Xposed不挂钩的方法

Question

我需要做一个“你好世界”的应用程序。我试着用X的方法改变IMEI。有些方法是上钩的，有些则不是。问题是如何将它们全部连接起来？

我制作了一个测试应用程序，它从TelephonyManager中获取IMEI并显示出来：

    telephonyManager = (TelephonyManager)getSystemService(Context.TELEPHONY_SERVICE);
    tv.setText(telephonyManager.getDeviceId());

而不是我编写的方法来替换该方法：

private void replaceImei(final XC_LoadPackage.LoadPackageParam loadPackageParam,
                         final String className,
                         final String methodName)
{
    try {
        XC_MethodHook.Unhook u =
                XposedHelpers.findAndHookMethod(
                        className,
                        loadPackageParam.classLoader,
                        methodName,
                        new XC_MethodReplacement() {
                            @Override
                            protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                                XposedBridge.log("happy replaced " + methodHookParam.method.getName()
                                        + " at " + methodHookParam.method.getDeclaringClass().getName());
                                return "123456789012345";
                            }
                        }
                );

        if (u != null) {
            XposedBridge.log("happy hooked " + u.getHookedMethod().getName() + " "
                    + u.getHookedMethod().getDeclaringClass().getCanonicalName());
        }
    } catch (Exception e) {
        XposedBridge.log("happy error " + e.getMessage());
        e.printStackTrace();
    }
}

并使用它：

@Override
public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {

    XposedBridge.log("happy loaded app: " + loadPackageParam.packageName);

    replaceImei(loadPackageParam,
            "android.telephony.TelephonyManager",
            "getDeviceId");
}

它起作用了!

但是当我在Settings应用程序上查看IMEI时，它没有变化。好的，我使用了Settings应用程序的APK，通过apktool提取了源代码，并发现了以下内容：

.line 86
const-string v1, "imei"

invoke-interface {v0}, Lcom/android/internal/telephony/Phone;->getImei()Ljava/lang/String;

move-result-object v2

invoke-direct {p0, v1, v2}, Lcom/android/settings/deviceinfo/ImeiInformation;->setSummaryText(Ljava/lang/String;Ljava/lang/String;)V

因此，它使用了来自getImei()接口的com.android.internal.telephony.Phone方法。因为不可能挂钩接口的方法，所以我找到了这个接口的所有在来源中实现：

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneProxy",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneBase",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.gsm.GSMPhone",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.imsphone.ImsPhone",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.cdma.CDMAPhone",
            "getImei");

日志记录显示，设置应用程序中的getImea()在PhoneProxy中被钩住了(参见上面的源代码)：

I/Xposed  ( 6800): happy loaded app: com.android.settings
I/Xposed  ( 6800): happy hooked getDeviceId android.telephony.TelephonyManager
I/Xposed  ( 6800): happy hooked getImei com.android.internal.telephony.PhoneProxy

但是什么都没有发生，IMEI在设置中没有改变。当然，我安装了这个应用程序，每次迭代都重新启动手机。

好的，我试图强行执行这个任务:我找到了一些其他的方法，并将它们连上了钩。但没什么用。

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.gsm.GSMPhone",
            "getPhoneId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.imsphone.ImsPhone",
            "getPhoneId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.cdma.CDMAPhone",
            "getPhoneId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoController",
            "getDeviceId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoController",
            "getImeiForSubscriber");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoController",
            "getDeviceIdForPhone");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfo",
            "getDeviceId");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfo",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoProxy",
            "getImeiForSubscriber");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneSubInfoProxy",
            "getImei");

    replaceImei(loadPackageParam,
            "com.android.internal.telephony.PhoneBase",
            "getPhoneId");

有什么想法吗？怎么搞错了？那该怎么办呢？

所有实验都是在Nexus 4和Android5.1.1上进行的。

这个问题的全部来源如下：https://gist.github.com/tseglevskiy/d100898468b286e1fff214778c9609b3

更新1

实验的下一部分。我发现，通过实现IXposedHookZygoteInit接口，可以在Zygote的早期阶段挂钩一些方法。好吧，我做到了：

private void replaceImeiInitZygote(final String className,
                                   final String methodName)
{
    try {
        final Class<?> foundClass = XposedHelpers.findClass(className, null);

        if (foundClass != null) {
            XC_MethodHook.Unhook u = XposedHelpers.findAndHookMethod(foundClass, methodName,

                    new XC_MethodReplacement() {
                        @Override
                        protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                            XposedBridge.log("happy replaced " + methodHookParam.method.getName()
                                    + " at " + methodHookParam.method.getDeclaringClass().getName());
                            return "123456789099999";
                        }
                    });

            if (u != null) {
                XposedBridge.log("happy hooked from initZygote " + u.getHookedMethod().getName() + " "
                        + u.getHookedMethod().getDeclaringClass().getCanonicalName());
            }
        }
    } catch (Exception e) {
        XposedBridge.log("happy error " + e.getMessage());
        e.printStackTrace();
    }
}

并使用它：

@Override
public void initZygote(StartupParam startupParam) throws Throwable {
    replaceImeiInitZygote(
            "android.telephony.TelephonyManager",
            "getDeviceId");

    replaceImeiInitZygote(
            "com.android.internal.telephony.PhoneProxy",
            "getImei");

    replaceImeiInitZygote(
            "com.android.internal.telephony.PhoneBase",
            "getImei");

    replaceImeiInitZygote(
            "com.android.internal.telephony.gsm.GSMPhone",
            "getImei");

    replaceImeiInitZygote(
            "com.android.internal.telephony.imsphone.ImsPhone",
            "getImei");

    replaceImeiInitZygote(
            "com.android.internal.telephony.cdma.CDMAPhone",
            "getImei");

}

通过日志，它连接了几个方法：

I/Xposed  (  198): happy hooked from initZygote getDeviceId android.telephony.TelephonyManager
I/Xposed  (  198): happy hooked from initZygote getImei com.android.internal.telephony.PhoneProxy

但是id也不会改变设置应用程序中的IMEI。怎么了？

Answer 1

好吧，你差点就成功了！您试图挂起getImei()，但实际上系统从未调用过它。使用getDeviceId()代替，它返回相同的数据。

若要在设置中更改IMEI，请尝试使用此片段，它的工作方式与魅力一样：

findAndHookMethod(
        "com.android.internal.telephony.gsm.GSMPhone",
        lpparam.classLoader,
        "getDeviceId",
        new XC_MethodReplacement() {
            @Override
            protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
                XposedBridge.log("NEW IMEI!!! com.android.internal.telephony.gsm.GSMPhone.getDeviceId()");
                return "111111111111111";
            }
        }
);

顺便说一句，您也可以将这些方法挂钩：

com.android.internal.telephony.PhoneSubInfo.getDeviceId()
com.android.internal.telephony.gsm.GSMPhone.getDeviceId()
com.android.internal.telephony.cdma.CDMAPhone.getDeviceId()
com.android.internal.telephony.imsphone.ImsPhone.getDeviceId()
com.android.internal.telephony.sip.SipPhone.getDeviceId()

干杯!