Home

Hook org.apache.http 包中的 HttpPost 请求

XposedHelpers.findAndHookMethod("org.apache.http.impl.client.AbstractHttpClient", loadPackageParam.classLoader, "execute", HttpUriRequest.class, new XC_MethodHook() {

    @Override
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        if (!param.args[0].getClass().getCanonicalName().contains("HttpPost")) {
            return;
        }
        HttpPost request = (HttpPost) param.args[0];

        String url = request.getURI().toString();
    }
}

流量统计或者内容嗅探

final int apiLevel = Build.VERSION.SDK_INT;
/* 自 Android 4.4 后改用 okhttp 实现，在 6.0 后包名有改动 */
if (apiLevel >= 23) {
    XposedHelpers.findAndHookMethod("com.android.okhttp.internal.huc.HttpURLConnectionImpl", loadPackageParam.classLoader, "getInputStream", URLGetInputStreamHook);
} else if (apiLevel >= 19) {
    XposedHelpers.findAndHookMethod("com.android.okhttp.internal.http.HttpURLConnectionImpl", loadPackageParam.classLoader, "getInputStream", URLGetInputStreamHook);
} else {
    XposedHelpers.findAndHookMethod("libcore.net.http.HttpURLConnectionImpl", loadPackageParam.classLoader, "getInputStream", URLGetInputStreamHook);
}

http payload

XposedHelpers.findAndHookConstructor("java.net.URL", loadPackageParam.classLoader, String.class, new XC_MethodHook() {
    @Override
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        String url = (String) param.args[0];
        log("URL construct " + url);
        /* 还可以通过修改参数或结果，改变应用逻辑 */
        param.args[0] = "http://www.baidu.com/";
        log("Change URL to " + param.args[0]);
    }
});

所有网络 IO，本地 IO 等 IO 错误都会被捕获

XposedBridge.hookAllConstructors(IOException.class, new XC_MethodHook() {
    @Override
    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        XposedBridge.log((Throwable) param.thisObject);
    }
});

monkeyrunner

frameworks/base/services/java/com/android/server/wm/WindowManagerService.java#startViewServer com.android.server.wm.WindowManagerService#isSystemSecure ,false com.android.server.wm.WindowManagerService#checkCallingPermission ,true

UserAgentString

android.webkit.WebView#loadUrl

Object thisObj = param.thisObject;
String UserAgentString = null;
if (thisObj instanceof WebView) {
   UserAgentString = ((WebView) thisObj).getSettings().getUserAgentString();
}

StartActivity

android.app.Instrumentation#execStartActivity

##EditText android.widget.EditText#getText

https

org.apache.http.conn.ssl.AbstractVerifier#verify

getCookie

com.android.webview.chromium.CookieManagerAdapter#getCookie

Got hook: http://gslab.qq.com/article-32-1.html

cert

android.content.pm.PackageParser#collectCertificates

Ref: https://github.com/rovo89/XposedBridge/wiki/Development-tutorial