API Hook总结之一

6,API Hook总结

实际上, droidplugin框架一共Hook了十多个服务对应的API接口, ServiceManager和LocationManager API的Hook

在前面已经详细论述了。

这些Hook一般都是在HookFactory的installHook方法中构造和安装的。

其实主要就是三要素,Hook类, Hook 代理类以及Hook 方法实现类。

6.1, AudioManager分析

结构图如下,

Hook 类

IAudioServiceBinderHook

Hook 代理类

IAudioServiceHookHandle

 

 

 

 

Hook 方法实现类

adjustVolume

adjustLocalOrRemoteStreamVolume

adjustSuggestedStreamVolume

adjustStreamVolume

adjustMasterVolume

setStreamVolume

setMasterVolume

requestAudioFocus

registerRemoteControlClient

IAudioServiceHookHandle的内部类MyBaseHandler的beforeInvoke方法如下,

protected boolean beforeInvoke(Object receiver, Method method, Object[] args) throws Throwable {            if (VERSION.SDK_INT >= VERSION_CODES.KITKAT) {                if (args != null && args.length > 0) {                    for (int index = 0; index < args.length; index++) {                        if (args[index] instanceof String) {                            String callingPkg = (String) args[index];                            if (!TextUtils.equals(callingPkg, mHostContext.getPackageName()) && PluginManager.getInstance().isPluginPackage(callingPkg)) {                                args[index] = mHostContext.getPackageName();                            }                        }                    }                }            }            return super.beforeInvoke(receiver, method, args);        }

也是修改PackageName参数。

6.2, Clipboard Hook

结构图如下,

Hook 类

IClipboardBinderHook

Hook 代理类

IClipboardHookHandle

 

 

 

 

Hook 方法实现类

setPrimaryClip

getPrimaryClip

getPrimaryClipDescription

hasPrimaryClip

addPrimaryClipChangedListener

removePrimaryClipChangedListener

hasClipboardText

IClipboardHookHandle的内部类MyBaseHookedMethodHandler的beforeInvoke方法如下,

protected boolean beforeInvoke(Object receiver, Method method, Object[] args) throws Throwable {            if (args != null && args.length > 0 && args[args.length - 1] instanceof String) {                String pkg = (String) args[args.length - 1];                if (!TextUtils.equals(pkg, mHostContext.getPackageName())) {                    args[args.length - 1] = mHostContext.getPackageName();                }            }            return super.beforeInvoke(receiver, method, args);        }