安卓逆向-new-sec6-5 平头哥框架hook简介 | 类加载器

新增JNI文件并导入so库

# For more information about using CMake with Android Studio, read the
# documentation: https://d.android.com/studio/projects/add-native-code.html
# Sets the minimum version of CMake required to build the native library.
cmake_minimum_required(VERSION 3.10.2)
# Declares and names the project.
project("native-lib")
# Creates and names a library, sets it as either STATIC
# or SHARED, and provides the relative paths to its source code.
# You can define multiple libraries, and CMake builds them for you.
# Gradle automatically packages shared libraries with your APK.
add_library( # Sets the name of the library.
native-lib
# Sets the library as a shared library.
SHARED
# Provides a relative path to your source file(s).
native-lib.cpp
)
# Searches for a specified prebuilt library and stores the path as a
# variable. Because CMake includes system libraries in the search path by
# default, you only need to specify the name of the public NDK library
# you want to add. CMake verifies that the library exists before
# completing its build.
find_library( # Sets the name of the path variable.
log-lib
# Specifies the name of the NDK library that
# you want CMake to locate.
log)
# Specifies libraries CMake should link to your target library. You
# can link multiple libraries, such as libraries you define in this
# build script, prebuilt third-party libraries, or system libraries.
target_link_libraries( # Specifies the target library.
native-lib
# Links the target library to the log library
# included in the NDK.
${log-lib})

externalNativeBuild {
cmake {
path "src/main/cpp/CMakeLists.txt"
version "3.10.2"
}
}

内部类

类加载器

package com.sam.myapplicationcj;import android.util.Log;import com.virjar.ratel.api.rposed.IRposedHookLoadPackage;
import com.virjar.ratel.api.rposed.RC_MethodHook;
import com.virjar.ratel.api.rposed.RposedHelpers;
import com.virjar.ratel.api.rposed.callbacks.RC_LoadPackage;public class HookMethodEntry implements IRposedHookLoadPackage {private static final String TAG = "yuanrenxue->";@Overridepublic void handleLoadPackage(RC_LoadPackage.LoadPackageParam lpparam) throws Throwable {if (lpparam.packageName.equals("com.yuanrenxue.course4")) {Log.d(TAG, "handleLoadPackage: hook method start success");// hook静态方法// 方法一：（与hook构造方法类似）通过classname：public static RC_MethodHook.Unhook findAndHookConstructor(String className, ClassLoader classLoader, Object... parameterTypesAndCallback) {RposedHelpers.findAndHookMethod("com.yuanrenxue.course4.MysteryBox", lpparam.classLoader, "staticMethod", String.class, int.class, new RC_MethodHook() {@Overrideprotected void beforeHookedMethod(MethodHookParam param) throws Throwable {super.beforeHookedMethod(param);// 如何获取方法的参数 -> param.args[]Log.d(TAG, "beforeHookedMethod: args[0] = " + param.args[0] + ", args[1]" + param.args[1]);// 对于方法参数的修改（修改后的类型还是要和形参一致）param.args[0] = "静态方法修改后的第一个参数";param.args[1] = 1000;}@Overrideprotected void afterHookedMethod(MethodHookParam param) throws Throwable {super.afterHookedMethod(param);// 获取方法的返回值Object result = param.getResult();Log.d(TAG, "afterHookedMethod: " + result);// 修改方法返回值（返回值类型要和原始的返回值类型一致）param.setResult("我是修改之后的静态方法返回值");}});// hook实例方法（静态和实例方法用的都是findAndHookMethod函数，而且可以用一个重载方法没关系）// 方法二（方法一实际上也是内部先调用的方法二）：public static RC_MethodHook.Unhook findAndHookMethod(Class<?> clazz, String methodName, Object... parameterTypesAndCallback) {Class<?> MysteryBoxClass = lpparam.classLoader.loadClass("com.yuanrenxue.course4.MysteryBox");RposedHelpers.findAndHookMethod(MysteryBoxClass, "instanceMethod", String.class, int.class, new RC_MethodHook() {@Overrideprotected void beforeHookedMethod(MethodHookParam param) throws Throwable {super.beforeHookedMethod(param);Log.d(TAG, "beforeHookedMethod实例方法: args[0]" + param.args[0] + ", args[1] " + param.args[1]);param.args[0] = "实例方法修改后的第一个参数";param.args[1] = 2000;}@Overrideprotected void afterHookedMethod(MethodHookParam param) throws Throwable {super.afterHookedMethod(param);param.setResult("我是实例方法修改后的返回值");}});// 内部类处理RposedHelpers.findAndHookMethod("com.yuanrenxue.course4.MysteryBox$InnerClass", lpparam.classLoader, "innerClassMethod", String.class, int.class, new RC_MethodHook() {@Overrideprotected void beforeHookedMethod(MethodHookParam param) throws Throwable {super.beforeHookedMethod(param);Log.d(TAG, "beforeHookedMethod内部类: args[0]" + param.args[0] + ", args[1] " + param.args[1]);}@Overrideprotected void afterHookedMethod(MethodHookParam param) throws Throwable {super.afterHookedMethod(param);Log.d(TAG, "afterHookedMethod: " + param.getResult());}});// hook native函数RposedHelpers.findAndHookMethod("com.yuanrenxue.course4.MainActivity", lpparam.classLoader, "nativeMethod", new RC_MethodHook() {@Overrideprotected void beforeHookedMethod(MethodHookParam param) throws Throwable {super.beforeHookedMethod(param);Log.d(TAG, "beforeHookedMethod: " + param.args.length);}@Overrideprotected void afterHookedMethod(MethodHookParam param) throws Throwable {super.afterHookedMethod(param);Log.d(TAG, "afterHookedMethod: " + param.getResult());param.setResult("我是修改之后native方法的返回值");}});}}
}

PS

安卓逆向-new-sec6-5 平头哥框架hook简介 | 类加载器 | 内部类相关推荐

安卓逆向-new-sec6-4 Java反射相关知识以及平头哥框架hook构造函数 | App发布测试版本感染
反射机制 app加上这个属性,也能发布测试版本,被成功感染,无需签名和发布那个release版本 APP是E:\1A_androidstudio_project\course4 插件是E:\1A_an ...
安卓逆向_24（一） --- Hook 框架 frida（ Hook Java层和 so层））
From:Hook 神器家族的 Frida 工具使用详解:https://blog.csdn.net/FlyPigYe/article/details/90258758 详解 Hook 框架 frid ...
安卓逆向Xposed HOOK TB直播APP的x-sign参数
最近学习安卓逆向,接触一下TB系的APP,了解大厂APP是做数据安全的,这篇文章主要介绍某宝直播APP的签名参数x-sign的HOOK过程,当然,其他的参数也是可以HOOK的.本文只用于学习交流,请勿 ...
20145307陈俊达_安卓逆向分析_Xposed的hook技术研究
20145307陈俊达_安卓逆向分析_Xposed的hook技术研究引言其实这份我早就想写了,xposed这个东西我在安卓SDK 4.4.4的时候就在玩了,root后安装架构,起初是为了实现一些屌 ...
c语言延时函数_介召几个frida在安卓逆向中使用的脚本以及延时Hook手法
0x00 frida简介 frida是近几年才推出的一款全平台的逆向神器.功能上主要采用动态hook的方式,加入log,修改逻辑等.可以对java,native等hook. 具体使用情况,谁用谁知道. ...
安卓逆向_22（一） --- Xposed【 Android Studio + Xposed 实现简单的 hook 】
From:使用渗透测试框架 Xposed 框架 hook 调试 Android APP:https://www.freebuf.com/articles/terminal/56453.html Xpo ...
安卓怎么调用系统的ui_安卓逆向 | 为了反射调用我们怎么能拿到被HOOK函数的实例...
先打一拳,打的时候再把问题问遍. 蔚前言当我们在xposed进行反射调用的时候,很多时候被HOOK函数并不是static函数,但是我们在调用的时候需要传入该函数的类的实例,那实例我们怎么拿到呢,今天 ...
安卓逆向——AS开发Xposed插件HOOK案例
环境和工具 : 模拟器:雷电 4.0.43版本安卓版本:7.1.2 x86 Xposed :xposed-installer-3-1-5 反编译根据:jadx,Android killer 基于上 ...
安卓逆向Xposed HOOK TB直播APP的x-sign参数（二）
最近学习安卓逆向,接触一下TB系的APP,了解大厂APP是做数据安全的,这篇文章主要介绍某宝直播APP的签名参数x-sign的HOOK过程,当然,其他的参数也是可以HOOK的.本文只用于学习交流,请勿 ...

安卓逆向-new-sec6-5 平头哥框架hook简介 | 类加载器 | 内部类

新增JNI文件并导入so库

内部类

类加载器

PS

安卓逆向-new-sec6-5 平头哥框架hook简介 | 类加载器 | 内部类相关推荐

最新文章

热门文章