Please note that GitHub no longer supports Internet Explorer versions 7 or 8.
We recommend upgrading to the latest , , or .
If you are using IE 11, make sure you .
JavaScript
Clone with SSH
Use an SSH key and passphrase from account.
Nothing to show
Nothing to show
New pull request
Latest commit
May 24, 2016
Instant Run replaces the application with a bootstrap application that
can communicate with Android Studio and dynamically exchange methods
In order to achieve this, actual classes are not stored directly in the
APK's classes.dex, but within a file called instant-run.zip in the APK.
Therefore, these classes can't be found by Xposed unless it would
simulate the same bootstrapping that takes place when the app is started.
Let's avoid the misleading ClassNotFoundException and instead print a
proper error message asking the user to disable Instant Run.
Something went wrong with that request. Please try again.
You signed in with another tab or window.
to refresh your session.
You signed out in another tab or window.
to refresh your session.1397人阅读
Android-HOOK（17）
继《》之后，编写一个小小的demo应用，刚好之前分析叉叉的游戏辅助框架(参考《》，我们是用了libsubstrate的hook框架来完成的)，这次就用XPOSED实现一下。
相关参考：
官方教程《》
看雪论坛《》，文章介绍的很详细很清晰。
准备工作：
上一篇中我们用的是“华为专用Xposed框架”，也并不是很完美，于是还是从官网上下载稳定版本的，这个要视不同手机而定。
，点下面的“Show
older versions”逐个版本安装试用，每个版本都要激活一次并重启手机，还是挺麻烦的，好在试到2.5.1版本的时候成功了！这个版本确实比“华为专用Xposed框架”要稳定完美许多，果断换用2.5.1官方版本。
实现思路：
实现接口IXposedHookLoadPackage的接口函数handleLoadPackage，判断参数包名是否是目标APK，若是则调用findAndHookMethod对目标启动类的onCreate函数进行HOOK，在afterHookedMethod函数中动态加载插件，将参数中有关activity的实例传给插件。
一个 XposedModule 本质上是设定了部分特殊元数据标志位的普通应用程序，需要在&AndroidManifest.xml 文件中添加如下设置：&
AndroidManifest.xml =& Application =& Application Nodes (at the bottom) =& Add =& Meta Data
添加节点：name = xposedmodule，value = true。name = xposedminiversion, value = API level。
&application&android:allowBackup=&true&android:icon=&@drawable/ic_launcher&android:label=&@string/app_name&&android:theme=&@style/AppTheme&android:name=&.MainApplication&&&&!--&Xposed&--&&&meta-dataandroid:name=&xposedmodule&&android:value=&true&&/&&&meta-dataandroid:name=&xposedminversion&&android:value=&42+&&/&&&meta-data&android:name=&xposeddescription&android:value=&GameAssistant&&/&&&activityandroid:name=&com.netease.ga.view.MainActivity&android:theme=&@android:style/Theme.NoTitleBar.Fullscreen&&&intent-filter&&&actionandroid:name=&android.intent.action.MAIN&&/&&&categoryandroid:name=&android.intent.category.LAUNCHER&&/&&&/intent-filter&&&/activity&&&activityandroid:name=&.view.MyGamesActivity&android:theme=&@android:style/Theme.NoTitleBar.Fullscreen&/&&activity&android:name=&.view.PluginsActivity&&/&&&activityandroid:name=&.view.MoreActivity&&/&&&receiverandroid:name=&.receiver.MyReceiver&&/&&&/application&
添加标记的作用估计是让XPOSED安装器识别为插件。
添加库文件：XposedBridgeApi.jar
需要注意的是这个jar包不能放到工程的libs目录，否则运行会出现异常。最好是放到工程主目录下，然后在eclipse里右键选择该jar-Build
Path =& Add to Build Path。
注意这个jar包版本选择，经测试XposedBridgeApi-54.jar在2.5.1版本的xposedinstaller下是兼容的，但是最新版的靠谱助手（2.5.1143）上默认集成安装了2.6.1版本的xposedinstaller，测试发现XposedBridgeApi-54.jar并不是很稳定，后来改用XposedBridgeApi-42.jar是可以的。
Next, make the XposedBridge API known to the project. You can downloadXposedBridgeApi-&version&.jar&from
the first post of&. Copy it into a subfolder called&lib.
Then right-click on it and select Build Path =& Add to Build Path. The&&version&&from
the file name is the one you insert asxposedminversion&in
the manifest.
Make sure that the API classes are not included (but only referenced) in your compiled APK, otherwise you will get an&IllegalAccessError.
Files in thelibs&(with &s&) folder are automatically included by Eclipse, so don't put the API file there.
这个设置对应到androidstudio的操作步骤：
F4打开工程结构，选择Modules-当前项目-Dependencies-+-选择“Jar or directiories”，
选择jar包后，在“Scope”栏选择“Provided”，不要选择“Complie”。
然后声明一个类XposedXXHook实现接口IXposedHookLoadPackage
在 assets 目录下新建一个 xposed_init 文件，这个文件声明了需要加载到 XposedInstaller&的入口类：com.netease.ga.XposedXXHook
由于改动不大，因此直接在原来的GA工程（基于libsubstrate的叉叉游戏辅助框架）上添加。
完善XposedXXHook的代码：
package&com.netease.&import&android.app.A&import&android.content.Cimport&android.content.SharedP&import&android.os.B&importandroid.os.B&import&android.util.L&import&java.lang.reflect.M&importdalvik.system.DexClassL&import&de.robv.android.xposed.IXposedHookLoadPimport&de.robv.android.xposed.XC_MethodH&importde.robv.android.xposed.callbacks.XC_LoadP&import&staticde.robv.android.xposed.XposedHelpers.findAndHookM&import&staticde.robv.android.xposed.XposedHelpers.findC&/**&* Created by sing on 14-9-17. * desc:&*/&public&class&XposedXXHook&implements&IXposedHookLoadPackage {&private&staticfinal&String TAG = &XposedXXHook&;&private&static&final&String TARGET_PACKAGE = &com.example.helloapplication&;&private&static&final&String TARGET_CLASS = &com.example.helloapplication.MainActivity&;&private&static&final&String TARGET_FUNCTION = &onCreate&;&//private SharedP&/**&* *&@param&param *@throws&Throwable&*/&@Override&public&voidhandleLoadPackage(XC_LoadPackage.LoadPackageParam param)&throws&Throwable { String packageName&=&param.packageN Log.d(TAG,&&handleLoadPackage: & +&packageName);&if(packageName.equals(TARGET_PACKAGE) ==&false) {&return; } Log.d(TAG,&handleLoadPackage: star hook&); XC_MethodHook.Unhook unhook&= findAndHookMethod(TARGET_CLASS, param.classLoader, TARGET_FUNCTION, Bundle.class,&newXC_MethodHook() { @Override&protected&void&beforeHookedMethod(MethodHookParam param)throws&Throwable { Log.d(TAG,&&[handleLoadPackage]beforeHookedMethod&); } @Overrideprotected&void&afterHookedMethod(MethodHookParam param)&throws&Throwable { Log.d(TAG,&[handleLoadPackage]afterHookedMethod: & +&param.thisObject.toString()); String plugApkPath&= &/data/data/com.netease.ga/app_plugin/lianmengplug.apk&; String plugSoPath&= &/data/data/com.netease.ga/app_plugin/libxxlianmeng_mm.so&; String dexOutputDir&= &/data/data/& + TARGET_PACKAGE + &/cache&; ClassLoader localClassLoader&=&ClassLoader.getSystemClassLoader(); DexClassLoader localDexClassLoader&=&new&DexClassLoader(plugApkPath, dexOutputDir,&null, localClassLoader); java.lang.Class&?& plugClass = localDexClassLoader.loadClass(&com.xxAssistant.UI.UniversalUI&); Method mInit&= plugClass.getDeclaredMethod(&init&, Activity.class, String.class); mInit.invoke(null, param.thisObject, plugSoPath); } });&if&(unhook!=null) { Log.d(TAG,&handleLoadPackage: hook ok&); }else{ Log.d(TAG,&&handleLoadPackage: hook failed&); } } }
注意这段代码只HOOK包名为com.example.helloapplication的应用程序，如果要HOOK其他应用程序则把包名过滤的判断去掉，并动态解析应用程序的主启动类即可。
编译安装好后在xposed安装器的模块中激活GA并重启手机。
启动手机后不用运行xposed安装器和GA，直接运行helloapplication程序：
可以看出插件已经被我们成功加载了。
常见错误：
09-17 07:58:42.049: I/Xposed(2447): java.lang.NoSuchMethodError: com.example.helloapplication.MainActivity#onCreate()#exact
错误为未找到对应的函数，在hook的时候需要指定函数的参数形式。
findAndHookMethod(TARGET_CLASS, param.classLoader, TARGET_FUNCTION,&newXC_MethodHook(){...});
因为onCreate是有参数的，所以正确的调用方式是：
findAndHookMethod(TARGET_CLASS, param.classLoader, TARGET_FUNCTION, Bundle.class,&newXC_MethodHook(){...});
xposed与libsubstrate的对比：
测试都需要经过反复的重启，此次xposed的测试demo也是如是，即便写的只是java层代码，也需要每次改动都要重启手机。而之前用libsubstrate实现的底层hook，在每次改动JNI代码后也是需要重启手机的。
代码量方面还是xposed框架下少很多，而且都是java层代码，写起来速度也快不容易出错，测试的时间自然也少很多。
参考知识库
* 以上用户言论只代表其个人观点，不代表CSDN网站的观点或立场
访问：528485次
积分：6206
积分：6206
排名：第2574名
原创：223篇
转载：112篇
评论：118条
(1)(4)(14)(7)(43)(21)(41)(4)(7)(5)(4)(13)(28)(2)(3)(4)(3)(3)(6)(4)(36)(27)(13)(2)(12)(16)(16)xposed开发经验分享-hook imsi、imei等参数
xposed开发经验分享-hook imsi、imei等参数
围观5156次
编辑日期： 字体：
网上有很多基于xposed的修改系统参数的收费软件，归根结底，还是hook住相关相关类的相关方法。（有错之处还望指教）
首先新建一个类，例如Hookphone，注意这个类要在assets/xposed_init 按照全部路径填写（例如：com.xiaobai.hookphoneinfo.HookPhone）
//实现一个接口IXposedHookLoadPackage
public class HookPhone implements IXposedHookLoadPackage
接着按照错误提示添加下面未实现的方法
LoadPackageParam lpparam 类
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
//这里填写hook的方法
hookPhoneinfo(lpparam);
LoadPackageParam 找到相关类
public static class LoadPackageParam extends XCallback.Param {
public LoadPackageParam(CopyOnWriteSortedSet callbacks) {
super(callbacks);
/** 加载包的名称 */
public String packageN
/** The process in which the package is executed */
public String processN
/** 此包中使用的类加载器 */
public ClassLoader classL
/**关于要加载应用程序的更多信息*/
public ApplicationInfo appI
/**，如果这是这个过程中的第一个（主）的应用 ，设置为true */
public boolean isFirstA
这里可以获取已经加载包的packageName、processName、classLoader、appInfo、isFirstApplication，
下面开始hook方法（解释LoadPackageParam这个并非所要hook类所在的报名，如果要hook某一确定包名的相关方法，可以用LoadPackageParam.packageName来判断下）
private void hookPhoneinfo(final LoadPackageParam lpparam) {
findAndHookMethod(TelephonyManager.class.getName(),lpparam.classLoader, "getDeviceId", new XC_MethodHook() {// 第一个参数要hook的类名，第二个参数固定lpparam.classLoader，第三个方法名，第四个固定
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
// TODO 自动生成的方法存根
super.afterHookedMethod(param);
param.setResult("这里填写imei");//setResult 表示修改原方法的返回值
其中MethodHookParam中有很多方法 不仅仅可以设置返回值还可以 设置hook方法的参数（如：param.args[0]=1;），获取原方法的返回值param.getResult();等等参数，可以阅读de.robv.android.xposed.MethodHookParam中的相关方法和参数，有相关注释。
上面提供一个简单的小例子，下面提供相关代码(代码并不完整，仅作参考)
package com.xiaobai.
import static de.robv.android.xposed.XposedHelpers.findAndHookM
import android.net.wifi.WifiI
import android.telephony.TelephonyM
import de.robv.android.xposed.IXposedHookLoadP
import de.robv.android.xposed.XC_MethodH
import de.robv.android.xposed.XposedB
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageP
public class HookPhone implements IXposedHookLoadPackage {
/* (non-Javadoc)
* @see de.robv.android.xposed.IXposedHookLoadPackage#handleLoadPackage(de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam)
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
// TODO 自动生成的方法存根
XposedBridge.log("hook phoneinfo");
hookPhoneinfo(lpparam);
* @param lpparam
private void hookPhoneinfo(final LoadPackageParam lpparam) {
// TODO Auto-generated method stub
XposedBridge.log("包名："+lpparam.packageName+"调用");
findAndHookMethod(WifiInfo.class.getName(),lpparam.classLoader,
"getMacAddress",new XC_MethodHook() {
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
// TODO 自动生成的方法存根
super.afterHookedMethod(param);
XposedBridge.log("包名："+lpparam.packageName+"调用");
MainActivity save = new MainActivity();
XposedBridge.log("开始hook mac地址");
param.setResult(save.getmac());
findAndHookMethod(TelephonyManager.class.getName(),
lpparam.classLoader, "getDeviceId", new XC_MethodHook() {
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
// TODO 自动生成的方法存根
super.afterHookedMethod(param);
MainActivity save = new MainActivity();
XposedBridge.log("开始hook imsi");
param.setResult(save.getimsi());
findAndHookMethod(TelephonyManager.class.getName(),
lpparam.classLoader, "getSubscriberId", new XC_MethodHook() {
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
// TODO 自动生成的方法存根
super.afterHookedMethod(param)
MainActivity save = new MainActivity();
XposedBridge.log("开始hook imei");
param.setResult(save.getimei());
findAndHookMethod(TelephonyManager.class.getName(),
lpparam.classLoader, "getSimState", new XC_MethodHook() {
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
// TODO 自动生成的方法存根
super.afterHookedMethod(param);
XposedBridge.log("开始hook SimState");
param.setResult((int) 5);
findAndHookMethod(TelephonyManager.class.getName(),
lpparam.classLoader, "getSimOperator", new XC_MethodHook() {
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
// TODO 自动生成的方法存根
super.afterHookedMethod(param);
MainActivity save = new MainActivity();
XposedBridge.log("开始hook SimOperator");
param.setResult(save.getOperator());
findAndHookMethod(TelephonyManager.class.getName(),
lpparam.classLoader, "getLine1Number", new XC_MethodHook() {
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
// TODO 自动生成的方法存根
super.afterHookedMethod(param);
MainActivity save = new MainActivity();
XposedBridge.log("开始hook getLine1Number");
param.setResult(save.gettelnum());
本文固定链接:
转载请注明: 本文不用做任何商业用途。
作者：xiaobai
这个作者貌似有点懒，什么都没有留下。
您可能还会对这些文章感兴趣！xposed开发指南1
Development tutorial
Alright.. you want to learn how you can create a new module for
Xposed? Then read this tutorial (or let's rather call it "extensive
essay") and learn how to approach this. This includes not only the
technical "create this file and insert ...", but also the thinking
behind it, which is the step where value is created and for which
you really need to understand what you do and why. If you feel like
"TL;DR", you can just look at the final source code and read the
"" chapter. But you will get a
better understanding if you read the whole tutorial. You will save
the time spent for reading this later because you don't have to
figure everything out yourself.
The modification
You will recreate the red clock example that can be found
well. It includes changing the color of the status bar clock to red
and adding a smiley. I'm choosing this example because it is a
rather small, but easily visible change. Also, it uses some of the
basic methods provided by the framework.
How Xposed works
Before beginning with your modification, you should get a rough
idea how Xposed works (you might skip this section though if you
feel too bored). Here is how:
There is a process that is called "Zygote". This is the heart of
the Android runtime. Every application is started as a copy
("fork") of it. This process is started by
an&/init.rc&script
when the phone is booted. The process start is done
with&/system/bin/app_process,
which loads the needed classes and invokes the initialization
This is where Xposed comes into play. When you install the
framework, an&executable is copied
to&/system/bin.
This extended startup process adds an additional jar to the
classpath and calls methods from there at certain places. For
instance, just after the VM has been created, even before
the&main&method
of Zygote has been called. And inside that method, we are part of
Zygote and can act in its context.
The jar is located at&/data/data/de.robv.android.xposed.installer/bin/XposedBridge.jar&and
its source code can be found&. Looking at the
you can see the&mainmethod.
This is what I wrote about above, this gets called in the very
beginning of the process. Some initializations are done there and
also the modules are loaded (I will come back to module loading
hooking/replacing
What really creates the power of Xposed is the possibility to
"hook" method calls. When you do a modification by decompiling an
APK, you can insert/change commands directly wherever you want.
However, you will need to recompile/sign the APK afterwards and you
can only distribute the whole package. With the hooks you can place
with Xposed, you can't modify the code inside methods (it would be
impossible to define clearly what kind of changes you want to do in
which place). Instead, you can inject your own code before and
after methods, which are the smallest unit in Java that can be
addressed clearly.
XposedBridge has a private, native
method&hookMethodNative.
This method is implemented in the
extended&app_process&as
well. It will change the method type to "native" and link the
method implementation to its own native, generic method. That means
that every time the hooked method is called, the generic method
will be called instead without the caller knowing about it. In this
method, the method&handleHookedMethod&in
XposedBridge is called, passing over the arguments to the method
call, the&this&reference
etc. And this method then takes care of invoking callbacks that
have been registered for this method call. Those can change the
arguments for the call, change instance/static variables, invoke
other methods, do something with the result... or skip anything of
that. It is very flexible.
Ok, enough theory. Let's create a module now!
Creating the project
A module is normal app, just with some special meta data and files.
So begin with creating a new Android project. I assume you have
already done this before. If not, the&&is quite detailed. When asked
for the SDK, I chose 4.0.3 (API 15). I suggest you try this as well
and do not start experiments yet. You don't need to create an
activity because the modification does not have any user-interface.
After answering that question, you should have a blank project.
Making the
project an Xposed module
Now let's turn the project into something loaded by Xposed, a
module. Several steps are required for this.
AndroidManifest.xml
The module list in the Xposed Installer looks for applications with
a special meta data flag. You can create it by going to
AndroidManifest.xml =& Application =& Application Nodes (at
the bottom) =& Add =& Meta Data. The name should
be&xposedmodule&and
the value&true.
Leave the resource empty. Then repeat the same
for&xposedminversion&(see
below) and&xposeddescription&(a
very short description of your module). The XML source will now
look like this:
& & package="de.robv.android.xposed.mods.tutorial"
& & android:versionCode="1"
& & android:versionName="1.0" &
& & & & android:icon="@drawable/ic_launcher"
& & & & android:label="@string/app_name" &
& & & & & & android:name="xposedmodule"
& & & & & & android:value="true" /&
& & & & & & android:name="xposeddescription"
& & & & & & android:value="Easy example which makes the status bar clock red and adds a smiley" /&
& & & & & & android:name="xposedminversion"
& & & & & & android:value="30" /&
XposedBridgeApi.jar
Next, make the XposedBridge API known to the project. You can
download&XposedBridgeApi-.jar&from
the first post of&. Copy it into a subfolder
called&lib.
Then right-click on it and select Build Path =& Add to Build
Path. The&&from the file name is
the one you insert as&xposedminversion&in
the manifest.
sure that the API classes are not included (but only referenced) in
your compiled APK, otherwise you will get
an&IllegalAccessError.
Files in the&libs&(with
"s") folder are automatically included by Eclipse, so don't put the
API file there.
Module implementation
Now you can create a class for your module. Mine is named
"Tutorial" and is in the packagede.robv.android.xposed.mods.tutorial:
package de.robv.android.xposed.mods.tutorial;
public class Tutorial {
For the first step, we will just do some logging to show that the
module was loaded. A module can have a few entry points. Which
one(s) you choose depends on the what you want to modify. You can
have Xposed call a function in your module when the Android system
boots, when a new app is about to be loaded, when the resources for
an app are initialised and so on.
A bit further down this tutorial, you will learn that the necessary
changes need to be done in one specific app, so let's go with the
"let me know when a new app is loaded" entry point. All entry
points are marked with a sub-interface of IXposedMod. In this case,
it's IXposedHookLoadPackage which you need to implement. It's
actually just one method with one parameter that gives more
information about the context to the implementing module. In our
example, let's log the name of the loaded app:
package de.robv.android.xposed.mods.
import de.robv.android.xposed.IXposedHookLoadP
import de.robv.android.xposed.XposedB
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageP
public class Tutorial implements IXposedHookLoadPackage {
& & public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
& & & & XposedBridge.log("Loaded app: " + lpparam.packageName);
This log method writes the message to the standard logcat
(tag&Xposed)
and to /data/data/de.robv.android.xposed.installer/log/debug.log`
(which is easily accessible via the Xposed Installer).
assets/xposed_init
The only thing that is still missing now is a hint for XposedBridge
which classes contain such entry points. This is done via a file
called&xposed_init.
Create a new text file with that name in theassets&folder.
In this file, each line contains one fully qualified class name. In
this case, this isde.robv.android.xposed.mods.tutorial.Tutorial.
Trying it out
Save your files. Then run your project as Android application. As
this is the first time you install it, you need to enable it before
you can use it. Open the Xposed Installer app and make sure you
have installed the framework. Then go to the "Modules" tab. You
should find your app in there. Check the box to enable it. Then
reboot. You will not see a difference of course, but if you check
the log, you should see something like this:
Loading Xposed (for Zygote)...
Loading modules from /data/app/de.robv.android.xposed.mods.tutorial-1.apk
Loading class de.robv.android.xposed.mods.tutorial.Tutorial
Loaded app: com.android.systemui
Loaded app: com.android.settings
... (many more apps follow)
Voil&! That worked. You now have an Xposed module. It could just be
a bit more useful than writing logs...
Exploring your target and finding a way to modify it
Ok, so now begins the part that can be very different depending on
what you want to do. If you have modded APKs before, you probably
know how to think here. In general, you first need to get some
details about the implementation of the target. In this tutorial,
the target is the clock in the statusbar. It helps to know that the
statusbar and lots of other things are part of the SystemUI. So
let's begin our search there.
Possibility one: Decompile it. This will give you the exact
implementation, but it is hard to read and understand because you
get smali format. Possibility two: Get the AOSP sources
(e.g.&&or&and
look there. This can be quite different from your ROM, but in this
case it is a similar or even the same implementation. I would look
at AOSP first and see if that is enough. If I need more details,
look at the actual decompiled code.
You can look for classes with "clock" in their name or containing
that string. Other things to look for are resources and layout
used. If you downloaded the official AOSP code, you can start
looking inframeworks/base/packages/SystemUI.
You will find quite a few places where "clock" appears. This is
normal and indeed there will be different ways to implement a
modification. Keep in mind that you can "only" hook methods. So you
have to find a place where you can insert some code to do the magic
either before, after or replacing a method. You should hook methods
that are as specific as possible, not ones that are called
thousands of times to avoid performance issues and unintended
side-effects.
In this case, you might find that the
layout&res/layout/status_bar.xml&contains
a reference to a custom view with the
class&com.android.systemui.statusbar.policy.Clock.
Multiple ideas might come to your mind now. The text color is
defined via a&textAppearance&attribute,
so the cleanest way to change it would be to change the appearance
definition. However, the this is not possible to change styles with
the Xposed framework and probably won't be (it's too deep in native
code). Replacing the layout for the statusbar would be possible,
but an overkill for the small change you are trying to make.
Instead, look at this class. There is a method
called&updateClock,
which seems to be called every minute to update the time:
final void updateClock() {
mCalendar.setTimeInMillis(System.currentTimeMillis());
setText(getSmallTime());
That looks perfect for modifications because it is a very specific
method which seems to be the only means of setting the text for the
clock. If we add something after every call to this method that
changes the color and the text of the clock, that should work. So
let's do it.
the text color alone, there is an even better way. See the example
for "Modifying layouts" on "".
reflection to find and hook a method
What do we already know? We have a
method&updateClock&in
classcom.android.systemui.statusbar.policy.Clock&that
we want to intercept. We found this class inside the SystemUI
sources, so it will only be available in the process for the
SystemUI. Some other classes belong to the framework and are
available everywhere. If we tried to get any information and
references to this class directly in
the&handleLoadPackage&mehod,
this would fail because it is the wrong process. So let's implement
a condition to execute certain code only when a specified package
is about to be loaded:
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
if (!lpparam.packageName.equals("com.android.systemui"))
XposedBridge.log("we are in SystemUI!");
Using the parameter, we can easily check if we are in the correct
package. Once we verified that, we get access to the classes in
that packages with the ClassLoader which is also referenced from
this variable. Now we can look for
the&com.android.systemui.statusbar.policy.Clock&class
and itsupdateClock&method
and tell XposedBridge to hook it:
package de.robv.android.xposed.mods.
import static de.robv.android.xposed.XposedHelpers.findAndHookM
import de.robv.android.xposed.IXposedHookLoadP
import de.robv.android.xposed.XC_MethodH
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageP
public class Tutorial implements IXposedHookLoadPackage {
& & public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
& & & & if (!lpparam.packageName.equals("com.android.systemui"))
& & & & & &
& & & & findAndHookMethod("com.android.systemui.statusbar.policy.Clock", lpparam.classLoader, "updateClock", new XC_MethodHook() {
& & & & & & @Override
& & & & & & protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
& & & & & & & & // this will be called before the clock was updated by the original method
& & & & & & }
& & & & & & @Override
& & & & & & protected void afterHookedMethod(MethodHookParam param) throws Throwable {
& & & & & & & & // this will be called after the clock was updated by the original method
& & & & & & }
findAndHookMethod&is
a&&function.
Note the static import, which is automatically added if you
configure it as described in the linked page. This method looks up
the&Clock&class
using the ClassLoader for the SystemUI package. Then it looks for
the&updateClock&method
in it. If there were any parameters to this method, you would have
to list the types (classes) of these parameters afterwards. There
are different ways to do this, but as our method doesn't have any
parameters, let's skip this for now. As the last argument, you need
to provide an implementation of the&XC_MethodHook&class.
For smaller modifications, you can use a anonymous class. If you
have much code, it's better to create a normal class and only
create the instance here. The helper will then do everything
necessary to hook the method as described above.
There are two methods in&XC_MethodHook&that
you can override. You can override both or even none, but the
latter makes absolutely no sense. These methods
are&beforeHookedMethod&andafterHookedMethod.
It's not too hard to guess that the are executed before/after the
original method. You can use the "before" method to
evaluate/manipulate the parameters of the method call
(via&param.args)
and even prevent the call to the original method (sending your own
result). The "after" method can be used to do something based on
the result of the original method. You can also manipulate the
result at this point. And of course, you can add your own code
which should be executed exactly before/after the method call.
you want to replace a method completely, have a look at the
subclassXC_MethodReplacement&instead,
where you just need to override&replaceHookedMethod.
XposedBridge keeps a list of registered callbacks for each hooked
method. Those with highest priority (as defined in hookMethod) are
called first. The original method has always the lowest priority.
So if you have hooked a method with callbacks A (prio high) and B
(prio default), then whenever the hooked method is called, the
control flow will be this: A.before -& B.before -& original
method -& B.after -& A.after. So A could influence the
arguments B gets to see, which could further change them before
passing them on. The result of the original method can be processed
by B first, but A has the final word what the original caller
Final steps: Execute your own code before/after the method
Alright, you have now a method that is called every time
the&updateClock&method
is called, with exactly that context (i.e. you're in the SystemUI
process). Now let's modify something.
First thing to check: Do we have a reference to the concrete Clock
object? Yes we have, it's in theparam.thisObject&parameter.
So if the method was called with&myClock.updateClock(),
thenparam.thisObject&would
be&myClock.
Next: What can we do with the clock?
The&Clock&class
is not available, you can't castparam.thisObject&to
class (don't even try to). However it inherits
from&TextView.
So you can use methods like&setText,&getText&and&setTextColor&once
you have casted the&Clock&reference
toTextView.
The changes should be done after the original method has set the
new time. As there is nothing to do before the method call, we can
leave out the&beforeHookedMethod.
Calling the (empty) "super" method is not necessary.
So here is the complete source code:
package de.robv.android.xposed.mods.
import static de.robv.android.xposed.XposedHelpers.findAndHookM
import android.graphics.C
import android.widget.TextV
import de.robv.android.xposed.IXposedHookLoadP
import de.robv.android.xposed.XC_MethodH
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageP
public class Tutorial implements IXposedHookLoadPackage {
& & public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
& & & & if (!lpparam.packageName.equals("com.android.systemui"))
& & & & & &
& & & & findAndHookMethod("com.android.systemui.statusbar.policy.Clock", lpparam.classLoader, "updateClock", new XC_MethodHook() {
& & & & & & @Override
& & & & & & protected void afterHookedMethod(MethodHookParam param) throws Throwable {
& & & & & & & & TextView tv = (TextView) param.thisO
& & & & & & & & String text = tv.getText().toString();
& & & & & & & & tv.setText(text + " :)");
& & & & & & & & tv.setTextColor(Color.RED);
& & & & & & }
& & & & });
Be happy about the
Now install/start your app again. As you have already enabled it in
the Xposed Installer when you started it the first time, you do not
need to do that again, rebooting is enough. However, you will want
to disable the red clock example if you were using it. Both use the
default priority for theirupdateClock&handler,
so you cannot know which one will win (it actually depends on the
string representation of the handler method, but don't rely on
Conclusion
I know that this tutorial was very long. But I hope you can now not
only implement a green clock, but also something completely
different. Finding good methods to hook is a matter of experience,
so start with something rather easy. Try using
the&log&functions
a lot in the beginning to make sure that everything is called when
you expect it. And now: Have fun!
已投稿到：
以上网友发言只代表其个人观点，不代表新浪网的观点或立场。