资源和环境

Android studio
XposedBridgeApi-54.jar
Xposed 框架 
Oppo R7 Android4.4

例子APK 提取码: uba5。

Android studio主题下载，配置->xxx.jar(删掉空格)->选择File—>Import Settings—>把刚才下载好的jar包导入->重启Android Studio

Java层hook编写

程序目录结构如图

1.png

创建一个no Avtivty项目,将下载的->XposedBridgeApi-54.jar ，将XposedBridgeApi-54.jar放入app->libs里面，直接右键Add As Library，也就是在build.gradle中生成了。

1、接着在main->创建一个assets目录并在之下创建xposed_init(声明xposed入口)

ese.javahook.JavaXposed //包名+类名

2、在main下面的AndroidMainfest.xml中的application下添加(自己标识为一个Xposed模块)

<meta-data
    android:name="xposedmodule"
    android:value="true" />
<meta-data
    android:name="xposeddescription"
    android:value="JavaXposed" /> 
<meta-data
    android:name="xposedminversion"
    android:value="54" />

3、写一个Xposed模块入口JavaXposed.java

package ese.javahook;

/**
 * Created by ESE on 2019/1/19.
 */

import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

public class JavaXposed  implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
        String pagName = "ese.xposedtest";

//        Log.d("JavaXposed",loadPackageParam.packageName);
        if(loadPackageParam.packageName.equals(pagName)) {

            Log.d("JavaXposed","inHook" );

            //hook 外部类
            String classz = "ese.xposedtest.MainActivity";

            String MethodName1 = "OutClass";
            //OutClass
            Class clazz = loadPackageParam.classLoader.loadClass(classz);
            XposedHelpers.findAndHookMethod(clazz, MethodName1, new XC_MethodReplacement() {
                @Override
                protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                    return "hook outclass"; //暴力替换函数
                }
            });

            //hook 内部类
            XposedHelpers.findAndHookMethod("ese.xposedtest.MainActivity$inClasse",
                    loadPackageParam.classLoader, //
                    "formInclass", //formInclass
                    int.class,String.class,
                    new XC_MethodHook(){
                        @Override
                        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                            param.args[0] = 2;
                            param.args[1] = "hooray";
                        }

                        @Override
                        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                            String res = (String) param.getResult();
                            Log.d("JavaXposed","afterHookedMethod:--->"+res);

                            super.afterHookedMethod(param);
                            param.setResult("hook hooray3");
                        }
                    });
        }
    }

}

4、修改依赖app-->build.gradle -->dependencies

image.png

5、关闭instant run功能(File->Settings->Build,Execution,Deployment-->instant run->去掉打钩)
6、编译，运行----->将xopsed打钩，重启xposed框架(这是无界面的apk，不会有图标，在Xposed里有模块)
如果编译出现--->Default Activity not found解决

4、So层hook编写

待续