemo.Demo",lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz,
"test",
new XC_MethodReplacement(){
@Override
protected Object replaceHookedMethod(MethodHookParam param)
throws Throwable {
Log.d("====================", "replaceHook");
return null;
}
});
}
}
}

日志输出效果图如下：

可以发现test()函数已经被我们成功的替换掉，同理当我们什么也不写只返回Null就相当于将Hook的函数置空。

0x02 Hook内部类与匿名类

在Hook的时候，我们经常也会遇到一些内部类以及匿名内部类，我们还是以之前的案例为例进行说明。

然后编写我们的Hook代码如下：

package com.xposed;


import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;


public class Hook implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
if (lpparam.packageName.equals("com.feichen.xposeddemo")){
final Class<?> clazz = XposedHelpers.findClass("com.feichen.xposeddemo.Demo$InnerClass",lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz,
"innerFunc",
String.class,
new XC_MethodReplacement(){
@Override
protected Object replaceHookedMethod(MethodHookParam param)
throws Throwable {
Log.d("====================", "我是被替换的内部类");
return null;
}
});
final Class<?> clazz1 = XposedHelpers.findClass("com.feichen.xposeddemo.Demo$1",lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz1,
"eatFunc",
String.class,
new XC_MethodReplacement(){
@Override
protected Object replaceHookedMethod(MethodHookParam param)
throws Throwable {
Log.d("====================", "我是被替换的匿名内部类");
return null;
}
});
}
}
}

Hook日志如下：

我们通过编写的Hook代码可以发现，Hook内部类的字节码为：类路径$类名

Hook匿名内部类的字节码为：类路径1 类路径2 类路径

0x03 Xposed主动调用

在Hook的时候，我们有时候也是需要对app内部的函数进行主动调用，其中主动调用的函数为XposedHelpers.callMethod(),他的第一个参数为类的实例即clazz.newInstance()，第二个参数是方法名，第三个参数是参数列表，对于没有参数的函数可省略。那我还是以上个案例为例，找到其中的一个未被调用的函数refl（）

然后编写Hook代码如下：

package com.xposed;


import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;


public class Hook implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
if (lpparam.packageName.equals("com.feichen.xposeddemo")){
final Class<?> clazz = XposedHelpers.findClass("com.feichen.xposeddemo.Demo$InnerClass",lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz,
"innerFunc",
String.class,
new XC_MethodReplacement(){
@Override
protected Object replaceHookedMethod(MethodHookParam param)
throws Throwable {
Log.d("====================", "我是被替换的内部类");
return null;
}
});
final Class<?> clazz1 = XposedHelpers.findClass("com.feichen.xposeddemo.Demo$1",lpparam.classLoader);
XposedHelpers.findAndHookMethod(clazz1,
"eatFunc",
String.class,
new XC_MethodReplacement(){
@Override
protected Object replaceHookedMethod(MethodHookParam param)
throws Throwable {
Log.d("====================", "我是被替换的匿名内部类");
return null;
}
});
//主动调用
final Class<?> clazz2 = XposedHelpers.findClass("com.feichen.xposeddemo.Demo",lpparam.classLoader);
XposedHelpers.callMethod(clazz2.newInstance(),"refl");
}
}
}

运行日志如下：