Android流氓代码块(亲测可行）

来源：互联网发布：华为 acl 端口编辑：程序博客网时间：2024/05/21 22:22

开机自启动（小米需要在安全中心设置自启动）

//在广播中声明  String action = intent.getAction();      if (action.equals("android.intent.action.BOOT_COMPLETED")) {            Intent activity = new Intent(context, SecondActivity.class);            activity.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);            context.startActivity(activity);     }   <receiver android:name=".xxx.xxx">            <intent-filter>                <action android:name="android.intent.action.BOOT_COMPLETED"/>            </intent-filter>  </receiver>  //权限<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>

静默安装（需要root）

    public static boolean installUseRoot(String filePath) {        if (TextUtils.isEmpty(filePath))            throw new IllegalArgumentException("Please check apk file path!");        boolean result = false;        Process process = null;        OutputStream outputStream = null;        BufferedReader errorStream = null;        try {            process = Runtime.getRuntime().exec("su");            outputStream = process.getOutputStream();            String command = "pm install -r " + filePath + "\n";            outputStream.write(command.getBytes());            outputStream.flush();            outputStream.write("exit\n".getBytes());            outputStream.flush();            process.waitFor();            errorStream = new BufferedReader(new InputStreamReader(process.getErrorStream()));            StringBuilder msg = new StringBuilder();            String line;            while ((line = errorStream.readLine()) != null) {                msg.append(line);            }            Log.d(TAG, "install msg is " + msg);            if (!msg.toString().contains("Failure")) {                result = true;            }        } catch (Exception e) {            Log.e(TAG, e.getMessage(), e);        } finally {            try {                if (outputStream != null) {                    outputStream.close();                }                if (errorStream != null) {                    errorStream.close();                }            } catch (IOException e) {                outputStream = null;                errorStream = null;                process.destroy();            }        }        return result;    }

关机代码块（root）

    public static void closeOs(Context context) {        try {            Process proc = Runtime.getRuntime().exec(new String[]{"su", "-c", "reboot -p"});  //关机        } catch (IOException e) {            e.printStackTrace();        }    }

双守护线程保活

public class DaemonService extends Service {    String TAG = "DaemonService";    private DaemonBinder mDaemonBinder;    private DaemonServiceConnection mDaemonServiceConn;    public DaemonService() {    }    @Override    public void onCreate() {        super.onCreate();        mDaemonBinder = new DaemonBinder();        if (mDaemonServiceConn == null) {            mDaemonServiceConn = new DaemonServiceConnection();        }        Log.i(TAG, TAG + " onCreate");    }    @Override    public int onStartCommand(Intent intent, int flags, int startId) {        super.onStartCommand(intent, flags, startId);        Log.i(TAG, TAG + " onStartCommand");        bindService(new Intent(this, RemoteService.class), mDaemonServiceConn, Context.BIND_IMPORTANT);        return START_STICKY;    }    @Nullable    @Override    public IBinder onBind(Intent intent) {        return mDaemonBinder;    }    /**     * 通过AIDL实现进程间通信     */    class DaemonBinder extends IProcessService.Stub {        @Override        public String getServiceName() throws RemoteException {            return TAG;        }    }    /**     * 连接远程服务     */    class DaemonServiceConnection implements ServiceConnection {        @Override        public void onServiceConnected(ComponentName name, IBinder service) {            try {                // 与远程服务通信                IProcessService process = IProcessService.Stub.asInterface(service);                Log.i(TAG, "连接" + process.getServiceName() + "服务成功");            } catch (RemoteException e) {                e.printStackTrace();            }        }        @Override        public void onServiceDisconnected(ComponentName name) {            // RemoteException连接过程出现的异常，才会回调,unbind不会回调            startService(new Intent(DaemonService.this, RemoteService.class));            bindService(new Intent(DaemonService.this, RemoteService.class), mDaemonServiceConn, Context.BIND_IMPORTANT);        }    }}public class RemoteService extends Service {    String TAG = "RemoteService";    private ServiceBinder mServiceBinder;    private RemoteServiceConnection mRemoteServiceConn;    @Override    public void onCreate() {        super.onCreate();        mServiceBinder = new ServiceBinder();        if (mRemoteServiceConn == null) {            mRemoteServiceConn = new RemoteServiceConnection();        }        Log.i(TAG, TAG + " onCreate");    }    @Override    public int onStartCommand(Intent intent, int flags, int startId) {        super.onStartCommand(intent, flags, startId);        Log.i(TAG, TAG + " onStartCommand");        bindService(new Intent(this, DaemonService.class), mRemoteServiceConn, Context.BIND_IMPORTANT);        return START_STICKY;    }    @Nullable    @Override    public IBinder onBind(Intent intent) {        return mServiceBinder;    }    /**     * 通过AIDL实现进程间通信     */    class ServiceBinder extends IProcessService.Stub {        @Override        public String getServiceName() throws RemoteException {            return "RemoteService";        }    }    /**     * 连接远程服务     */    class RemoteServiceConnection implements ServiceConnection {        @Override        public void onServiceConnected(ComponentName name, IBinder service) {            try {                IProcessService process = IProcessService.Stub.asInterface(service);                Log.i(TAG, "连接" + process.getServiceName() + "服务成功");            } catch (RemoteException e) {                e.printStackTrace();            }        }        @Override        public void onServiceDisconnected(ComponentName name) {            // RemoteException连接过程出现的异常，才会回调,unbind不会回调            startService(new Intent(RemoteService.this, DaemonService.class));            bindService(new Intent(RemoteService.this, DaemonService.class), mRemoteServiceConn, Context.BIND_IMPORTANT);        }    }}

//aidl 文件

package com.android.process.aidl;interface IProcessService {    /**     * Demonstrates some basic types that you can use as parameters     * and return values in AIDL.     */    String getServiceName();}

非Root的智能安装（可以）

原文链接：http://blog.csdn.net/fuchaosz/article/details/51852442

原理是用到了android提供的AccessibilityService服务，这个服务可以获取屏幕上的节点，一个节点也就是一个view，我们写的xml文件中每个标签就是一个节点，然后可以模拟用户的操作，对这些节点进行点击、滑动等操作。我们就是利用这个原理，来自动点击安装按钮的，当然使用这个服务必须用户手动开启无障碍服务。

创建AccessibilityService配置文件在res目录下创建xml目录，然后在xml目录下创建一个accessibility_service_config.xml文件，内容如下 res/xml/accessibility_service_config.xml:

<accessibility-service xmlns:android="http://schemas.android.com/apk/res/android"                       android:accessibilityEventTypes="typeAllMask"                       android:accessibilityFeedbackType="feedbackGeneric"                       android:accessibilityFlags="flagDefault"                       android:canRetrieveWindowContent="true"                       android:description="@string/desc"                       android:packageNames="com.android.packageinstaller"    />

accessibilityEventTypes:指定我们在监听窗口中可以模拟哪些事件，typeAllMask表示所有的事件都能模拟.
accessibilityFeedbackType:指定无障碍服务的反馈方式.
canRetrieveWindowContent:指定是否允许我们的程序读取窗口中的节点和内容，当然是true.
description: 当用户手动配置服务时，会显示给用户看.
packageNames: 指定我们要监听哪个应用程序下的窗口活动，这里写com.android.packageinstaller表示监听Android系统的安装界面。其余参数照写即可。 res/strings.xml:

创建AccessibilityService服务

public class MyAccessibilityService extends AccessibilityService {    private static final String TAG = "[TAG]";    private Map<Integer, Boolean> handleMap = new HashMap<>();    @Override    public void onAccessibilityEvent(AccessibilityEvent event) {        AccessibilityNodeInfo nodeInfo = event.getSource();        if (nodeInfo != null) {            int eventType = event.getEventType();            if (eventType == AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED || eventType == AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED) {                if (handleMap.get(event.getWindowId()) == null) {                    boolean handled = iterateNodesAndHandle(nodeInfo);                    if (handled) {                        handleMap.put(event.getWindowId(), true);                    }                }            }        }    }    @Override    public void onInterrupt() {    }    //遍历节点，模拟点击安装按钮    private boolean iterateNodesAndHandle(AccessibilityNodeInfo nodeInfo) {        if (nodeInfo != null) {            int childCount = nodeInfo.getChildCount();            if ("android.widget.Button".equals(nodeInfo.getClassName())) {                String nodeCotent = nodeInfo.getText().toString();                Log.d(TAG, "content is: " + nodeCotent);                if ("安装".equals(nodeCotent) || "完成".equals(nodeCotent) || "确定".equals(nodeCotent)) {                    nodeInfo.performAction(AccessibilityNodeInfo.ACTION_CLICK);                    return true;                }            }            //遇到ScrollView的时候模拟滑动一下            else if ("android.widget.ScrollView".equals(nodeInfo.getClassName())) {                nodeInfo.performAction(AccessibilityNodeInfo.ACTION_SCROLL_FORWARD);            }            for (int i = 0; i < childCount; i++) {                AccessibilityNodeInfo childNodeInfo = nodeInfo.getChild(i);                if (iterateNodesAndHandle(childNodeInfo)) {                    return true;                }            }        }        return false;    }}

AndroidManifest中配置服务

 <service            android:name=".MyAccessibilityService"            android:label="智能安装App"            android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE"            >            <intent-filter>                <action android:name="android.accessibilityservice.AccessibilityService"/>            </intent-filter>            <meta-data                android:name="android.accessibilityservice"                android:resource="@xml/accessibility_service_config"                />        </service>

重点是后面的service标签:

android:label：这个就是用户看到的无障碍服务的名称
android:permission: 需要用到BIND_ACCESSIBILITY_SERVICE这个权限.
action: android.accessibilityservice.AccessibilityService 有了这个action，用户才能在设置里面看到我们的服务，否则用户无法开启我们写的服务，也就不能进到我们写的MyAccessibilityService里面了.所以，注意不要写错了，如果你发现无障碍服务里面没有我们写的服务，请检查这里.

调用智能安装代码

   private void smartInstall() {        Uri uri = Uri.fromFile(new File("/mnt/sdcard/test.apk"));        Intent localIntent = new Intent(Intent.ACTION_VIEW);        localIntent.setDataAndType(uri, "application/vnd.android.package-archive");        startActivity(localIntent);    }

手动配置智能安装服务

//跳转到开启智能安装服务的界面Intent intent = new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS);startActivity(intent);

查看文章：http://blog.csdn.net/fuchaosz/article/details/51852442

8 0