(Android) 如何使用HOOK實現動態注入以及自動化操作

為什么會有這邊博文?

最近一直在搞一些apk破解以及自動化方面的東西.覺得有必要記錄一下.也是為了修改下自己懶的毛病(很久很久很久沒更新博客了)

一. 項目需求

項目功能:

本文將使用QQ為例,利用Hook實現自動登錄,自動退出登錄功能

項目流程:

流程比較簡單

二. 資源準備

大致需要準備以下東西:

一臺空閑的安卓手機,能root最好.

安裝VirtualXposed(傳送門),安裝QQ(傳送門,提取碼: ty58)(注意QQ是8.0.0.4000版本,不同版本可能會影響hook點),對于不懂怎么使用hook的請參考

將QQ安裝到VirtualXposed

QQ脫殼獲取源代碼(不懂脫殼操作請點這里)

三. 功能實現

3.1 實現自動從QQ新用戶頁跳轉到登陸頁

第一次啟動qq的時候,qq會停留在,顯然要實現登陸的話我們需要讓其自動進入登陸頁面,如圖:

3.1.1 獲取新用戶頁的堆棧信息(手機需要連接電腦)

adb shell dumpsys activity >>輸出路徑

下面是導出的堆棧信息:

我們可以得到登陸界面的RegisterGuideView.以及登陸按鈕的16進制值7f0b0da9

3.1.2 獲取登陸按鈕邏輯的Hook點

通過PowerGREP工具對脫殼后的QQdex源碼(脫殼后可得到十幾個dex文件)進行字符串搜索找到RegisterGuideView所在的dex,然后通過jeb工具反編譯該dex, 以下是RegisterGuideView類的源碼

package com.tencent.mobileqq.activity.registerGuideLogin;import android.annotation.SuppressLint; import android.content.Intent; import android.graphics.drawable.BitmapDrawable; import android.os.Bundle; import android.view.LayoutInflater; import android.view.View$OnClickListener; import android.view.View; import android.view.ViewGroup; import android.widget.Button; import android.widget.ImageView; import com.tencent.mobileqq.activity.RegisterPhoneNumActivity; import com.tencent.mobileqq.app.QQAppInterface; import com.tencent.mobileqq.statistics.ReportController; import com.tencent.qphone.base.util.QLog;public class RegisterGuideView extends GuideBaseFragment implements View$OnClickListener {private View a;private Button a;private Button b;public RegisterGuideView() {super();}@SuppressLint(value={"ValidFragment"}) public RegisterGuideView(QQAppInterface arg1) {super(arg1);}public void onClick(View arg14) {Intent v0;switch(arg14.getId()) {case 2131430824: {ReportController.b(this.a, "CliOper", "", "", "0X8007576", "0X8007576", 0, 0, "", "", "", "");v0 = new Intent(this.a, RegisterPhoneNumActivity.class);v0.putExtra("key_register_from", 2);v0.putExtra("leftViewText", this.a.getString(2131499116));v0.addFlags(67108864);this.a.startActivity(v0);break;}case 2131430825: {ReportController.b(this.a, "CliOper", "", "", "0X8007575", "0X8007575", 0, 0, "", "", "", "");v0 = this.a.getIntent();v0.putExtra("from_register_guide", true);v0.putExtra("is_need_show_logo_animation", true);GuideBaseFragment v0_1 = GuideHandler.a(this.a, this.a);if(this.a == null) {return;}this.a.a(v0_1);break;}}}public View onCreateView(LayoutInflater arg7, ViewGroup arg8, Bundle arg9) {View v1 = arg7.inflate(2130903607, arg8, false);this.a = v1.findViewById(2131428759);this.a.setVisibility(0);this.a = v1.findViewById(2131430825);this.b = v1.findViewById(2131430824);this.a.setOnClickListener(((View$OnClickListener)this));this.b.setOnClickListener(((View$OnClickListener)this));View v0 = v1.findViewById(2131430823);try {((ImageView)v0).setImageDrawable(new BitmapDrawable(this.getResources(), this.getActivity().getAssets().open("splash.jpg")));}catch(Throwable v0_1) {QLog.e("LoginActivity.RegisterGuideView", 1, "onCreateView error:" + v0_1.getMessage());}return v1;} }

通過我們得到的登陸按鈕的16進制值7f0b0da9可以確定10進制值2131430825,從而確定變量a是登陸按鈕.

3.1.3 通過Hook 實現登陸按鈕點擊

由于我們已經找到了登陸按鈕相關的類和按鈕變量對象,接下來我們只需要通過hook拿到該按鈕對象,實現點擊即可自動進入登陸頁面
以下是核心代碼:

/*** hook新用戶頁,拿到登陸按鈕,模擬點擊登陸*/public static void hookRegisterGuideLogin(){XposedHelpers.findAndHookMethod("com.tencent.mobileqq.activity.registerGuideLogin.RegisterGuideView", context.getClassLoader(), "onCreateView", LayoutInflater.class, ViewGroup.class, Bundle.class, new XC_MethodHook(){@Overrideprotected void afterHookedMethod(MethodHookParam param) throws Throwable{super.afterHookedMethod(param);final Object obj = param.thisObject;doMainLooper(context, 1000, new Runnable(){@Overridepublic void run(){//得到按鈕對象Object viewObj = ReflectUtils.getFieldValueForFiledClsNm(obj, "a", "android.widget.Button");if (viewObj instanceof Button){//點擊按鈕((Button) viewObj).performClick();}}});}});}

目前為止,我們就已經完成了長征的第一步,從新用戶頁自動點擊到登陸頁. 下面是成果演示:

可以看到我們已經實現了從新用戶頁點擊到登陸頁了.

3.2 實現登陸頁自動填充登陸賬號和密碼并自動登陸

3.2.1 打印登陸頁的堆棧信息

如下圖,我們可以找到登陸頁面所在的類名,以及按鈕輸入框等信息

3.2.2 找到源碼中登陸相關hook點

LoginView的重要源碼如下,我們基本可以定位到賬號輸入框,密碼輸入框,登陸按鈕等對象

private void a(View arg12) {int v0_6;ImageView v1_1;int v3;int v1;int v10 = -16578534;int v9 = 2;int v8 = 8;this.i = arg12.findViewById(2131430866);arg12.findViewById(2131438684).setVisibility(v8);this.a = arg12.findViewById(2131430867);this.a = arg12.findViewById(2131430735);this.a.setHeadBorder(2130839513);this.a = this.a.a();this.a.a = ((NewStyleDropdownView$DropdownCallback)this);this.a.setContentDescription(this.a.getString(2131492973));Bundle v0 = this.a.getInputExtras(true);if(v0 != null) {v0.putInt("INPUT_TYPE_ON_START", 1);}this.a = arg12.findViewById(2131430736);this.a.setCustomClearButtonCallback(new abgm(this, arg12.findViewById(2131430871), ((int)(43f * this.a + 0.5f))));this.a.setContentDescription(this.a.getString(2131492974));SpannableString v0_1 = new SpannableString("輸入密碼");v0_1.setSpan(new AbsoluteSizeSpan(17, true), 0, v0_1.length(), 33);this.a.setHint(((CharSequence)v0_1));if(Build$VERSION.SDK_INT >= 26) {try {View.class.getMethod("setImportantForAutofill", Integer.TYPE).invoke(this.a, Integer.valueOf(8));}catch(Exception v0_2) {QLog.w("LoginActivity.LoginView", v9, "disable auto fill error", ((Throwable)v0_2));}}this.a = arg12.findViewById(2131430150);this.a.setContentDescription(this.a.getString(2131492976));arg12.findViewById(2131430876).setOnClickListener(((View$OnClickListener)this));View v0_3 = arg12.findViewById(2131430875);ViewCompat.setImportantForAccessibility(v0_3, v9);v0_3.setContentDescription(this.a.getString(2131498620) + this.a.getString(2131500954));this.a.setOnClickListener(((View$OnClickListener)this));this.a.a();this.g();this.a = arg12.findViewById(2131430740);this.a.setContentDescription(this.a.getString(2131492978));this.a.setOnClickListener(((View$OnClickListener)this));this.a = arg12.findViewById(2131430864);this.f = arg12.findViewById(2131430874);this.g = arg12.findViewById(2131430733);this.a.setOnSizeChangedListenner(((InputMethodRelativeLayout$onSizeChangedListenner)this));this.a.setOnTouchListener(((View$OnTouchListener)this));this.e = arg12.findViewById(2131430865);this.e.setOnTouchListener(new abgn(this));this.a = arg12.findViewById(2131430868);if(this.j) {this.a.setVisibility(4);}this.b = arg12.findViewById(2131430738);this.b = arg12.findViewById(2131430739);this.b.setContentDescription(this.a.getString(2131498674));arg12.findViewById(2131438685).setOnClickListener(((View$OnClickListener)this));this.a = this.a.getSystemService("input_method");this.b = this.a.a();this.b.setOnClickListener(this.a);if(this.a == null) {this.a = new ArrayList();goto label_183;}try {this.a.clear();}catch(Exception v0_2) {QLog.d("LoginActivity.LoginView", 1, "initViews crash: ", ((Throwable)v0_2));this.a = new ArrayList();}label_183:List v0_4 = BaseApplicationImpl.sApplication.getAllAccounts();if(v0_4 != null) {this.a.addAll(((Collection)v0_4));}if(this.a != null) {if(this.a.size() <= 0) {goto label_470;}while(this.a.size() > v8) {this.a.remove(this.a.size() - 1);}this.a.setAdapter(new abgo(this, this.a));if((this.g) && !this.f) {goto label_273;}if(this.i) {goto label_273;}if(this.k) {goto label_273;}String v4 = this.a.getIntent().getStringExtra("uin");String v5 = this.a.getIntent().getStringExtra("befault_uin");if((this.f) && v4 != null && v4.length() > 0) {v1 = 0;v3 = -1;}else {this.a(this.a.get(0));this.a = 0;goto label_273;}while(v1 < this.a.size()) {Object v0_5 = this.a.get(v1);if(v0_5 != null && ((SimpleAccount)v0_5).getUin() != null) {if(v5 != null && (v5.equals(((SimpleAccount)v0_5).getUin()))) {v3 = v1;}if(!v4.equals(((SimpleAccount)v0_5).getUin())) {goto label_255;}this.a(((SimpleAccount)v0_5));this.a = v1;}label_255:++v1;}if(v3 == -1) {goto label_273;}this.a.remove(v3);}else {label_470:this.a.b().setVisibility(v8);}label_273:this.a.addTextChangedListener(this.a);this.a.addTextChangedListener(this.b);this.a.setOnFocusChangeListener(this.a);this.a.setOnFocusChangeListener(this.a);this.a.setLongClickable(false);this.c = arg12.findViewById(2131430872);this.c.setOnClickListener(((View$OnClickListener)this));if(this.a) {this.a.setTransformationMethod(PasswordTransformationMethod.getInstance());v1_1 = this.c;v0_6 = (this.g) || (this.f) || (this.i) ? 2130844987 : 2130842965;v1_1.setImageResource(v0_6);this.c.setContentDescription("隱藏密碼");}else {this.a.setTransformationMethod(HideReturnsTransformationMethod.getInstance());v1_1 = this.c;v0_6 = (this.g) || (this.f) || (this.i) ? 2130844988 : 2130842968;v1_1.setImageResource(v0_6);this.c.setContentDescription("顯示密碼");}this.c.setVisibility(v8);this.b.setOnClickListener(((View$OnClickListener)this));if(this.a.mSystemBarComp != null && ImmersiveUtils.isSupporImmersive() == 1) {this.a.mSystemBarComp.init();}this.c = arg12.findViewById(2131430734);this.d = arg12.findViewById(2131430869);this.a.clearFocus();this.a.clearFocus();this.a.setClearButtonVisible(false);this.a.setTextClearedListener(((ConfigClearableEditText$OnTextClearedListener)this));this.a.addTextChangedListener(this.c);this.b(arg12);if(this.a.getIntent().getBooleanExtra("reason_for_upgrade", false)) {this.a.showDialog(v9);}if((this.a.getIntent().getBooleanExtra("key_req_by_contact_sync", false)) && (this.a.getIntent().getBooleanExtra("IS_ADD_ACCOUNT", false))) {this.a.setText(this.a.getIntent().getStringExtra("key_uin_to_login"));}this.a.setVisibility(0);this.i.setVisibility(v8);this.f.setVisibility(0);this.b.setVisibility(0);this.a.a(false, null);this.a.setTextColor(v10);this.a.setHintTextColor(-5196865);this.a.setFocusable(true);this.a.setFocusableInTouchMode(true);this.a.setTextColor(v10);this.a.setHintTextColor(-5196865);this.a.setVisibility(0);this.b.findViewById(2131430877).setVisibility(0);this.a.setVisibility(0);this.b.setVisibility(0);this.d(this.a.isInMultiWindow());if((this.g) || (this.f) || (this.i)) {this.c.setVisibility(0);this.a.setVisibility(v8);this.i.setVisibility(0);this.i.setOnClickListener(((View$OnClickListener)this));if(this.i) {String v0_7 = this.a.getIntent().getStringExtra("uin");if(!TextUtils.isEmpty(((CharSequence)v0_7))) {v1 = v0_7.length();this.a.setText(v0_7.substring(0, v9) + "****" + v0_7.substring(v1 - 2, v1));this.b(v0_7);this.a.setFocusable(false);this.a.setFocusableInTouchMode(false);}this.b.findViewById(2131430877).setVisibility(v8);this.a.setVisibility(v8);RelativeLayout$LayoutParams v0_8 = new RelativeLayout$LayoutParams(-2, -2);v0_8.addRule(13);this.b.setLayoutParams(((ViewGroup$LayoutParams)v0_8));goto label_454;}this.a.a(false, null);this.a.setFocusable(true);this.a.setFocusableInTouchMode(true);}else {if(!this.l && !this.a.isInMultiWindow()) {goto label_454;}this.c.setVisibility(0);}label_454:this.a = this.a.getLayoutParams();this.b = this.g.getLayoutParams();this.c = this.a.getLayoutParams();this.e();}

3.2.3 使用hook實現自動登陸

以下是核心代碼

private static void hookAutoLogin(){String loginviewClsNm = "com.tencent.mobileqq.activity.registerGuideLogin.LoginView";final String loginBtnClsNm = "com.tencent.mobileqq.activity.registerGuideLogin.LoginAnimBtnView"; //登陸按鈕類名final String loginBtnFiledNm = "a"; //登陸按鈕變量名final String pwdEdTextClsNm = "com.tencent.mobileqq.widget.CustomSafeEditText"; //密碼輸入框類名final String pwdEdTextFiledNm = "a"; //密碼輸入框變量名final String newStyleDropdownViewClsNm = "com.tencent.mobileqq.widget.NewStyleDropdownView"; //輸入框外view類名final String newStyleDropdownViewFiledNm = "a"; //輸入框外view類名final String actInputViewClsNm = "aqsw"; //輸入框類名final String actInputViewFiledNm = "a"; //輸入框的變量名//hook登錄頁節點XposedHelpers.findAndHookMethod(loginviewClsNm, context.getClassLoader(), "a", View.class, new XC_MethodHook(){@Overrideprotected void afterHookedMethod(MethodHookParam param) throws Throwable{super.afterHookedMethod(param);//得到登陸所需對象Object loginViewObj = param.thisObject;Object newStyleDropdownViewOBj = ReflectUtils.getFieldValueForFiledClsNm(loginViewObj, newStyleDropdownViewFiledNm, newStyleDropdownViewClsNm);final Object loginBtnObj = ReflectUtils.getFieldValueForFiledClsNm(loginViewObj, loginBtnFiledNm, loginBtnClsNm);final Object pwdEdTextObj = ReflectUtils.getFieldValueForFiledClsNm(loginViewObj, pwdEdTextFiledNm, pwdEdTextClsNm);final Object actInputViewobj = ReflectUtils.getFieldValueForFiledClsNm(newStyleDropdownViewOBj, actInputViewFiledNm, actInputViewClsNm);// 開始輸入賬號密碼登陸final String account="";final String pwd="";doMainLooper(context, 3000, new Runnable(){@Overridepublic void run(){if (actInputViewobj instanceof AutoCompleteTextView){((AutoCompleteTextView) actInputViewobj).setText(account);}if (pwdEdTextObj instanceof EditText){((EditText) pwdEdTextObj).setText(pwd);}if (loginBtnObj instanceof View){((View) loginBtnObj).performClick();}}});}});}

至此我們的自動登陸功能就算是做好了,下面是演示:

3.3 實現退出登錄

和上面步驟一樣,我們需要從賬號管理界面界面入手

3.3.1 獲取堆棧信息

拿到堆棧信息如下,找到所在的類AccountManageActivity

3.3.2 查找源碼中退出登錄的相關hook點

public void a(int arg11, boolean arg12) {String v9 = null;int v5 = 7000;int v6 = 2;Object v0 = this.a.get(arg11);if(v0 == null) {this.a.dismiss();if(QLog.isColorLevel()) {QLog.w("Switch_Account", v6, "onItemLongClick simple account = null");}}else {String v2 = ((SimpleAccount)v0).getUin();String v3 = this.app.getCurrentAccountUin();this.a = v2;if(v2.equals(v3)) {AccountManageActivity.a(((Activity)this), this.app);}if(QLog.isColorLevel()) {QLog.d("hunter", v6, "++++++++++");}this.a(this.a, arg12);HistoryChatMsgSearchKeyUtil.a(v2);CrmUtils.a(this.getBaseContext(), v3);this.a.remove(v0);Manager v1 = this.app.getManager(60);if(v1 != null && (((SubAccountManager)v1).a(v2))) {SubAccountControll.a(this.app, 0, v2);((SubAccountManager)v1).e(v2);((SubAccountManager)v1).a(v2, v9, true);((SubAccountManager)v1).a(v2, v6);SubAccountControll.a(this.app, v2, 7);int v1_1 = 1 - this.app.a().a(v2, v5);if(v1_1 != 0) {this.app.a().c(v2, v5, v1_1);}if(!QLog.isColorLevel()) {goto label_68;}QLog.d("SUB_ACCOUNT", v6, "deleteAccount() hint need to verify,msg num=1, subUin=" + v2);}label_68:GesturePWDUtils.clearGestureData(this.getActivity(), ((SimpleAccount)v0).getUin());if(v2.equals(v3)) {this.app.getApplication().refreAccountList();List v0_1 = this.getAppRuntime().getApplication().getAllAccounts();if(v0_1 != null && v0_1.size() > 0) {v0 = v0_1.get(0);if(((SimpleAccount)v0).isLogined()) {this.getAppRuntime().startPCActivePolling(((SimpleAccount)v0).getUin(), "delAccount");}}}ThreadManager.post(new unx(this, v2, arg12, arg11), 8, ((ThreadExcutor$IThreadListener)v9), true);}}

3.3.3 hook注入退出方法,實現自動退出登錄

以下是核心代碼:

private static void loginOut(){//hook 賬號管理頁XposedHelpers.findAndHookMethod(accountManageActivityClsNm, context.getClassLoader(), "a", Bundle.class, new XC_MethodHook(){@Overrideprotected void afterHookedMethod(MethodHookParam param) throws Throwable{super.afterHookedMethod(param);final Object accountManageActivityObj = param.thisObject;doMainLooper(context, 3000, new Runnable(){@Overridepublic void run(){ReflectUtils.invokeMethod(accountManageActivityObj, "a", new Class[]{int.class, boolean.class}, 0, true);}});}});}

四. 最終效果

已經實現了完全的自動登錄,自動退出登錄操作,完整展示:

由于篇幅原因,部分代碼已省略,完整代碼已上傳github(傳送門)

實際上,利用hook動態注入可以無所不能,大家可以發揮想象.(不過希望用在正途哦,手動滑稽)

總結

以上是生活随笔為你收集整理的(Android) 如何使用HOOK实现动态注入以及自动化操作的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。