Android之hook框架——Legend学习_legend框架

Legend是一款免root的开源框架，作者Lody，github地址：https://github.com/asLody/legend，直接下载下来就能运行。

项目包含主工程sample，library工程legendCore以及Native方法。sample中很简单，MainActivity.java中三个按钮分别实现获取sim卡iccid，弹出toast提示，调用startActivity方法，APP.java分别对这三个方法hook!

  @Hook("android.telephony.TelephonyManager::getSimSerialNumber")
    public static String TelephonyManager_getSimSerialNumber(TelephonyManager thiz) {
         return "110";
    }


    @Hook("android.widget.Toast::show")
    public static void Toast_show(Toast toast) {
        if (ENABLE_TOAST) {
            HookManager.getDefault().callSuper(toast);
        }
    }

    @Hook("android.app.Activity::startActivity@android.content.Intent")
    public static void Activity_startActivity(Activity activity, Intent intent)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

@Hook怎么使用了？来看下源码！

 public void applyHooks(Class<?> holdClass) {
        for (Method hookMethod : holdClass.getDeclaredMethods()) {
            Hook hook = hookMethod.getAnnotation(Hook.class);
            if (hook != null) {
                String statement = hook.value();
                String[] splitValues = statement.split("::");
                if (splitValues.length == 2) {
                    String className = splitValues[0];
                    String[] methodNameWithSignature = splitValues[1].split("@");
                    if (methodNameWithSignature.length <= 2) {
                        String methodName = methodNameWithSignature[0];
                        String signature = methodNameWithSignature.length == 2 ? methodNameWithSignature[1] : "";
                        String[] paramList = signature.split("#");
                        if (paramList[0].equals("")) {
                            paramList = new String[0];
                        }
                        try {
                            Class<?> clazz = Class.forName(className);
                            boolean isResolve = false;
                            for (Method method : clazz.getDeclaredMethods()) {
                                if (method.getName().equals(methodName)) {
                                    Class<?>[] types = method.getParameterTypes();
                                    if (paramList.length == types.length) {
                                        boolean isMatch = true;
                                        for (int N = 0; N < types.length; N++) {
                                            if (!types[N].getName().equals(paramList[N])) {
                                                isMatch = false;
                                                break;
                                            }
                                        }
                                        if (isMatch) {
                                            hookMethod(method, hookMethod);
                                            isResolve = true;
                                            Logger.d("[+++] %s have hooked.", method.getName());
                                        }
                                    }
                                }
                                if (isResolve) {
                                    break;
                                }
                            }
                            if (!isResolve) {
                                Logger.e("[---] Cannot resolve Method : %s.", Arrays.toString(methodNameWithSignature));
                            }
                        } catch (Throwable e) {
                            Logger.e("[---] Error to Load Hook Method From : %s." , hookMethod.getName());
                            e.printStackTrace();
                        }

                    }else {
                        Logger.e("[---] Can't split method and signature : %s.", Arrays.toString(methodNameWithSignature));
                    }
                }else {
                    Logger.e("[---] Can't understand your statement : [%s].", statement);
                }
            }
        }
    }
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

从代码逻辑看，@Hook(“具体类名：：方法名@参数类型1#参数类型2…”)。
用法搞懂了，来自定义一个方法并hook吧！！

1. 定义一个简单的login方法。

 public void login(int name,int pass){
        if(name==111&pass==222){
            Toast.makeText(this, "success", Toast.LENGTH_SHORT).show();
        }
    }
1
2
3
4
5

2. 点击button调用login

 public void onClick(View view) {
        switch (view.getId()){
            case R.id.startActivity:
                int name=111,pass=222;
                login(name,pass);
                break;
             default:
                    break;
        }
    }
1
2
3
4
5
6
7
8
9
10

3. 在APP.java中hook，打印出name和pass值

  @Hook("com.legend.demo.MainActivity::login@int#int")
    public static void MainActivity_login(MainActivity activity,int a,int b){
        Toast.makeText(activity, "参数："+a+b, Toast.LENGTH_SHORT).show();
        HookManager.getDefault().callSuper(activity,a,b);
    }
1
2
3
4
5

至此Legend框架基本使用就完成了，具体的内部如何实现的，有兴趣的可以阅读源码！！

上一篇：Android架构模式——MVVM