{"id":9,"date":"2023-07-03T07:30:40","date_gmt":"2023-07-02T23:30:40","guid":{"rendered":"http:\/\/blog.wystudio.xyz\/?p=9"},"modified":"2024-08-05T17:14:11","modified_gmt":"2024-08-05T09:14:11","slug":"xposed%e6%a8%a1%e5%9d%97-xposed-hook%e5%ae%9e%e7%94%a8%e6%96%b9%e6%b3%95%e8%af%a6%e8%b0%88","status":"publish","type":"post","link":"https:\/\/blog.wystudio.xyz\/index.php\/2023\/07\/03\/xposed%e6%a8%a1%e5%9d%97-xposed-hook%e5%ae%9e%e7%94%a8%e6%96%b9%e6%b3%95%e8%af%a6%e8%b0%88\/","title":{"rendered":"[Xposed\u6a21\u5757] Xposed Hook\u5b9e\u7528\u65b9\u6cd5\u8be6\u8c08"},"content":{"rendered":"<h1>\u7f18\u8d77<\/h1>\n<p>\u6b63\u5982\u5404\u4f4d\u7f51\u53cb\u6240\u89c1\uff0c\u76ee\u524d\u7f51\u4e0a\u5df2\u7ecf\u6709\u8bb8\u591aXposed\u6a21\u5757\u7f16\u5199\u6559\u7a0b\uff0c\u4f46\u90fd\u662f\u57fa\u7840\u6559\u7a0b\u6216\u9488\u5bf9\u4e8e\u67d0\u4e00\u5e94\u7528\u3002\u4ecd\u9700\u6839\u636e\u6240Hook\u7684\u5e94\u7528\u6765\u5b9e\u9645\u8c03\u6574\u3002<\/p>\n<p>\u672c\u6587\u5c06\u5217\u4e3e\u5e76\u8c08\u53ca\u4e00\u4e9b\u5e38\u7528Hook\u65b9\u6cd5(<strong>\u9002\u7528\u4e8e\u5927\u90e8\u5206\u5e94\u7528<\/strong>)\uff0c\u4ee5\u65b9\u4fbf\u65b0\u4eba\u7684\u5b66\u4e60\u3002<\/p>\n<p>PS\uff1a\u672c\u6587\u4e3a<strong>\u57fa\u7840\u8fdb\u9636\u6559\u7a0b<\/strong>\uff0c\u9700\u8981\u6709\u4e00\u5b9a\u7684Xposed Hook\uff0cJava\u57fa\u7840\u3002\u82e5\u60a8\u4e3a\u65b0\u624b\u5efa\u8bae\u5148\u89c2\u770b\u4e00\u4e0b\u6559\u7a0b\uff1a<\/p>\n<p><a href=\"https:\/\/www.52pojie.cn\/home.php?mod=space&amp;uid=1109458\">@\u6b63\u5df1<\/a>(\u543e\u7231\u7834\u89e3\u8bba\u575b)\uff1a<br \/>\n<a href=\"https:\/\/www.52pojie.cn\/thread-1740944-1-1.html\">\u4e03\u3001Sorry\uff0c\u4f1aHook\u771f\u7684\u53ef\u4ee5\u4e3a\u6240\u6b32\u4e3a-Xposed\u5feb\u901f\u4e0a\u624b(\u4e0a)\u6a21\u5757\u7f16\u5199<\/a>  <\/p>\n<p><a href=\"https:\/\/www.52pojie.cn\/thread-1748081-1-1.html\">\u516b\u3001Sorry\uff0c\u4f1aHook\u771f\u7684\u53ef\u4ee5\u4e3a\u6240\u6b32\u4e3a-xposed\u5feb\u901f\u4e0a\u624b(\u4e0b)\u5feb\u901fhook<\/a><\/p>\n<h1>\u5b9e\u7528\u65b9\u6cd5\u5217\u8868<\/h1>\n<h2>1.\u83b7\u53d6Activity\u5bf9\u8c61(Android\u4e16\u754c\u7684\u5927\u95e8)<\/h2>\n<h4>\u2460\u4ecb\u7ecd\uff1a<\/h4>\n<p>\u4f17\u6240\u5468\u77e5\uff0cAndroid\u4e2d\u7684\u56db\u5927\u7ec4\u4ef6\u4e3a\uff1a<\/p>\n<ul>\n<li>Activity<\/li>\n<li>Service<\/li>\n<li>Content Provider<\/li>\n<li>Broadcast Provider<\/li>\n<\/ul>\n<p>Activity\u5904\u4e8e\u7b2c\u4e00\u4e2a\u53ef\u89c1\u5176\u5341\u5206\u91cd\u8981<br \/>\n\u800c\u5728Java\u4e2d\u6709\u4e86Activity\u5bf9\u8c61\uff0c\u4fbf\u53ef\u5bf9Activity\u8fdb\u884c\u5404\u79cd\u64cd\u4f5c\uff0c\u5982\uff1a\u6253\u5f00\u53e6\u4e00\u4e2aActivity\uff0c\u5173\u95ed\u5f53\u524dActivity\uff0c\u83b7\u53d6Activity\u4e2d\u7684\u5e03\u5c40\u7b49\u3002<br \/>\n\u540c\u65f6Activity\u7ee7\u627f\u4e8eContext\uff0c\u6240\u4ee5\u6709\u4e86Activity\u65b9\u6cd5\u4e5f\u53ef\u4ee5\u4f7f\u7528Context\u7684\u65b9\u6cd5\u3002\u5e76\u4e14\u4e00\u4e9b\u9700\u8981\u4f20\u5165Context\u4f5c\u4e3a\u53c2\u6570\u7684\u65b9\u6cd5\u4e5f\u53ef\u4ee5\u4f20\u5165Activity\u5bf9\u8c61\uff0c\u6bd4\u5982 new\u5404\u79cdView\u548cnew\u4e00\u4e2aToast\u7b49\u3002<br \/>\n<strong><em>\u603b\u4e4b\u5f97\u5230\u4e86Activity\u5bf9\u8c61\uff0c\u5c31\u72b9\u5982\u6253\u5f00\u4e86Android\u4e16\u754c\u7684\u5927\u95e8\uff0c\u4e16\u754c\u4e4b\u5927\u4efb\u4f60\u9068\u6e38\uff01<\/em><\/strong>  <\/p>\n<p><strong><em>\u4e0b\u9762\u4ecb\u7ecd\u4e24\u79cd\u4e0d\u540c\u7684\u83b7\u53d6\u65b9\u6cd5\uff0c\u8bf7\u6839\u636e\u5b9e\u9645\u60c5\u51b5\u9009\u62e9\u4f7f\u7528<\/em><\/strong><\/p>\n<h3>\u6cd5\u4e00\uff1a\u83b7\u53d6\u6307\u5b9a\u7684Activity\u5bf9\u8c61<\/h3>\n<p>\u8be5\u65b9\u6cd5\u7528\u4e8e\u5728\u77e5\u9053\u7c7b\u540d\u548c<code>onCreate<\/code>\u5b9e\u73b0\u65b9\u6cd5\u540d\u7684\u524d\u63d0\u4e0b\uff0c\u83b7\u53d6\u6307\u5b9a\u7684Activity\u5bf9\u8c61<\/p>\n<h4>\u2461\u6b65\u9aa4\uff1a<\/h4>\n<h5>(1)\u9996\u5148\u8981\u786e\u5b9a\u83b7\u53d6\u54ea\u4e00\u4e2aActivity\u5bf9\u8c61\u3002<\/h5>\n<p>\u8fd9\u4e00\u6b65\u53ef\u4ee5\u4f7f\u7528MT\u7ba1\u7406\u5668\u4e2d\u7684Activity\u8bb0\u5f55\u6355\u6349\u6216\u76f4\u63a5\u6253\u5f00\u6e05\u5355\u6587\u4ef6\u67e5\u627e\u3002\u8fd9\u91cc\u4e0d\u518d\u8fc7\u591a\u8d58\u8ff0\u3002\u8bb0\u4e0b\u8fd9\u4e2aActivity\u7c7b\u7684\u5305\u540d\u8def\u5f84\uff0c\u8fd9\u91cc\u4ee5 <code>com.example.app.MainActivity<\/code> \u4e3a\u4f8b<br \/>\n<figure class=\"mdx-lazyload-container\" style=\"\"><div style=\"padding-top:50%\"><\/div><div class=\"mdx-img-loading-sp mdui-valign\"><div><div class=\"mdui-spinner\"><\/div><\/div><\/div><img class=\"lazyload\" title=\"Activity\u5305\u540d\u8def\u5f84\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" data-src=\"https:\/\/blog.wystudio.xyz\/wp-content\/uploads\/2023\/07\/IMG_20230701_113447_602.jpg\" alt=\"Activity\u5305\u540d\u8def\u5f84\"><\/figure><\/p>\n<h5>(2)\u627e\u5230\u8fd9\u4e2aActivity\u7684 onCreate \u65b9\u6cd5\u7684\u5b9e\u73b0\u65b9\u6cd5\u540d\u3002<\/h5>\n<p>\u5982\u679c\u88abHook\u7684\u5e94\u7528\u6ca1\u6709\u88ab\u6df7\u6dc6\uff0c\u90a3\u540d\u79f0\u5c31\u4e3a <code>onCreate<\/code> \u3002\u5982\u679c\u88ab\u6df7\u6dc6\u4e86\uff0c\u90a3\u5c31\u628a\u5e94\u7528\u62d6\u5165jsdx\u6216\u7528MT\u7ba1\u7406\u5668\u7b49\u5de5\u5177\uff0c\u53bb\u8fd9\u4e2aActivity\u7684smail\u4ee3\u7801\u4e2d\u627e\u5230\u540d\u79f0\u3002\u5e76\u8bb0\u4e0b\u8fd9\u4e2a\u540d\u79f0\u3002<br \/>\n\u8fd9\u91cc\u5047\u8bbe\u6ca1\u6709\u88ab\u6df7\u6dc6\uff0c\u65b9\u6cd5\u540d\u4e3a <code>onCreate<\/code>\uff1a<br \/>\n<figure class=\"mdx-lazyload-container\" style=\"\"><div style=\"padding-top:50%\"><\/div><div class=\"mdx-img-loading-sp mdui-valign\"><div><div class=\"mdui-spinner\"><\/div><\/div><\/div><img class=\"lazyload\" title=\"onCreate\u5b9e\u73b0\u65b9\u6cd5\u540d\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" data-src=\"https:\/\/blog.wystudio.xyz\/wp-content\/uploads\/2023\/07\/IMG_20230701_125322_215.jpg\" alt=\"onCreate\u5b9e\u73b0\u65b9\u6cd5\u540d\"><\/figure><\/p>\n<h5>(3)Hook\u8fd9\u4e2a\u65b9\u6cd5\u5373\u53ef<\/h5>\n<p>\u73b0\u5728\u6211\u4eec\u5f97\u5230\u4e86\u6307\u5b9aActivity\u7684\u7c7b\u540d\u548c <code>onCreate<\/code> \u5b9e\u73b0\u65b9\u6cd5\u540d\u3002<br \/>\n\u6700\u540e\u6211\u4eec\u53ea\u9700\u8981Hook\u6b64\u7c7b\u4e2d\u7684 <code>onCreate<\/code> \u5b9e\u73b0\u65b9\u6cd5\u5373\u53ef\u62ff\u5230Activity\u5bf9\u8c61\uff0c\u5177\u4f53\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-java\">XposedHelpers.findAndHookMethod(&quot;com.example.app.mainActivity&quot;, lpparam.classLoader, &quot;onCreate&quot;,new XC_MethodHook() {\n    @Override\n    protected void afterHookedMethod(MethodHookParam param) throws Throwable {\n       Activity mainActivity = (Activity) param.thisObject; \/\/mainActivity\u5c31\u662f\u6700\u7ec8\u5f97\u5230\u7684Activity\u5bf9\u8c61\n    }\n});<\/code><\/pre>\n<p>\u6700\u540e\u7684 <code>mainActivity<\/code> \u5c31\u662f\u6211\u4eec\u83b7\u53d6\u5230\u7684Activity\u5bf9\u8c61<br \/>\n<strong><em>\u73b0\u5728\u4f60\u53ef\u4ee5\u50cf\u7f16\u5199\u4e00\u4e2aAPP\u4e00\u6837\uff0c\u53bb\u4f7f\u7528\u5b83\u505a\u5404\u79cd\u4e8b\u60c5<\/em><\/strong><\/p>\n<h3>\u6cd5\u4e8c\uff1a\u83b7\u53d6\u5f53\u524dActivity\u5bf9\u8c61<\/h3>\n<p>\u6b64\u65b9\u6cd5\u7528\u4e8e\u83b7\u53d6\u5f53\u524d\u6b63\u5728\u663e\u793a\u7684Activity\u5bf9\u8c61\uff01<\/p>\n<blockquote>\n<p>\uff01\u6ce8\u610f\uff1a\u56e0\u4e3a\u6b64\u65b9\u6cd5\u5c5e\u4e8e\u975e\u516c\u5f00\u7684API\u4f7f\u7528\uff0c\u53ef\u80fd\u56e0\u4e3aAndroid\u7248\u672c\u7684\u66f4\u8fed\u800c\u53d1\u751f\u53d8\u5316\uff01  <\/p>\n<p>\u8be5\u65b9\u6cd5\u5728\u4e00\u4e9b\u7cfb\u7edf\u88ab\u9b54\u6539\u7684\u6709\u4e9b\u8fc7\u5206\u7684\u7cfb\u7edf\u4e2d\uff0c\u53ef\u80fd\u51fa\u73b0\u672a\u77e5\u9519\u8bef\u3002\u4f46\u662f\u5927\u90e8\u5206\u7cfb\u7edf\u90fd\u6ca1\u95ee\u9898<\/p>\n<\/blockquote>\n<h4>\u2461\u6b65\u9aa4\uff1a<\/h4>\n<h5>(1)Hook <code>android.app.ActivityThread<\/code> \u4e2d\u7684 <code>currentActivityThread<\/code> \u65b9\u6cd5<\/h5>\n<p>\u901a\u8fc7Hook\u6b64\u65b9\u6cd5\u83b7\u53d6\u5230\u5f53\u524dActivityThread\u5bf9\u8c61<\/p>\n<h5>(2)\u901a\u8fc7\u53cd\u5c04\u83b7\u53d6\u5230\u5f53\u524dActivity\u5bf9\u8c61<\/h5>\n<p>\u5148\u901a\u8fc7\u53cd\u5c04\u83b7\u53d6\u5230Activity\u96c6\u5408\uff0c\u518d\u83b7\u53d6\u5f53\u524dActivity<br \/>\n\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-java\">XposedHelpers.findAndHookMethod(&quot;android.app.ActivityThread&quot;, lpparam.classLoader, &quot;currentActivityThread&quot;, new XC_MethodHook() {\n    @Override\n    protected void afterHookedMethod(MethodHookParam param) throws Throwable {\n        super.afterHookedMethod(param);\n        Object currentActivityThread = param.getResult(); \/\/ \u83b7\u53d6\u5f53\u524dActivityThread\u5bf9\u8c61\n\n        Field activityField = currentActivityThread.getClass().getDeclaredField(&quot;mActivities&quot;);\n        activityField.setAccessible(true);\n\n        \/\/ \u83b7\u53d6Activity\u96c6\u5408\n        Map&lt;?, ?&gt; activities = (Map&lt;?, ?&gt;) activityField.get(currentActivityThread);\n        for (Object activityRecord : activities.values()) {\n            Class&lt;?&gt; activityRecordClass = activityRecord.getClass();\n            Field activityField2 = activityRecordClass.getDeclaredField(&quot;activity&quot;);\n            activityField2.setAccessible(true);\n\n            \/\/ \u83b7\u53d6Activity\u5bf9\u8c61\n            Activity currentActivity = (Activity)activityField2.get(activityRecord);\n            \/\/ currentActivity\u5c31\u4e3a\u5f53\u524d\u6b63\u5728\u8fd0\u884c\u7684Acticity\u5bf9\u8c61\n        }\n    }\n});<\/code><\/pre>\n<p>\u6700\u540e\u7684<code>currentActivity<\/code>\u5c31\u4e3a\u5f53\u524d\u6b63\u5728\u8fd0\u884c\u7684Acticity\u5bf9\u8c61<\/p>\n<blockquote>\n<p>\u4f7f\u7528\u6b64\u65b9\u6cd5\uff0c\u6bcf\u5f53<strong><em>\u6253\u5f00\u53e6\u4e00\u4e2aActivity<\/em><\/strong>\u6216<strong><em>\u5f53\u524dActivity\u88ab\u6539\u53d8<\/em><\/strong>\uff0c\u90fd\u4f1a\u81ea\u52a8\u91cd\u65b0\u83b7\u53d6\u5f53\u524dActivity  <\/p>\n<\/blockquote>\n<p><strong><em>\u8fd9\u91cc\u53ea\u4ecb\u7ecd\u4e86\u4e24\u79cd\u83b7\u53d6Activity\u5bf9\u8c61\u7684\u65b9\u6cd5\uff0c\u4f46\u5176\u5b9e\u4e0d\u6b62\u8fd9\u4e24\u79cd\u3002\u8bf7\u6839\u636e\u5b9e\u9645\u60c5\u51b5\u9009\u62e9\u4f7f\u7528\uff01<\/em><\/strong><\/p>\n<h2>2.\u83b7\u53d6Activity\u7684\u6839\u5e03\u5c40<\/h2>\n<h4>\u2460\u4ecb\u7ecd\uff1a<\/h4>\n<p>\u524d\u4e00\u4e2a\u65b9\u6cd5\u4ecb\u7ecd\u4e86\u5982\u4f55\u83b7\u53d6Activity\u5bf9\u8c61\uff0c\u73b0\u5728\u6709\u4e86\u5bf9\u8c61\uff0c\u5c31\u53ef\u4ee5\u8fdb\u884c\u5404\u79cd\u64cd\u4f5c\uff0c\u8fd9\u91cc\u8bf4\u8bf4\u83b7\u53d6\u5e03\u5c40<\/p>\n<h4>\u2461\u6b65\u9aa4\uff1a<\/h4>\n<h5>(1)\u62ff\u5230Activity\u5bf9\u8c61<\/h5>\n<p>\u901a\u8fc7\u65b9\u6cd51\u62ff\u5230Activity\u5bf9\u8c61<\/p>\n<h5>(2)\u901a\u8fc7findViewById\u62ff\u5230\u5e03\u5c40<\/h5>\n<blockquote>\n<p>\u6709\u4e9b\u65b0\u624b\u53ef\u80fd\u4f1a\u95ee\u4e3a\u4ec0\u4e48 Activity \u4e2d\u6709 <code>setContentView(int id)<\/code> \u8fd9\u4e2a\u65b9\u6cd5\u5374\u6ca1\u6709 <code>getContentView<\/code> \u8fd9\u4e2a\u65b9\u6cd5\u5462\uff1f<br \/>\n\u8fd9\u4e2a\u6211\u771f\u6ca1\u529e\u6cd5\u56de\u7b54\uff0c\u4f46\u662f\u6211\u80fd\u544a\u8bc9\u4f60\u600e\u4e48\u53bb\u901a\u8fc7Activity\u5bf9\u8c61\u62ff\u5230\u6839\u5e03\u5c40<\/p>\n<\/blockquote>\n<p>\u5176\u5b9e\u901a\u8fc7Activity\u5bf9\u8c61\u6765\u83b7\u53d6\u6839\u5e03\u5c40\u7684\u65b9\u6cd5\u6709\u5f88\u591a\u79cd\uff0c\u6bd4\u5982\uff1a<\/p>\n<ul>\n<li>\n<p>getRootView()<br \/>\n\u4f46\u662f\u901a\u5e38\u62ff\u4e0d\u5230id\uff0c\u8fd9\u662f\u4e3a\u4ec0\u4e48\u5462\uff1f\u8fd9\u662f\u56e0\u4e3a\u62ff\u5230\u7684getRootView \u662f\u5728ContentView\u5916\u7684DecorView\u3002<\/p>\n<blockquote>\n<p>\u5728\u300aAndroid\u7fa4\u82f1\u4f20\u300b\u4e2d\u8bf4\u5230\uff1aAndroid\u7684Window\u5bf9\u8c61\u7531PhoneWindow\u5b9e\u73b0\uff0c DecorView\u5c06\u663e\u793a\u5185\u5bb9\u5448\u73b0\u5728PhoneWindow\u4e0a\uff0c\u6240\u6709\u7684View\u76d1\u542c\u7531 WindowManagerService\u63a5\u6536\uff0c\u901a\u8fc7Activity\u5bf9\u8c61\u56de\u8c03onClickListener\uff1b DecorView\u5305\u542bTitleView \u548cContentView\u3002<br \/>\n\u8fd9\u5c31\u662f\u4e3a\u4ec0\u4e48 requestWindowFeature(Window.FEATURE_NO_TITLE)\u8981\u653e\u5728setContent\u4e4b\u524d\u3002<br \/>\n---\u6765\u81ea<a href=\"https:\/\/baike.baidu.com\/item\/Android%E7%BE%A4%E8%8B%B1%E4%BC%A0\/18525972?fr=ge_ala\" title=\"Android\u7fa4\u82f1\u4f20\">Android\u7fa4\u82f1\u4f20<\/a><\/p>\n<\/blockquote>\n<\/li>\n<li>\n<p>getWindow().getDecorView().getRootView()<br \/>\n\u6b64\u65b9\u6cd5\u9ad8\u7248\u672c\u5b89\u5353\u83b7\u53d6\u4e0d\u5230<\/p>\n<\/li>\n<li>\n<p>\u7b49<\/p>\n<\/li>\n<\/ul>\n<p>\u8fd9\u4e9b\u65b9\u6cd5\u8981\u4e48\u9ad8\u7248\u672c\u83b7\u53d6\u4e0d\u5230\uff0c\u8981\u4e48\u8017\u65f6\u5de8\u5927\u3002\u4e0b\u9762\u4f5c\u8005\u4ecb\u7ecd\u7684\u8fd9\u4e2a\u65b9\u6cd5\u5219\u5c06\u5b8c\u7f8e\u907f\u5f00\u8fd9\u4e9b\u95ee\u9898\u3002<br \/>\n\u5177\u4f53\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-java\">\/\/\u901a\u8fc7\u65b9\u6cd51\u62ff\u5230mainActivity\nViewGroup rootLayout = (ViewGroup)mainActivity.findViewById(android.R.id.content);<\/code><\/pre>\n<p>\u8fd9\u4e2arootLayout\u5c31\u662f\u6839\u5e03\u5c40\uff0c\u4e3aViewGroup\u7c7b\u578b\u3002<br \/>\n\u6709\u4e86\u6839\u5e03\u5c40\u5c31\u53ef\u4ee5\u5bf9Activity\u4e2d\u7684\u7ec4\u4ef6\u8fdb\u884c\u64cd\u4f5c\uff0c\u4f8b\u5982\uff1a<\/p>\n<pre><code class=\"language-java\">\/\/\u83b7\u53d6\u6839\u5e03\u5c40\u4e0b\u7684\u7b2c\u4e00\u4e2aView\nView view = rootLayout.getChildAt(0);\n\n\/\/\u5220\u9664\u6839\u5e03\u5c40\u4e0b\u7684\u7b2c\u4e00\u4e2aView\nrootLayout.removeViewAt(0);\n\n\/\/\u5411\u6839\u5e03\u5c40\u4e2d\u6dfb\u52a0View\nTextView textView = new TextView(mainActivity);\ntextView.setText(&quot;\u6211\u662f\u65b0\u6dfb\u52a0\u7684TextView&quot;);\nrootLayout.addView(textView);\n\n\/\/......<\/code><\/pre>\n<h4>\u2462\u60c5\u666f\u6a21\u62df\uff1a<\/h4>\n<p>\u5f53\u6211\u4eec\u5728Hook\u67d0\u4e2a\u5e94\u7528\u65f6\uff0c\u53d1\u73b0<code>mainActivity<\/code>\u4e2d\u6709\u4e00\u4e2a\u5e7f\u544a\u4e00\u76f4\u963b\u6321\u6211\u4eec\u7684\u89c6\u7ebf\uff0c\u5341\u5206\u82e6\u607c\u3002\u4f46\u53c8\u4e0d\u60f3\u53bb\u5206\u6790\u5e7f\u544a\u4ee3\u7801\uff0c\u600e\u4e48\u624d\u80fd\u53bb\u9664\u5462\uff1f<br \/>\n\u5176\u5b9e\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7Hook\u5f97\u5230\u8fd9\u4e2a\u5e7f\u544a\u6240\u5728\u9875\u9762\u7684\u6839\u5e03\u5c40\uff0c\u7136\u540e\u901a\u8fc7\u5e03\u5c40\u52a9\u624b\u7b49\u8f6f\u4ef6\uff0c\u627e\u5230\u8fd9\u4e2a\u5e7f\u544a\u7ec4\u4ef6\u7684id\uff0c\u7136\u540e\u8fdb\u884c\u53bb\u9664\u3002\u5982\u679c\u6ca1\u6709id\uff0c\u90a3\u4e48\u5c31\u53ea\u6709\u5206\u6790\u5e03\u5c40\u7ed3\u6784\uff0c\u7136\u540e\u62ff\u5230\u8fd9\u4e2a\u5e7f\u544a\u7ec4\u4ef6\u7684\u5bf9\u8c61\u8fdb\u884c\u53bb\u9664\u3002<br \/>\n\u8fd9\u91cc\u6211\u4eec\u5047\u8bbe\u62ff\u4e0d\u5230\u8fd9\u4e2aid\u3002<br \/>\n\u901a\u8fc7\u5e03\u5c40\u7ed3\u6784\u5206\u6790\u53d1\u73b0\u8fd9\u4e2a\u5e7f\u544a\u7ec4\u4ef6\u5e03\u5c40\u7ed3\u6784\u5982\u4e0b\uff1a  <\/p>\n<ul>\n<li>\u6839\u5e03\u5c40\n<ul>\n<li>RelativeLayout\n<ul>\n<li>ADView (\u5e7f\u544a\u7ec4\u4ef6)<\/li>\n<li>xxx<\/li>\n<\/ul>\n<\/li>\n<li>LinearLayout<\/li>\n<li>xxx<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h5>(1)\u5148\u901a\u8fc7\u6839\u5e03\u5c40\u62ff\u5230RelativeLayout<\/h5>\n<p>\u6839\u636e\u5e03\u5c40\u7ed3\u6784\u5206\u6790\uff0cRelativeLayout\u4e3a\u6839\u5e03\u5c40\u4e0b\u7b2c\u4e00\u4e2a\u7ec4\u4ef6<br \/>\n\u4f7f\u7528 <code>getChildAt(int id)<\/code> \u65b9\u6cd5\u83b7\u53d6RelativeLayout\uff1a<\/p>\n<pre><code class=\"language-java\">\/\/\u901a\u8fc7\u65b9\u6cd52\u62ff\u5230\u6839\u5e03\u5c40 rootLayout\nRelativeLayout relativeLayout = (RelativeLayout) rootLayout.getChildAt(0);<\/code><\/pre>\n<h5>(2)\u518d\u901a\u8fc7RelativeLayout\u5220\u9664\u5e7f\u544a\u7ec4\u4ef6<\/h5>\n<p>\u6839\u636e\u5e03\u5c40\u7ed3\u6784\u5206\u6790\uff0c\u5e7f\u544a\u7ec4\u4ef6\u4e3a RelativeLayout \u4e0b\u7684\u7b2c\u4e00\u4e2a\u7ec4\u4ef6<br \/>\n\u4f7f\u7528 <code>removeViewAt(int id)<\/code> \u65b9\u6cd5\u5220\u9664\u5e7f\u544a\u7ec4\u4ef6\uff1a<\/p>\n<pre><code class=\"language-java\">relativeLayout.removeViewAt(0);<\/code><\/pre>\n<p>\u81f3\u6b64\uff0c\u8fd9\u4e2a\u5e7f\u544a\u7ec4\u4ef6\u5df2\u7ecf\u88ab\u6211\u4eec\u6210\u529f\u53bb\u9664\uff01<\/p>\n<h2>3.\u83b7\u53d6ApplicationContext<\/h2>\n<h4>\u2460\u4ecb\u7ecd\uff1a<\/h4>\n<p>\u5b9e\u7528\u65b9\u6cd51\u8bb2\u8ff0\u4e86\u5982\u4f55\u83b7\u53d6Activity\u5bf9\u8c61\uff0c\u4f46\u662f\u6709\u4e9b\u65f6\u5019\u6211\u4eec\u5e76\u4e0d\u9700\u8981Activity\u5bf9\u8c61\u4e5f\u61d2\u5f97\u53bb\u5206\u6790Activity\u6240\u5728\u7684\u7c7b\u540d\u3002\u6211\u4eec\u53ea\u9700\u8981\u4e00\u4e2aApplicationContext(\u5e94\u7528\u4e0a\u4e0b\u6587)<br \/>\n\u5e76\u4e14\u6211\u4eec\u53ea\u9700\u8981\u5728\u5e94\u7528\u542f\u52a8\u65f6Hook\u5f97\u5230\u5b83\uff0c\u5e76\u628a\u5b83\u5b58\u5728\u53d8\u91cf\u4e2d\uff0c\u540e\u7eed\u5c31\u53ef\u4ee5\u76f4\u63a5\u62ff\u6765\u4f7f\u7528<br \/>\n\u5e76\u4e14ApplicationContext\u4e0d\u4f1a\u56e0\u4e3a\u5f53\u524dActivity\u7684\u6539\u53d8\u800c\u65e0\u6cd5\u4f7f\u7528\u3002\u5b83\u968f\u5e94\u7528\u542f\u52a8\u800c\u521b\u5efa\uff0c\u968f\u5e94\u7528\u7ec8\u6b62\u800c\u9500\u6bc1\u3002\u5728\u5e94\u7528\u7684\u4efb\u4f55\u4e00\u4e2a\u5730\u65b9\u90fd\u53ef\u4ee5\u4f7f\u7528\u5b83\u3002  <\/p>\n<p><strong><em>\u4e0b\u9762\u4ecb\u7ecd\u4e24\u79cd\u4e0d\u540c\u7684\u83b7\u53d6\u65b9\u6cd5\uff0c\u8bf7\u6839\u636e\u5b9e\u9645\u60c5\u51b5\u9009\u62e9\u4f7f\u7528<\/em><\/strong><\/p>\n<h3>\u6cd5\u4e00\uff1a\u901a\u8fc7Application\u83b7\u53d6Context<\/h3>\n<p>\u8be5\u65b9\u6cd5\u901a\u8fc7Hook\u5e94\u7528\u542f\u52a8\u65f6\u7684<code>Application<\/code>\u7c7b\u4e2d\u7684<code>attach<\/code>\u65b9\u6cd5\u6765\u62ff\u5230Context<\/p>\n<h4>\u2461\u6b65\u9aa4\uff1a<\/h4>\n<h5>(1)Hook <code>Application<\/code> \u7c7b\u4e2d\u7684 <code>attach<\/code> \u65b9\u6cd5<\/h5>\n<p><code>attach<\/code>\u65b9\u6cd5\u4e2d\u7684\u53c2\u6570\u5c31\u662f\u6211\u4eec\u9700\u8981\u7684Context<br \/>\n\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-java\">XposedHelpers.findAndHookMethod(Application.class,&quot;attach&quot;,new XC_MethodHook(){\n    @Override\n    protected void afterHookedMethod(MethodHookParam param) throws Throwable {\n        super.afterHookedMethod(param);\n        Context context= (Context) param.args[0];\n        \/\/\u8fd9\u4e2acontext\u5c31\u4e3a\u6211\u4eec\u9700\u8981\u7684ApplicationContext\n    }\n});<\/code><\/pre>\n<p>\u6700\u540e<code>context<\/code>\u5c31\u4e3a\u6211\u4eec\u9700\u8981\u7684ApplicationContext  <\/p>\n<blockquote>\n<p><strong><em>\u6b64\u65b9\u6cd5\u53ef\u7528\u4e8e\u4e00\u4e9b\u52a8\u6001\u52a0\u8f7ddex\u7684APP\uff0c\u5982\u5404\u79cd\u5546\u4e1a\u7ea7APP<\/em><\/strong><\/p>\n<\/blockquote>\n<h4>\u2462\u539f\u7406\u5206\u6790\uff1a<\/h4>\n<blockquote>\n<p>\u4e3a\u4ec0\u4e48<code>Application<\/code>\u7c7b\u4e2d\u7684<code>attach<\/code>\u65b9\u6cd5\u53c2\u6570\u662f\u4e00\u4e2aContext\u5462\uff1f\u8fd9\u4e2a\u53c2\u6570\u53c8\u662f\u8c01\u4f20\u7ed9\u5b83\u7684\u5462\uff1f  <\/p>\n<\/blockquote>\n<p>\u7531\u4e8eAndroid\u662f\u5f00\u6e90\u7684\uff0c\u6211\u4eec\u67e5\u9605Android\u7684\u6e90\u4ee3\u7801\u5f97\u5230\uff1a  <\/p>\n<h5>(1)\u5148\u7531 <code>ActivityThread.<\/code> \u4e2d\u7684 <code>handleBindApplication<\/code> \u65b9\u6cd5\u521b\u5efa<code>Application<\/code><\/h5>\n<pre><code class=\"language-java\">private void handleBindApplication(AppBindData data) {\n    ...\n    \/\/ If the app is Honeycomb MR1 or earlier, switch its AsyncTask\n    \/\/ implementation to use the pool executor.  Normally, we use the\n    \/\/ serialized executor as the default. This has to happen in the\n    \/\/ main thread so the main looper is set right.\n    if (data.appInfo.targetSdkVersion &lt;= android.os.Build.VERSION_CODES.HONEYCOMB_MR1) {\n        AsyncTask.setDefaultExecutor(AsyncTask.THREAD_POOL_EXECUTOR);\n    }\n\n    ...\n    final ContextImpl appContext = ContextImpl.createAppContext(this, data.info);\n    ...\n        app = data.info.makeApplication(data.restrictedBackupMode, null);\n\n        ...\n\n        mInitialApplication = app;\n\n        ...\n        try {\n            mInstrumentation.callApplicationOnCreate(app);\n        ...\n}<\/code><\/pre>\n<p>\u53ef\u4ee5\u770b\u5230\u5728<code>handleBindApplication<\/code>\u53c8\u8c03\u7528\u4e86<code>makeApplication<\/code>\u65b9\u6cd5\u6784\u9020<code>Application<\/code><\/p>\n<h5>(2)\u518d\u901a\u8fc7 <code>LoadedApk<\/code> \u4e2d\u7684 <code>makeApplication<\/code> \u6784\u9020<code>Application<\/code><\/h5>\n<pre><code class=\"language-java\">public Application makeApplication(boolean forceDefaultAppClass,\n        Instrumentation instrumentation) {\n    ...\n        ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);\n        app = mActivityThread.mInstrumentation.newApplication(\n                cl, appClass, appContext);\n        appContext.setOuterContext(app);\n    ...\n    return app;\n}<\/code><\/pre>\n<p>\u53ef\u4ee5\u770b\u5230<code>makeApplication<\/code>\u901a\u8fc7<code>ContextImpl.createAppContext<\/code>\u6784\u9020\u4e86<code>contextImpl<\/code>\uff0c\u7136\u540e\u7528<code>newApplication<\/code>\u6784\u9020\u4e86<code>Application<\/code><\/p>\n<h5>(3)\u7136\u540e\u8c03\u7528<code>Instrumentation<\/code> \u7684 <code>newApplication<\/code> \u65b9\u6cd5<\/h5>\n<pre><code class=\"language-java\">public Application newApplication(ClassLoader cl, String className, Context context)\n        throws InstantiationException, IllegalAccessException, \n        ClassNotFoundException {\n    Application app = getFactory(context.getPackageName())\n            .instantiateApplication(cl, className);\n    app.attach(context);\n    return app;\n}<\/code><\/pre>\n<p>\u53ef\u4ee5\u770b\u51fa<code>newApplication<\/code>\u5148\u6784\u9020\u4e86<code>Application<\/code>\uff0c\u6700\u540e\u518d\u8c03\u7528<code>attach<\/code>\u65b9\u6cd5\u5e76\u4f20\u5165\u7531<code>makeApplication<\/code>\u4e2d\u521b\u5efa\u7684<code>context<\/code>\u4f5c\u4e3a\u53c2\u6570<\/p>\n<h5>(4)\u6700\u540e\u8c03\u7528 <code>Application<\/code> \u4e2d\u7684 <code>attach<\/code> \u65b9\u6cd5<\/h5>\n<pre><code class=\"language-java\">\/* package *\/ final void attach(Context context) {\n    attachBaseContext(context);\n    mLoadedApk = ContextImpl.getImpl(context).mPackageInfo;\n}<\/code><\/pre>\n<p>\u53ef\u4ee5\u770b\u5230\u5148\u8c03\u7528\u4e86<code>attachBaseContext<\/code>\uff0c\u7136\u540e\u7ed9<code>mLoadedApk<\/code>\u8d4b\u503c<\/p>\n<h5>\u603b\u7ed3\uff1a<\/h5>\n<p><code>Application<\/code>\u4e2d\u7684<code>attach<\/code>\u65b9\u6cd5\u662f\u7531<code>Instrumentation<\/code>\u4e2d\u7684<code>newApplication<\/code>\u65b9\u6cd5\u5728Application\u521b\u5efa\u65f6\u8c03\u7528\u7684<br \/>\n\u4f20\u5165\u7684\u53c2\u6570<code>Context<\/code>\u662f\u5728<code>LoadedApk<\/code>\u4e2d\u7684<code>makeApplication<\/code>\u65b9\u6cd5\u521b\u5efa\u7684<\/p>\n<h3>\u6cd5\u4e8c\uff1a\u901a\u8fc7ActivityThread\u83b7\u53d6Context<\/h3>\n<p>\u8be5\u65b9\u6cd5\u901a\u8fc7Hook<code>ActivityThread<\/code>\u4e2d\u7684<code>getSystemContext<\/code>\u65b9\u6cd5\u6765\u83b7\u53d6Context<\/p>\n<h4>\u2461\u6b65\u9aa4\uff1a<\/h4>\n<h5>(1)\u83b7\u53d6\u5f53\u524dActivityThread\u5bf9\u8c61<\/h5>\n<p>\u901a\u8fc7Hook<code>ActivityThread<\/code>\u4e2d\u7684<code>currentActivityThread<\/code>\u65b9\u6cd5\u6765\u83b7\u53d6\u5f53\u524dActivityThread\u5bf9\u8c61<\/p>\n<h5>(2)\u8c03\u7528getSystemContext\u65b9\u6cd5<\/h5>\n<p>\u8c03\u7528\u5f53\u524dActivityThread\u5bf9\u8c61\u4e2d\u7684<code>getSystemContext<\/code>\u65b9\u6cd5<br \/>\n\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-java\">XposedHelpers.findAndHookMethod(&quot;android.app.ActivityThread&quot;, lpparam.classLoader, &quot;currentActivityThread&quot;,new XC_MethodHook() {\n    @Override\n    protected void afterHookedMethod(MethodHookParam param) throws Throwable {\n        super.afterHookedMethod(param);\n        Object currentActivityThread = param.getResult(); \/\/ \u83b7\u53d6\u5f53\u524dActivityThread\u5bf9\u8c61\n        Context context= (Context)XposedHelpers.callMethod(currentActivityThread,&quot;getSystemContext&quot;);\n        \/\/context\u5373\u4e3a\u6211\u4eec\u8981\u7684ApplicationContext\n    }    \n});<\/code><\/pre>\n<p>context\u5373\u4e3a\u6211\u4eec\u8981\u83b7\u53d6\u7684ApplicationContext<\/p>\n<h2>4.\u672a\u5b8c\u5f85\u7eed\u3002\u3002\u3002<\/h2>\n<h1>\u5199\u5728\u6700\u540e<\/h1>\n<p>\u672c\u6587\u4e3a\u4f5c\u8005\u5b66\u4e60Xposed Hook\u65f6\uff0c\u53d1\u73b0\u7684\u4e00\u4e9b\u5b9e\u7528\uff0c\u5e38\u7528\u65b9\u6cd5\u8bb0\u5f55\u4ee5\u53ca\u4e00\u4e9b\u601d\u8def\u8bb0\u5f55\uff0c\u4f9b\u5927\u5bb6\u5b66\u4e60\uff01<br \/>\n<strong><em>\u672c\u6587\u5982\u6709\u9519\u8bef\uff0c\u8bf7\u5927\u4f6c\u6307\u6b63\uff01<\/em><\/strong>  <\/p>\n<p>\u672c\u6587\u5df2\u540c\u6b65\u53d1\u81f3\u543e\u7231\u7834\u89e3\u8bba\u575b\uff1a<a href=\"https:\/\/www.52pojie.cn\/thread-1803658-1-1.html\">\u7acb\u5373\u67e5\u770b<\/a><\/p>\n<h1>\u53c2\u8003\u6587\u6863<\/h1>\n<p><a href=\"https:\/\/baike.baidu.com\/item\/Android%E7%BE%A4%E8%8B%B1%E4%BC%A0\/18525972?fr=ge_ala\">\u300aAndroid\u7fa4\u82f1\u4f20\u300b \u5f90\u5b9c\u751f \u7535\u5b50\u5de5\u4e1a\u51fa\u7248\u793e<\/a><br \/>\n<a href=\"https:\/\/www.cnblogs.com\/gordon0918\/p\/6732100.html\">Android Studio Xposed\u6a21\u5757\u7f16\u5199\uff08\u4e8c\uff09 -Gordon0918 - \u535a\u5ba2\u56ed<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u7f18\u8d77 \u6b63\u5982\u5404\u4f4d\u7f51\u53cb\u6240\u89c1\uff0c\u76ee\u524d\u7f51\u4e0a\u5df2\u7ecf\u6709\u8bb8\u591aXposed\u6a21\u5757\u7f16\u5199\u6559\u7a0b\uff0c\u4f46\u90fd\u662f\u57fa\u7840\u6559\u7a0b\u6216\u9488\u5bf9\u4e8e\u67d0\u4e00\u5e94\u7528\u3002\u4ecd\u9700\u6839\u636e\u6240 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,13],"tags":[4,6,5],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-android","category-13","tag-android","tag-hook","tag-xposed"],"_links":{"self":[{"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":24,"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":37,"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/posts\/9\/revisions\/37"}],"wp:attachment":[{"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.wystudio.xyz\/index.php\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}