Xposed模块 -- Hook函数参数

Posted 2021-10-05 web安全工具库

安卓系统7.1搭建Xposed环境

安卓逆向 -- Xposed模块编写

安卓逆向 -- Jeb动态调试

一、根据以前的课程，我们通过抓包分析，知道了如下的关键函数

package com.dodonew.online.http;import android.text.TextUtils;import android.util.Log;import com.dodonew.online.util.DesSecurity;。。。。。。。。。。。。。。。。。。//省略导包public class RequestUtil {    public static String decodeDesJson(String json, String  desKey, String desIV) {        if(!TextUtils.isEmpty(json)) {            try {                json = new String(new DesSecurity(desKey,  desIV).decrypt64(json), "UTF-8");            }            catch(Exception e) {                e.printStackTrace();            }        }        return json;    }    public static String encodeDesMap(String data, String  desKey, String desIV) {        String v2;        try {            v2 = new DesSecurity(desKey,  desIV).encrypt64(data.getBytes("UTF-8"));        }        catch(Exception e) {            e.printStackTrace();            v2 = "";        }        return v2;    } 。。。。。。。。。。。。。。。。。。//省略部分函数    }}

二、添加一个hook的框架结构

package com.bucuo.a20210908;import android.util.Log;import de.robv.android.xposed.IXposedHookLoadPackage;import de.robv.android.xposed.XposedBridge;import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;import de.robv.android.xposed.IXposedHookLoadPackage;import de.robv.android.xposed.XC_MethodHook;import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;public class hook implements IXposedHookLoadPackage {    public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {        Log.d("逆向有你", "hook成功");        if(!loadPackageParam.packageName.equals("com.dodonew.online")) return;        Log.d("逆向有你","hooking.....");findAndHookMethod("com.dodonew.online.http.RequestUtil", loadPackageParam.classLoader,                "encodeDesMap",//添加要hook的类名及方法名                String.class,                String.class,                String.class,//hook的三个参数                new XC_MethodHook() {                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                    }                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {                        String args0 = (String) param.args[0];                        String args1 = (String) param.args[1];                        String args2 = (String) param.args[2];                        Log.d("逆向有你", args0);                        Log.d("逆向有你", args1);                        Log.d("逆向有你", args2);                    }                });    }}

三、安装到模拟器，重启，点击登录，成功获取我们想要

禁止非法，后果自负

欢迎关注公众号：逆向有你

欢迎关注视频号：之乎者也吧