Question

我需要为Xposed制作“Hello world”应用程序。我试图用Xposed改变IMEI。它挂钩的一些方法，有些没有。问题是如何将它们全部挂钩？

我制作的测试应用程序从TelephonyManager获取IMEI并显示：

    telephonyManager = (TelephonyManager)getSystemService(Context.TELEPHONY_SERVICE);
    tv.setText(telephonyManager.getDeviceId());

比我写方法来替换方法：

private void replaceImei(final XC_LoadPackage.LoadPackageParam loadPackageParam,
                         final String className,
                         final String methodName)
{
    try {
        XC_MethodHook.Unhook u =
                XposedHelpers.findAndHookMethod(
                        className,
                        loadPackageParam.classLoader,
                        methodName,
                        new XC_MethodReplacement() {
                            @Override
                            protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                                XposedBridge.log("happy replaced " + methodHookParam.method.getName()
                                        + " at " + methodHookParam.method.getDeclaringClass().getName());
                                return "123456789012345";
                            }
                        }
                );

        if (u != null) {
            XposedBridge.log("happy hooked " + u.getHookedMethod().getName() + " "
                    + u.getHookedMethod().getDeclaringClass().getCanonicalName());
        }
    } catch (Exception e) {
        XposedBridge.log("happy error " + e.getMessage());
        e.printStackTrace();
    }
}

并使用它：

@Override
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {

    XposedBridge.log("happy loaded app: " + loadPackageParam.packageName);

    replaceImei(loadPackageParam,
            "android.telephony.TelephonyManager",
            "getDeviceId");
}

有效！

但是当我在Settings应用程序上查看IMEI时，它保持不变。好的，我使用了Settings应用的APK，通过apktool提取了来源并找到了以下内容：

.line 86
const-string v1, "imei"

invoke-interface {v0}, Lcom/android/internal/telephony/Phone;->getImei()Ljava/lang/String;

move-result-object v2

invoke-direct {p0, v1, v2}, Lcom/android/settings/deviceinfo/ImeiInformation;->setSummaryText(Ljava/lang/String;Ljava/lang/String;)V

因此，它使用getImei()接口中的com.android.internal.telephony.Phone方法。因为挂钩接口的方法是不可能的，所以我找到了in sources这个接口的所有实现：

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneProxy",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneBase",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.gsm.GSMPhone",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.imsphone.ImsPhone",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.cdma.CDMAPhone",
            "getImei");

日志记录了设置应用中getImea()中的PhoneProxy被挂钩（请查看上面的来源）：

I/Xposed  ( 6800): happy loaded app: com.android.settings
I/Xposed  ( 6800): happy hooked getDeviceId android.telephony.TelephonyManager
I/Xposed  ( 6800): happy hooked getImei com.android.internal.telephony.PhoneProxy

但没有任何反应，设置中的IMEI没有变化。当然，我安装了应用程序，并在每次迭代时重新启动手机。

好吧，我试图强行执行这项任务：我找到了其他一些方法并将它们连接起来。但它没有帮助。

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.gsm.GSMPhone",
            "getPhoneId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.imsphone.ImsPhone",
            "getPhoneId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.cdma.CDMAPhone",
            "getPhoneId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoController",
            "getDeviceId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoController",
            "getImeiForSubscriber");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoController",
            "getDeviceIdForPhone");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfo",
            "getDeviceId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfo",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoProxy",
            "getImeiForSubscriber");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoProxy",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneBase",
            "getPhoneId");

有什么想法吗？怎么了？怎么办？

所有实验均在使用Android 5.1.1的Nexus 4上进行。

此问题的完整来源是：https://gist.github.com/tseglevskiy/d100898468b286e1fff214778c9609b3

更新1

实验的下一部分。我发现通过实现IXposedHookZygoteInit接口可以在Zygote的早期阶段挂钩一些方法。好的，我做到了：

private void replaceImeiInitZygote(final String className,
                                   final String methodName)
{
    try {
        final Class<?> foundClass = XposedHelpers.findClass(className, null);

        if (foundClass != null) {
            XC_MethodHook.Unhook u = XposedHelpers.findAndHookMethod(foundClass, methodName,

                    new XC_MethodReplacement() {
                        @Override
                        protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                            XposedBridge.log("happy replaced " + methodHookParam.method.getName()
                                    + " at " + methodHookParam.method.getDeclaringClass().getName());
                            return "123456789099999";
                        }
                    });

            if (u != null) {
                XposedBridge.log("happy hooked from initZygote " + u.getHookedMethod().getName() + " "
                        + u.getHookedMethod().getDeclaringClass().getCanonicalName());
            }
        }
    } catch (Exception e) {
        XposedBridge.log("happy error " + e.getMessage());
        e.printStackTrace();
    }
}

并使用它：

@Override
public void initZygote(StartupParam startupParam) throws Throwable {
    replaceImeiInitZygote(
            "android.telephony.TelephonyManager",
            "getDeviceId");

    replaceImeiInitZygote(
            "com.android.internal.telephony.PhoneProxy",
            "getImei");

    replaceImeiInitZygote(
            "com.android.internal.telephony.PhoneBase",
            "getImei");

    replaceImeiInitZygote(
            "com.android.internal.telephony.gsm.GSMPhone",
            "getImei");

    replaceImeiInitZygote(
            "com.android.internal.telephony.imsphone.ImsPhone",
            "getImei");

    replaceImeiInitZygote(
            "com.android.internal.telephony.cdma.CDMAPhone",
            "getImei");

}

通过日志，它挂钩了一些方法：

I/Xposed  (  198): happy hooked from initZygote getDeviceId android.telephony.TelephonyManager
I/Xposed  (  198): happy hooked from initZygote getImei com.android.internal.telephony.PhoneProxy

但是ID也不会在“设置”应用中更改IMEI。怎么了？

Answer 1

嗯，你几乎做到了！您试图挂钩getImei（），但实际上它从未被系统调用。使用getDeviceId（）代替它，它返回相同的数据。

要在设置中更改IMEI，请尝试使用此代码段，它就像魅力一样：

findAndHookMethod(
        "com.android.internal.telephony.gsm.GSMPhone",
        lpparam.classLoader,
        "getDeviceId",
        new XC_MethodReplacement() {
            @Override
            protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
                XposedBridge.log("NEW IMEI!!! com.android.internal.telephony.gsm.GSMPhone.getDeviceId()");
                return "111111111111111";
            }
        }
);

顺便说一下，你也可以挂钩这些方法：

com.android.internal.telephony.PhoneSubInfo.getDeviceId()
com.android.internal.telephony.gsm.GSMPhone.getDeviceId()
com.android.internal.telephony.cdma.CDMAPhone.getDeviceId()
com.android.internal.telephony.imsphone.ImsPhone.getDeviceId()
com.android.internal.telephony.sip.SipPhone.getDeviceId()

干杯！

Xposed不会挂钩该方法

1 个答案: