今日头条的广告SDK激励视频广告下载、安装分析

try {

Method method = null;

Class> a = getClassLoader().loadClass("com.ss.android.socialbase.appdownloader.a");

for (Method m : a.getDeclaredMethods()) {

Log.e("gamea", ":" + m.getName() + ":" + m.getReturnType().getName());

if (m.getReturnType().getName().equals("android.content.Intent")) {

method = m;

}

}

if (method != null) {

DexposedBridge.hookMethod(method, new XC_MethodHook() {

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

super.beforeHookedMethod(param);

Log.e("gamea", "getPackageName param:" + param.args[1]);

}

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

super.afterHookedMethod(param);

Log.e("gamea", "getPackageName param:" + param.getResult().toString());

}

});

}

Class f = FileProvider.class;

Method getUriForFile = f.getDeclaredMethod("getUriForFile", Context.class, String.class, File.class);

DexposedBridge.hookMethod(getUriForFile, new XC_MethodHook() {

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

super.beforeHookedMethod(param);

File o2 = (File) param.args[2];

Object o1 = param.args[1];

String oo2 = o2.getAbsolutePath();

// /storage/emulated/0/Android/data/com.iplay.assistant/files/Download/boxnewest.apk

String a = oo2.substring(oo2.lastIndexOf("/", oo2.length()));

fileNew = new File("/storage/emulated/0/Android/data/com.tool.mm.cool.o9/sandbox/0/com.iplay.assistant/files/Download/", a);

}

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

super.afterHookedMethod(param);

}

});

DexposedBridge.hookMethod(ContextWrapper.class.getDeclaredMethod("startActivity", Intent.class), new XC_MethodHook() {

@SuppressLint("WrongConstant")

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

super.beforeHookedMethod(param);

Object object = param.args[0];

if (object instanceof Intent) {

String v4_2 = "application/vnd.android.package-archive";

Intent intent1 = new Intent("android.intent.action.VIEW");

if (Build.VERSION.SDK_INT >= 24) {

intent1.addFlags(1);

}

intent1.setDataAndType(Uri.fromFile(fileNew), v4_2);

param.args[0] = intent1;

}

}

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

super.afterHookedMethod(param);

}

});

Class> b = getClassLoader().loadClass("com.ss.android.socialbase.downloader.g.b");

Method h = b.getDeclaredMethod("h");

DexposedBridge.hookMethod(h, new XC_MethodHook() {

@Override

protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

super.beforeHookedMethod(param);

}

@Override

protected void afterHookedMethod(MethodHookParam param) throws Throwable {

super.afterHookedMethod(param);

param.setResult("/storage/emulated/0/Android/data/com.tool.mm.cool.o9/sandbox/0/com.iplay.assistant/files/Download");

// Log.e("gamea", "h ret:" + param.getResult());

}

});

} catch (Exception e) {

e.printStackTrace();

}