大佬们帮我看一下这段 xposed 代码有没有问题 - V2EX
eyeshuaji

大佬们帮我看一下这段 xposed 代码有没有问题

  •  
  •   eyeshuaji Jun 17, 2024 8679 views
    This topic created in 716 days ago, the information mentioned may be changed or developed.
     public class HookInit implements IXposedHookLoadPackage { @Override public void handleLoadPackage ( final XC_LoadPackage.LoadPackageParam lpparam ) throws Throwable { XposedHelpers.findAndHookMethod ( "android.app.ContextImpl", lpparam.classLoader, "checkCallingOrSelfPermission", String.class, new XC_MethodReplacement ( ){ @Override protected Object replaceHookedMethod ( XC_MethodHook.MethodHookParam p1 ) throws Throwable { int i=0; return i; } } ); XposedHelpers.findAndHookMethod ( "android.app.Application", lpparam.classLoader, "attach", Context.class, new XC_MethodHook ( ){ @Override protected void afterHookedMethod ( MethodHookParam param ) throws Throwable { Class <?>wmg=XposedHelpers.findClass ( "android.view.WindowManagerGlobal", lpparam.classLoader ); final Object wm=XposedHelpers.callStaticMethod ( wmg, "getWindowManagerService" ); Method setForcedDisplayDensityForUser=XposedHelpers.findMethodBestMatch ( wm.getClass ( ), "setForcedDisplayDensityForUser", int.class, int.class, int.class ); setForcedDisplayDensityForUser.invoke ( wm, 160, Display.DEFAULT_DISPLAY, AndroidAppHelper.currentApplicationInfo ( ).uid ); } } ); } } 

    目的是想通过 WindowManagerGlobal 获取 WindowManagerService ,然后调用 setForcedDisplayDensityForUser 方法,因为这个方法会用 checkCallingOrSelfPermission 方法检查是否有权限,所以我修改了他的返回值为 0 。 setForcedDisplayDensityForUser 的源码:

     @Override public void setForcedDisplayDensityForUser(int displayId, int density, int userId) { if (mContext.checkCallingOrSelfPermission( android.Manifest.permission.WRITE_SECURE_SETTINGS) != PackageManager.PERMISSION_GRANTED) { throw new SecurityException("Must hold permission " + android.Manifest.permission.WRITE_SECURE_SETTINGS); 

    但这样修改后还是抛出异常"Must hold permission…" 大佬们有没有什么建议

    14 replies    2024-06-26 10:11:48 +08:00
    gzldc
        1
    gzldc  
       Jun 17, 2024
    试试 gp_t
    ColoThor
        2
    ColoThor  
       Jun 17, 2024
    试试我的方法,在 initZygote 方法内添加代码
    ```language
    AndroidActivityManagerHook.getInstance().start();
    ```

    AndroidActivityManagerHook 类,把其中的 xxx.xxx.xxx.xxx,替换为实际的引用包名
    ```language
    public class AndroidActivityManagerHook {
    public static String TAG = AndroidActivityManagerHook.class.getSimpleName();

    public static AndroidActivityManagerHook getInstance() {
    return InstanceUtils.instance;
    }

    private AndroidActivityManagerHook() {

    }

    private static class InstanceUtils {
    private static final AndroidActivityManagerHook instance = new AndroidActivityManagerHook();
    }

    public void start() {
    hookActivityManager(null);
    }

    private void hookActivityManager(ClassLoader classLoader) {
    try {
    String activityManagerClassName = "android.app.ActivityManager";
    Class activityManagerClass = XposedHelpers.findClassIfExists(activityManagerClassName, classLoader);
    if (activityManagerClass != null) {
    XposedBridge.hookAllMethods(activityManagerClass, "checkComponentPermission", new XC_MethodHook() {
    @Override
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
    super.beforeHookedMethod(param);
    try {
    String permission = (String) param.args[0];
    if (TextUtils.isEmpty(permission)) {
    return;
    }

    if (!Manifest.permission.WRITE_SECURE_SETTINGS.equals(permission)) {
    return;
    }

    int uid = (int) param.args[1];
    if (uid == 0) {
    return;
    }

    Context cOntext= AndroidAppHelper.currentApplication().getApplicationContext();
    if (cOntext== null) {
    return;
    }

    String packageName = context.getPackageManager().getNameForUid(uid);
    if ("xxx.xxx.xxx.xxx".equals(packageName)) {
    param.setResult(PackageManager.PERMISSION_GRANTED);
    Log.w(TAG, "access " + permission + " to " + packageName);
    }
    } catch (Exception e) {
    e.printStackTrace();
    Log.e(TAG, param.method.getName() + " error\n" + Log.getStackTraceString(e));
    }
    }
    });
    } else {
    Log.e(TAG, "class not find: " + activityManagerClassName);
    }
    } catch (Exception e) {
    Log.e(TAG, "hookActivityManager error:\n" + Log.getStackTraceString(e));
    }
    }
    }
    ```

    最后别忘了添加作用域 系统框架
    eyeshuaji
        3
    eyeshuaji  
    OP
       Jun 18, 2024
    @ColoThor 没有用啊老哥
    eyeshuaji
        4
    eyeshuaji  
    OP
       Jun 18, 2024
    @ssgooglg gpt 不懂怎么问才准确
    eyeshuaji
        5
    eyeshuaji  
    OP
       Jun 19, 2024
    来个大佬提点建议啊
    Nitsuya
        6
    Nitsuya  
       Jun 19, 2024
    不知道你的需求是怎样的, 代码看上去是改默认屏幕的 dpi, 按理说应该注入 System Server. 孵化应用的时候, 判断包名, 修改全局 Dpi.
    eyeshuaji
        7
    eyeshuaji  
    OP
       Jun 19, 2024
    @Nitsuya 就是想修改 dpi ,咋注入 system server 啊大佬
    Nitsuya
        8
    Nitsuya  
       Jun 19, 2024
    @eyeshuaji
    1.如果你只想全局修改 开发者模式里面直接改.
    2.如果你想 打开某应用触发影响全局 dpi, 注入域 [android] 系统框架, 然后去看 aosp 应用启动流程,卡在 call 应用前调用.
    3.如果只想改某个 app 的 dpi, github 去找项目.
    不知道你的需求是怎样的.
    Nitsuya
        9
    Nitsuya  
       Jun 19, 2024
    针对你提出的问题, 我猜测你注入的是应用, 应用调用这类的 Api, 是 RPC 调用 system server 即 android(系统框架). 权限验证在 server 侧. 我想你可能大概不知道 域 跟 代码跑在哪个进程下的.
    eyeshuaji
        10
    eyeshuaji  
    OP
       Jun 21, 2024 via Android
    @Nitsuya #9 大佬能讲一下域和代码分别分别跑在哪个进程吗
    eyeshuaji
        11
    eyeshuaji  
    OP
       Jun 23, 2024
    @Nitsuya 大佬怎么不回我
    Nitsuya
        12
    Nitsuya  
       Jun 24, 2024
    @eyeshuaji 因为双休. 代码作用域自己体会, 感觉不怎么好讲... 自己多学习多想一下...
    eyeshuaji
        13
    eyeshuaji  
    OP
       Jun 25, 2024
    @Nitsuya #12 意思就是说,权限验证在 android 框架里,只注入 app 是没用的,还要注入 android 系统框架里
    Nitsuya
        14
    Nitsuya  
       Jun 26, 2024
    @eyeshuaji 是的, 因为应用调用系统 api 是 RPC 调用 android server api. 权限验证就在框架侧. 多理解下调用 api 的原理..
    About     Help     Advertise     Blog     API     FAQ     Solana     1004 Online   Highest 6679       Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 41ms UTC 19:03 PVG 03:03 LAX 12:03 JFK 15:03
    Do have faith in what you're doing.
    ubao msn snddm index pchome yahoo rakuten mypaper meadowduck bidyahoo youbao zxmzxm asda bnvcg cvbfg dfscv mmhjk xxddc yybgb zznbn ccubao uaitu acv GXCV ET GDG YH FG BCVB FJFH CBRE CBC GDG ET54 WRWR RWER WREW WRWER RWER SDG EW SF DSFSF fbbs ubao fhd dfg ewr dg df ewwr ewwr et ruyut utut dfg fgd gdfgt etg dfgt dfgd ert4 gd fgg wr 235 wer3 we vsdf sdf gdf ert xcv sdf rwer hfd dfg cvb rwf afb dfh jgh bmn lgh rty gfds cxv xcv xcs vdas fdf fgd cv sdf tert sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf shasha9178 shasha9178 shasha9178 shasha9178 shasha9178 liflif2 liflif2 liflif2 liflif2 liflif2 liblib3 liblib3 liblib3 liblib3 liblib3 zhazha444 zhazha444 zhazha444 zhazha444 zhazha444 dende5 dende denden denden2 denden21 fenfen9 fenf619 fen619 fenfe9 fe619 sdf sdf sdf sdf sdf zhazh90 zhazh0 zhaa50 zha90 zh590 zho zhoz zhozh zhozho zhozho2 lislis lls95 lili95 lils5 liss9 sdf0ty987 sdft876 sdft9876 sdf09876 sd0t9876 sdf0ty98 sdf0976 sdf0ty986 sdf0ty96 sdf0t76 sdf0876 df0ty98 sf0t876 sd0ty76 sdy76 sdf76 sdf0t76 sdf0ty9 sdf0ty98 sdf0ty987 sdf0ty98 sdf6676 sdf876 sd876 sd876 sdf6 sdf6 sdf9876 sdf0t sdf06 sdf0ty9776 sdf0ty9776 sdf0ty76 sdf8876 sdf0t sd6 sdf06 s688876 sd688 sdf86