0x01前言

之前学习了Xposed如何实现不重新打包APP的条件下，实现函数的Hook，在使用过程中，除了方法的hook，比如我要实现某些函数额调用，不同类中的函数和Native方法的调用。

0x02 测试环境

1.待测试的APP，这里写了一个测试APP，Mainactivity实现界面，定义两个函数：

public String test1()
Public String test2(String str)

2.新建一个Class为test，并定义两个函数 ，和mainactivity一样，test1()和test2(String str),

3.新建一个testNdk的class，实现native方法，并定义两个函数，

public native String teststr();
public native String mytest(String str);

一个带参数和一个没有参数。

0x03 Xposed 实现方法的调用

这里我们hook mainactivity的btntest方法，

final Class <?> test = XposedHelpers.findClass("com.debug.xposed.xposedtest.test", lpparam.classLoader);final Class <?> testndk = XposedHelpers.findClass("com.debug.xposed.xposedtest.testndk", lpparam.classLoader);findAndHookMethod("com.debug.xposed.xposedtest.MainActivity", lpparam.classLoader, "testbtn", View.class, new XC_MethodHook() {@Overrideprotected void beforeHookedMethod(MethodHookParam param) throws Throwable {XposedBridge.log("Hook之前");//getSign}@Override//函数执行后protected void afterHookedMethod(MethodHookParam param) throws Throwable {XposedBridge.log("Hook之后");try {String str1 = (String) XposedHelpers.callMethod(param.thisObject, "test1");Log.i("debug","mainactivity test1 return "+str1);String str2 = (String) XposedHelpers.callMethod(param.thisObject, "test2","xposed input main test2");Log.i("debug","mainactivity test2 return "+str2);Object testObject = test.newInstance();String str3 = (String) XposedHelpers.callMethod(testObject,"test1");Log.i("debug","test test1 return= "+str3);String str4 = (String) XposedHelpers.callMethod(testObject, "test2", "hello ", "txmg");Log.i("debug","test test2 return= "+str4);Object testndkobject = testndk.newInstance();Method myteststr =  XposedHelpers.findMethodBestMatch(testndkobject.getClass(), "teststr");String str5 = (String) myteststr.invoke(testndkobject);Log.i("debug","ndk teststr return= "+str5);Method mytest =  XposedHelpers.findMethodBestMatch(testndkobject.getClass(), "mytest"," gggg");String str6 = (String) mytest.invoke(testndkobject,"mytest input test ");Log.i("debug","ndk mytest return= "+str6);}catch (Exception e){e.printStackTrace();}

Log输出：