码迷,mamicode.com
首页 > 其他好文 > 详细

Xposed Hook & Anti-hook

时间:2018-10-28 00:11:07      阅读:183      评论:0      收藏:0      [点我收藏+]

标签:sed   classes   包括   绕过   dir   odi   hook   getname   while   

一点简单记录。

xposed原理包括将hook的method转为Native。因此可检测如下:

for (ApplicationInfo applicationInfo : applicationInfoList) {
    if (applicationInfo.processName.equals("com.example.hookdetection")) {        
        Set classes = new HashSet();
        DexFile dex;
        try {
            dex = new DexFile(applicationInfo.sourceDir);
            Enumeration entries = dex.entries();
            while(entries.hasMoreElements()) {
                String entry = entries.nextElement();
                classes.add(entry);
            }
            dex.close();
        } 
        catch (IOException e) {
            Log.e("HookDetection", e.toString());
        }
        for(String className : classes) {
            if(className.startsWith("com.example.hookdetection")) {
                try {
                    Class clazz = HookDetection.class.forName(className);
                    for(Method method : clazz.getDeclaredMethods()) {
                        if(Modifier.isNative(method.getModifiers())){
                            Log.wtf("HookDetection", "Native function found (could be hooked by Substrate or Xposed): " 
+ clazz.getCanonicalName() + "->" + method.getName()); } } } catch(ClassNotFoundException e) { Log.wtf("HookDetection", e.toString()); } } } } }

 

所有xposed插件中,Hook isNative. 由于Hook在先,调用在后,可绕过。

Xposed Hook & Anti-hook

标签:sed   classes   包括   绕过   dir   odi   hook   getname   while   

原文地址:https://www.cnblogs.com/gm-201705/p/9863912.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!