Xposed使用说明

Xposed原理简介

Xposed基于两个部分，底层是替换/system/bin/app_process，增加Hook替换函数的接口，主体框架为XposedBridge，由de.robv.android.xposed.XposedBridge的main方法入口。

开发一个基于Xposed的插件

这里以一个动态监测sendTextMessage的Demo为例介绍如何基于Xposed框架实现一个插件。

1. AndroidManifest.xml

   Xposed会读取Application下的相关meta-data，例如这里：

    <meta-data android:value="true" android:name="xposedmodule"/>
    <meta-data android:value="2.1*" android:name="xposedminversion"/>
    <meta-data android:value="Test for Xposed." android:name="xposeddescription"/>
   

2. IXposedHookLoadPackage IXposedHookLoadPackage接口的handleLoadPackage方法在Package Load前调用。

    public class Main implements IXposedHookLoadPackage {
        public void handleLoadPackage(final LoadPackageParam pkg) throws Throwable {
            XposedBridge.log("Loaded app: " + pkg.packageName);
   

   在测试程序运行后输出日志如下：

    09-17 17:25:11.319: I/Xposed(13475): Loaded app: com.example.smshook
   

3. findAndHookMethod

   实现对指定类的指定方法进行Hook，并且通过override beforeHookedMethod和afterHookedMethod来记录和改变原始行为。

        findAndHookMethod("android.telephony.SmsManager", pkg.classLoader, "sendTextMessage",
                String.class,
                String.class,
                String.class,
                PendingIntent.class,
                PendingIntent.class,
        new XC_MethodHook() {
        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
            XposedBridge.log("before send");
            Object[] args = param.args;
            XposedBridge.log(args[0] + ": " + args[2]);
        }
   
        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
            XposedBridge.log("after send");
        }
    });
   

   在测试程序点击发送短信后输出日志如下：

    09-17 17:25:12.150: I/Xposed(13475): before send
    09-17 17:25:12.150: I/Xposed(13475): 10086: test hello world.
    09-17 17:25:12.160: I/Xposed(13475): after send
   

参考

• XDA上Xposed发布贴
• Xposed on Github
• Xposed开发教程
• XPrivacy