FakeLocation高版本悬浮窗上无法使用

一直用开fakeLocation去打卡，最近出了个某妖精游戏，记得以前有一个悬浮窗可以拨弄的（虽然到现在也不知道怎么用），就想试试，去打打鼓，但是开启后发现悬浮窗会消失，点击有时候还会crash。
Crash log大致是这样的：

WindowManager$BadTokenException: Unable to add window -- window android.view.ViewRootImpl$W@363f7b1 has already been added。

查询百度后发现Android高版本对全局窗口做了限制，防止滥用。特别是type为type toast的类型，三点五秒后会消失。 image

说个题外话，我查询52发现有另一个版本的叫fake location，是不是原作者的新作就没查证了，我使用的是如上的版本。
通过百度上面的log的关键字，就可以得出要更改type类型为system alert window。（如果有想知道是怎么回事的我这里给出一个文章link：https://www.jianshu.com/p/1445e330114b）

那么根据经验，悬浮窗一般通过addView这个函数进行添加的，那么我们通过ui的跟踪我们可以来到这个类：com.rong.xposed.fakelocation.service.f.FxService

通过搜索addView， image

有两个地方调用，那么我来讲一下，刚开始是一个定位的图标，点击后会展开，所以有两个addView 动作。
其中我们可以看到，有一个叫type的东西，高版本中会设为2005（TYPE_PHONE），所以我们现在要将这个值改为system alert window（2003）。
因为想要练手frIDA，所以那frida测试了一下

import frida, sys,io

def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

jscode = """
Java.perform(function () {
    var fxService = Java.use('com.rong.xposed.fakelocation.service.f.FxService');
    var clazz = Java.use('java.lang.Class');
    fxService.i.overload().implementation = function(){
        send('i empty args')
        Java.choose("com.rong.xposed.fakelocation.service.f.FxService", {
            onMatch: function(instance) {
                send('fxService instance:'+instance)
                var fxInstance = instance
                var fxClazz = Java.cast(fxInstance.getClass(),clazz)
                console.log(fxClazz)
                var h = fxClazz.getDeclaredField('h')
                h.setAccessible(true)
                var hInstance = h.get(fxInstance)

                var hClazz = Java.cast(hInstance.getClass(),clazz)
                console.log(hClazz)
                var type = hClazz.getDeclaredField('type')
                type.setAccessible(true)
                var typeVal = type.get(hInstance)
                console.log('before:'+typeVal)
                type.setInt(hInstance,2003)
                console.log('after:'+type.get(hInstance))
                instance.i()
            },
            onComplete: function() { }
        });
    }

    fxService.j.overload().implementation = function(){
        send('j empty args')
        Java.choose("com.rong.xposed.fakelocation.service.f.FxService", {
            onMatch: function(instance) {
                var fxInstance = instance
                var fxClazz = Java.cast(fxInstance.getClass(),clazz)
                console.log(fxClazz)
                var j = fxClazz.getDeclaredField('j')
                j.setAccessible(true)
                var jInstance = j.get(fxInstance)

                var jClazz = Java.cast(jInstance.getClass(),clazz)
                console.log(jClazz)
                var type = jClazz.getDeclaredField('type')
                type.setAccessible(true)
                var typeVal = type.get(jInstance)
                console.log('before:'+typeVal)
                type.setInt(jInstance,2003)
                console.log('after:'+type.get(jInstance))
                instance.j()
            },
            onComplete: function() { }
        });

    }

    fxService.n.overload().implementation = function(){
        send('n')
        this.n()
    }
    fxService.o.overload().implementation = function(){
        send('o')
        this.o()
    }
});
"""
# process = frida.get_usb_device().attach('com.rong.xposed.fakelocation')
# script = process.create_script(jscode)
# script.on('message', on_message)
# print('[*] Running CTF')
# script.load()
# sys.stdin.read()

device = frida.get_device_manager().enumerate_devices()[-1]
pid = device.spawn(["com.rong.xposed.fakelocation"])
session = device.attach(pid)
print("[*] Attach Application id:",pid)
device.resume(pid)
print("[*] Application onResume")
script = session.create_script(jscode)
script.on('message', on_message)
print('[*] Running CTF')
script.load()
sys.stdin.read()

xp版本：

public class Hook implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
        if (lpparam.packageName.equals("com.rong.xposed.fakelocation")) {
            final Class<?> fxServiceClass = lpparam.classLoader.loadClass("com.rong.xposed.fakelocation.service.f.FxService");
            XposedHelpers.findAndHookMethod(fxServiceClass, "m", new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    Field jField = fxServiceClass.getDeclaredField("j");
                    jField.setAccessible(true);
                    WindowManager.LayoutParams jLayoutParam = (WindowManager.LayoutParams) jField.get(param.thisObject);
                    if (jLayoutParam == null) {
                        jLayoutParam = new WindowManager.LayoutParams();
                        jLayoutParam.type = 2003;
                        jLayoutParam.format = 1;
                        jLayoutParam.flags = 8;
                        jLayoutParam.gravity = 8388659;
                        jLayoutParam.width = -2;
                        jLayoutParam.height = -2;
                        jField.set(param.thisObject, jLayoutParam);
                    }
                    super.beforeHookedMethod(param);
                }
            });
            XposedHelpers.findAndHookMethod(fxServiceClass, "l", new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    Field hField = fxServiceClass.getDeclaredField("h");
                    hField.setAccessible(true);
                    WindowManager.LayoutParams hLayoutParam = (WindowManager.LayoutParams) hField.get(param.thisObject);
                    if (hLayoutParam == null) {
                        hLayoutParam = new WindowManager.LayoutParams();
                        hLayoutParam.type = 2003;
                        hLayoutParam.format = 1;
                        hLayoutParam.flags = 8;
                        hLayoutParam.gravity = 8388659;
                        hLayoutParam.width = -2;
                        hLayoutParam.height = -2;
                        hField.set(param.thisObject, hLayoutParam);
                    }
                    super.beforeHookedMethod(param);
                }
            });
        }
    }
}

然后悬浮窗就能飘起来拉，当然，小米手机记得先去给软件悬浮窗权限！

哈哈哈哈，开开心心打开游戏，被检测到了，封了一个小时，（脸上笑嘻嘻）