ElderDrivers / EdXposed

Elder driver Xposed Framework.
https://edxp.meowcat.org/
GNU General Public License v3.0
5.4k stars 624 forks source link

[BUG] 有一个静态方法无法hook #136

Closed coderstory closed 5 years ago

coderstory commented 5 years ago

方法原型 public static boolean isSkippedItem(ComponentName cn) { return mSkippedItems.contains(cn); }

hook代码 @Override public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) { final String value = prefs.getString("Hide_App_List", ""); if (!value.equals("")) { final List hideAppList = Arrays.asList(value.split(":")); if (loadPackageParam.packageName.equals("com.miui.home")) { XposedBridge.log("我进来了"); findAndHookMethod("com.miui.home.launcher.LauncherProvider", loadPackageParam.classLoader, "loadSkippedItems", Context.class, new XC_MethodHook() { @Override protected void afterHookedMethod(MethodHookParam param) { HashSet mSkippedItems = (HashSet) XposedHelpers.getObjectField(param.thisObject, "mSkippedItems"); hideAppList.forEach(name -> mSkippedItems.add(new ComponentName(name, name))); XposedBridge.log("我进来了2"); } }); findAndHookMethod("com.miui.home.launcher.LauncherProvider", loadPackageParam.classLoader, "isSkippedItem", ComponentName.class, new XC_MethodReplacement() { @Override protected Object replaceHookedMethod(MethodHookParam param) throws Throwable { ComponentName componentName = (ComponentName) param.args[0]; XposedBridge.log("当前判断" + componentName.getPackageName()); if (hideAppList.contains(componentName.getPackageName())) { XposedBridge.log("我处理了"); return true; } else { return XposedBridge.invokeOriginalMethod(param.method, param.thisObject, param.args); } } }); } } }

edxposed已勾选去除系统代码优化

日志输出: 没有该hook的任何信息处理 上面的一个hook 日志打印出来了 日志分享FC

--------- beginning of head EdXposed Log Powered by Log Catcher QQ chat group 855219808 Now just a little more only just a little more... --------- beginning of system info Android version: 9 Android sdk: 28 Android build: PKQ1.181121.001 Fingerprint: Xiaomi/cepheus/cepheus:9/PKQ1.181121.001/9.3.1:user/release-keys ROM build description: cepheus-user 9 PKQ1.181121.001 9.3.1 release-keys EdXposed Version: 0.3.0.0beta1 Architecture: arm64-v8a Device: cepheus Manufacturer: Xiaomi Brand: Xiaomi Product: cepheus 01-12 13:26:30.535 660 660 I EdXposed-Core-Native: onModuleLoaded: welcome to EdXposed! 01-12 13:26:30.535 660 660 I EdXposed-Core-Native: start to install inline hooks 01-12 13:26:30.535 660 660 I EdXposed-Core-Native: using api level 28 01-12 13:26:30.575 660 660 I EdXposed-Core-Native: using installer com.solohsu.android.edxp.manager 01-12 13:26:30.576 660 660 I EdXposed-Core-Native: black/white list mode: 0 01-12 13:26:30.576 660 660 I EdXposed-Core-Native: dynamic modules mode: 0 01-12 13:26:30.579 660 660 I EdXposed-Core-Native: instrCst hooked 01-12 13:26:30.581 660 660 I EdXposed-Core-Native: disableHiddenAPIPolicyImpl done. 01-12 13:26:30.581 660 660 I EdXposed-Core-Native: install inline hooks done 01-12 13:26:30.584 661 661 I EdXposed-Core-Native: onModuleLoaded: welcome to EdXposed! 01-12 13:26:30.584 661 661 I EdXposed-Core-Native: start to install inline hooks 01-12 13:26:30.584 661 661 I EdXposed-Core-Native: using api level 28 01-12 13:26:30.613 661 661 I EdXposed-Core-Native: using installer com.solohsu.android.edxp.manager 01-12 13:26:30.613 661 661 I EdXposed-Core-Native: black/white list mode: 0 01-12 13:26:30.613 661 661 I EdXposed-Core-Native: dynamic modules mode: 0 01-12 13:26:30.614 661 661 I EdXposed-Core-Native: instrCst hooked 01-12 13:26:30.615 661 661 I EdXposed-Core-Native: disableHiddenAPIPolicyImpl done. 01-12 13:26:30.615 661 661 I EdXposed-Core-Native: install inline hooks done 01-12 13:26:30.656 660 660 I EdXposed-Core-Native: instrCst starts 01-12 13:26:30.656 660 660 I EdXposed-Core-Native: instrCst finishes 01-12 13:26:30.656 660 660 I EdXposed-Core-Native: instru changed from 0x0 to 0x77d4e6c828 01-12 13:26:30.666 661 661 I EdXposed-Core-Native: instrCst starts 01-12 13:26:30.666 661 661 I EdXposed-Core-Native: instrCst finishes 01-12 13:26:30.666 661 661 I EdXposed-Core-Native: instru_ changed from 0x0 to 0xefcb5608 03-06 19:12:33.303 660 660 I EdXposed-Bridge: Loading modules from /data/app/com.coderstory.Purify-USaUcWLXE_xlyKhMEBS47g==/base.apk 03-06 19:12:33.373 660 660 I EdXposed-Bridge: Loading class com.coderstory.Purify.plugins.start 03-06 19:12:33.375 660 660 I EdXposed-Bridge: 小米净化 2.x 开始Patch 03-06 19:12:41.263 661 661 I EdXposed-Bridge: Loading modules from /data/app/com.coderstory.Purify-USaUcWLXE_xlyKhMEBS47g==/base.apk 03-06 19:12:41.324 661 661 I EdXposed-Bridge: Loading class com.coderstory.Purify.plugins.start 03-06 19:12:41.328 661 661 I EdXposed-Bridge: 小米净化 2.x 开始Patch 03-06 19:12:41.811 2325 2325 I EdXposed-Bridge: 我进来了 03-06 19:12:42.582 2325 2783 I EdXposed-Bridge: 我进来了2 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: error when hooking LoadedApk.: pkg=com.miui.securitycenter, prc=com.miui.securitycenter 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: java.lang.NullPointerException 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at java.io.File.(File.java:283) 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at dalvik.system.DexPathList.addNativePath(DexPathList.java:617) 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at dalvik.system.BaseDexClassLoader.addNativePath(BaseDexClassLoader.java:201) 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at android.app.ApplicationLoaders.addNative(ApplicationLoaders.java:134) 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at android.app.LoadedApk.createOrUpdateClassLoaderLocked(LoadedApk.java:744) 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at android.app.LoadedApk.getClassLoader(LoadedApk.java:812) 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at com.elderdrivers.riru.xposed.d.b.b.hook(Unknown Source:170) 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at android.app.ContextCompat.createLoadedApk(Unknown Source:101) 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at android.app.ContextCompat.createApplicationContext(Unknown Source:0) 03-06 19:12:45.867 3339 4198 E EdXposed-Fwk: at com.miui.securitycenter.dynamic.ApkLoader.getDynamicC

到这里 我不知道该怎么处理了 求帮助

solohsu commented 5 years ago

如果hook不到说明目标方法有可能被内联了。 不过我试了下我这边可以。 去除系统代码优化只会对framework中的代码生效(实际上是只对BOOTCLASSPATH下的代码生效) 你这个是个系统app,并不属于BootImage。 可以尝试用speed编译一下这个app,看有没有效。

2850-3494/? I/EdXposed-Bridge: 当前判断com.xiaomi.youpin
2850-3494/? I/EdXposed-Bridge: 我处理了
2850-3494/? I/EdXposed-Bridge: 当前判断com.ximalaya.ting.android
2850-3494/? I/EdXposed-Bridge: 我处理了
2850-3494/? I/EdXposed-Bridge: 当前判断com.xunmeng.pinduoduo
2850-3494/? I/EdXposed-Bridge: 我处理了
2850-3494/? I/EdXposed-Bridge: 当前判断com.yidian.xiaomi
rxzcums commented 5 years ago

原来是小米净化的作者,支持各位大佬。

coderstory commented 5 years ago

如果hook不到说明目标方法有可能被内联了。 不过我试了下我这边可以。 去除系统代码优化只会对framework中的代码生效(实际上是只对BOOTCLASSPATH下的代码生效) 你这个是个系统app,并不属于BootImage。 可以尝试用speed编译一下这个app,看有没有效。

2850-3494/? I/EdXposed-Bridge: 当前判断com.xiaomi.youpin
2850-3494/? I/EdXposed-Bridge: 我处理了
2850-3494/? I/EdXposed-Bridge: 当前判断com.ximalaya.ting.android
2850-3494/? I/EdXposed-Bridge: 我处理了
2850-3494/? I/EdXposed-Bridge: 当前判断com.xunmeng.pinduoduo
2850-3494/? I/EdXposed-Bridge: 我处理了
2850-3494/? I/EdXposed-Bridge: 当前判断com.yidian.xiaomi

1.刷了第三方的rom 【已全局deodex的】发现能正常hook 官方的全局odex的rom 默认无法hook

2.D:\software\APKDB\Tools\ADB>adb shell cmd package compile -m speed -f com.miui.home

执行后重启发现成功了

针对这个问题 仅插件能解决这个问题吗? 或者edxposed能解决这个问题么? 或者修改默认编译模式?

solohsu commented 5 years ago

@coderstory

  1. 你重新编译后看下 /data/dalvik-cache/ 下有没有 system@priv-app@MiuiHome@ 开头的文件。奇怪我这里强制编译没有效果。
  2. 解决的话一种方法是把 /system/priv-app/MiuiHome/oat 里面的已编译文件清掉,修改全局编译模式为speed的话的问题是会导致所有app都speed编译了,会占用太多的内存空间。也还在找有没有什么简单的方式来解决。
coderstory commented 5 years ago

1.存在一个对应的dex和vdex (如果你覆盖安装miuihome的情况下 则不存在 但也有效) 我的是MIUI10 android 9.0 可能和系统有关

solohsu commented 5 years ago

@coderstory 覆盖安装的话应该会触发dex2oat重新编译了,这时候就能去掉内联了。因为EdXposed给dex2oat加了个参数--inline-max-code-units=0 其实核心就在于如何让它重新编译,只要它重新编译就能解决内联的问题了。

coderstory commented 5 years ago

清空dalvik缓存行不行?

solohsu commented 5 years ago

清空dalvik缓存行不行?

很多系统APP都没有dalvik缓存吧,直接用的同目录下的oat文件夹里已编译的odex。 可以把这个oat文件夹删了,但是如果有些系统app的apk里没有classes.dex,也没法重新编译。 不过可以自己把oat目录下的vdex文件解压出classes.dex,然后塞回apk里,替换原来的apk,这样有了原始的dex,就可以重新编译了。 如果不想直接修改system分区,可以制作一个magisk模块来替换相关文件。