1. 根据需求确定 要hook的对象
2. 寻找要hook的对象的持有者，拿到要hook的对象
3. 定义“要hook的对象”的代理类，并且创建该类的对象
4. 使用上一步创建出来的对象，替换掉要hook的对象

        // 4. Show the notification - 展示通知// https://developer.android.google.cn/training/notify-user/build-notification.html#notifyNotificationManagerCompat notificationManager = NotificationManagerCompat.from(context);// notificationId is a unique int for each notification that you must definenotificationManager.notify((int) System.currentTimeMillis(), builder.build());

        //        1.//        public void notify(int id, @NonNull Notification notification) {//            this.notify((String)null, id, notification);//        }////        2.//        public void notify(@Nullable String tag, int id, @NonNull Notification notification) {//            ....//            this.mNotificationManager.notify(tag, id, notification);//        }////        3.//        public void notify(String tag, int id, Notification notification)//        {//            notifyAsUser(tag, id, notification, mContext.getUser());//        }////        4.//        /**//         * @hide//         *///        public void notifyAsUser(String tag, int id, Notification notification, UserHandle user)//        {//            INotificationManager service = getService();//            ....//            service.enqueueNotificationWithTag(pkg, mContext.getOpPackageName(), tag, id,//                    copy, user.getIdentifier());//        }////        5.//        /** @hide *///        static public INotificationManager getService()//        {//            if (sService != null) {//                return sService;//            }//            IBinder b = ServiceManager.getService("notification");//            sService = INotificationManager.Stub.asInterface(b);//            return sService;//        }

  // 1. 通过反射获取NotificationManager对象，新版本可以这样。其实也可以直接如下获取：// -- (NotificationManager)this.mContext.getSystemService("notification");Field mNotificationManager = NotificationManagerCompat.class.getDeclaredField("mNotificationManager");mNotificationManager.setAccessible(true);final NotificationManager notificationManager1 = (NotificationManager) mNotificationManager.get(notificationManagerCompat);

   // 2. 获取将要被代理对象替换的INotificationManager变量- 实际是一个IxxxxService实例对象(该对象可以调用服务对应的方法)Field sService = NotificationManager.class.getDeclaredField("sService");sService.setAccessible(true);

  // 3. 创建一个代理接口对象 - 针对INotificationManager接口做代理Class iNotiMngClz = Class.forName("android.app.INotificationManager");final Object iNotiMngClzLast = sService.get(notificationManager1);Object proxyNotificationManager = Proxy.newProxyInstance(getClassLoader(), new Class[]{iNotiMngClz}, new InvocationHandler() {@Overridepublic Object invoke(Object proxy, Method method, Object[] args) throws Throwable {Log.e("test", "通知被拦截了！");// 为了正常运行，我们还是执行下人家的通知吧！//return method.invoke(iNotiMngClzLast, args);return null;}});

  // 4. 替换NotificationManager的sServicesService.set(notificationManager1, proxyNotificationManager);

  final Object iNotiMngClzLast = sService.get(notificationManager1);

package com.skl.hooktest;import android.app.NotificationManager;
import android.support.v4.app.NotificationManagerCompat;
import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.util.Log;
import android.view.View;import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;public class NotifyHookActivity extends AppCompatActivity {@Overrideprotected void onCreate(Bundle savedInstanceState) {super.onCreate(savedInstanceState);setContentView(R.layout.activity_notify_hook);}/*** Hook通知* @param view*/public void hook(View view) {// 跟踪下notificationManager.notify的调用流程;// 最终调用的是INotificationManager的enqueueNotificationWithTag方法，// --这就涉及到Android Service通信(Binder机制)的相关知识了。//        1.//        public void notify(int id, @NonNull Notification notification) {//            this.notify((String)null, id, notification);//        }////        2.//        public void notify(@Nullable String tag, int id, @NonNull Notification notification) {//            ....//            this.mNotificationManager.notify(tag, id, notification);//        }////        3.//        public void notify(String tag, int id, Notification notification)//        {//            notifyAsUser(tag, id, notification, mContext.getUser());//        }////        4.//        /**//         * @hide//         *///        public void notifyAsUser(String tag, int id, Notification notification, UserHandle user)//        {//            INotificationManager service = getService();//            ....//            service.enqueueNotificationWithTag(pkg, mContext.getOpPackageName(), tag, id,//                    copy, user.getIdentifier());//        }////        5.//        /** @hide *///        static public INotificationManager getService()//        {//            if (sService != null) {//                return sService;//            }//            IBinder b = ServiceManager.getService("notification");//            sService = INotificationManager.Stub.asInterface(b);//            return sService;//        }/**sService只创建一次，INotificationManager是接口，到这里我们就可以Hook替换掉这个sService*/// 老版本api可以用这个方法获取NotificationManager// NotificationManager notificationManager2 = getSystemService(NotificationManager.class);// 内部最终还是会获取NotificationManagerNotificationManagerCompat notificationManagerCompat = NotificationManagerCompat.from(this);try {// 1. 通过反射获取NotificationManager对象，新版本可以这样。其实也可以直接如下获取：// -- (NotificationManager)this.mContext.getSystemService("notification");Field mNotificationManager = NotificationManagerCompat.class.getDeclaredField("mNotificationManager");mNotificationManager.setAccessible(true);final NotificationManager notificationManager1 = (NotificationManager) mNotificationManager.get(notificationManagerCompat);// 2. 获取将要被代理对象替换的INotificationManager变量- 实际是一个IxxxxService实例对象(该对象可以调用服务对应的方法)Field sService = NotificationManager.class.getDeclaredField("sService");sService.setAccessible(true);// 3. 创建一个代理接口对象 - 针对INotificationManager接口做代理Class iNotiMngClz = Class.forName("android.app.INotificationManager");final Object iNotiMngClzLast = sService.get(notificationManager1);Object proxyNotificationManager = Proxy.newProxyInstance(getClassLoader(), new Class[]{iNotiMngClz}, new InvocationHandler() {@Overridepublic Object invoke(Object proxy, Method method, Object[] args) throws Throwable {Log.e("test", "通知被拦截了！");// 为了正常运行，我们还是执行下人家的通知吧！return method.invoke(iNotiMngClzLast, args);// return null;}});// 4. 替换NotificationManager的sServicesService.set(notificationManager1, proxyNotificationManager);} catch (NoSuchFieldException e) {e.printStackTrace();} catch (IllegalAccessException e) {e.printStackTrace();} catch (ClassNotFoundException e) {e.printStackTrace();}}/*** 发送通知（支持8.0+）* @param view*/public void nofify(View view) {NotifyUtil.notifyUtil(this);}/*** 跳转到其他页面，发送通知； 验证下Hook是不是App全局有效；* 答案：是的* 因为：我们的context获取的通知服务时针对当前App的，不会干扰到其他App，系统的更不可能了。* TODO 下一步：我们去跟踪下获取通知服务的源码流程，应该就大概知道原因了....* @param view*/public void goNextPage(View view) {// startActivity(new Intent(this, MainActivity.class));}
}

  package com.skl.hooktest;import android.app.NotificationChannel;
import android.app.NotificationManager;
import android.content.Context;
import android.os.Build;
import android.support.v4.app.NotificationCompat;
import android.support.v4.app.NotificationManagerCompat;public class NotifyUtil {private static String CHANNEL_ID = "111";public static void notifyUtil(Context context){// 1. Set the notification content - 创建通知基本内容// https://developer.android.google.cn/training/notify-user/build-notification.html#builderNotificationCompat.Builder builder = new NotificationCompat.Builder(context, CHANNEL_ID).setSmallIcon(R.drawable.ic_launcher_background).setContentTitle("My notification")// 这是单行//.setContentText("Much longer text that cannot fit one line...")// 这是多行.setStyle(new NotificationCompat.BigTextStyle().bigText("Much longer text that cannot fit one line..." +"Much longer text that cannot fit one line..." +"Much longer text that cannot fit one line...")).setPriority(NotificationCompat.PRIORITY_HIGH).setAutoCancel(true);// 2. Create a channel and set the importance - 8.0后需要设置Channel// https://developer.android.google.cn/training/notify-user/build-notification.html#buildercreateNotificationChannel(context);// 3. Set the notification's tap action - 创建一些点击事件，比如点击跳转页面// https://developer.android.google.cn/training/notify-user/build-notification.html#click// 4. Show the notification - 展示通知// https://developer.android.google.cn/training/notify-user/build-notification.html#notifyNotificationManagerCompat notificationManager = NotificationManagerCompat.from(context);// notificationId is a unique int for each notification that you must definenotificationManager.notify((int) System.currentTimeMillis(), builder.build());}private static void createNotificationChannel(Context context) {// Create the NotificationChannel, but only on API 26+ because// the NotificationChannel class is new and not in the support libraryif (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {CharSequence name = context.getString(R.string.app_name);String description = context.getString(R.string.app_name);int importance = NotificationManager.IMPORTANCE_HIGH;NotificationChannel channel = new NotificationChannel(CHANNEL_ID, name, importance);channel.setDescription(description);// Register the channel with the system; you can't change the importance// or other notification behaviors after thisNotificationManager notificationManager = context.getSystemService(NotificationManager.class);notificationManager.createNotificationChannel(channel);}}
}