Database Develop

[Q] Modifying notification

Hi folks,
even though there are many nice 3rd party twitter clients available they are all missing an important feature: push notifications using GCM. The original Twitter app offers GCM based notifications but the app itself is more or less crap.
Therefore I thought about utilizing the original Twitter app for receiving GCM messages which create the Android notifications and then modify these notifications so that another (3rd party) app is started when clicking on them. I already managed to hook into the NotificationManager:
Code:
XposedHelpers.findAndHookMethod(android.app.NotificationManager.class, "notify", String.class, int.class, Notification.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("NotificationManager.beforeHookedMethod(): param=" + param);
for (Object o : param.args) {
if (o instanceof Notification) {
Notification n = (Notification) o;
XposedBridge.log("NotificationManager.beforeHookedMethod(): notification=" + n);
}
}
}
}
);
At this stage, where simple things as changing Notification.tickeText work, I tried the following:
1) Creating a new PendingIntent and assigning it to Notification.contentIntent:
Code:
Intent LaunchIntent = context.getPackageManager().getLaunchIntentForPackage("it.mvilla.android.fenix");
PendingIntent contentIntent = PendingIntent.getActivity(context, 0, LaunchIntent, 0);
n.contentIntent = contentIntent;
This fails due to the fact that I did not succeed in getting my hand on a Context instance. Does anyone have got an idea on how to get a Context instance or can provide another possibility for creating the PendingIntend without a Context?
2) As the previous did not work due to a missing Context I tried to change the LauchIntent of the existing Notification. But I was not able to find the correct place - I did not even find the original LaunchIntent when studying the sources or even by dumping the notification by reflection.
I also started investigating on how to hook into the Twitter app itself. But as the source code is (of course) not public and additionally is obfuscated this seems to be even more complicated. In addition hooking into the NotificationManager is more generic and would allow - when adding configuration - the redirection also for other sources and targets.
As you see, I am somehow stucked. But I'm not hopeless respectively cannot imaging that it should not be possible. So now it's up to you to feed me with the correct ideas
So far and thanks in advance,
yaan04

yaan04 said:
1) Creating a new PendingIntent and assigning it to Notification.contentIntent:
This fails due to the fact that I did not succeed in getting my hand on a Context instance. Does anyone have got an idea on how to get a Context instance or can provide another possibility for creating the PendingIntend without a Context?
Click to expand...
Click to collapse
AndroidAppHelper.currentApplication() should do the trick. Otherwise see this, though if AndroidAppHelper fails most of these probably will, too.
yaan04 said:
2) As the previous did not work due to a missing Context I tried to change the LauchIntent of the existing Notification. But I was not able to find the correct place - I did not even find the original LaunchIntent when studying the sources or even by dumping the notification by reflection.
Click to expand...
Click to collapse
LaunchIntent?
yaan04 said:
I also started investigating on how to hook into the Twitter app itself. But as the source code is (of course) not public and additionally is obfuscated this seems to be even more complicated. In addition hooking into the NotificationManager is more generic and would allow - when adding configuration - the redirection also for other sources and targets.
Click to expand...
Click to collapse
Android API calls won't be obfuscated. Try searching for "NotificationManager" for example and see where it's used.

Yeah, AndroidAppHelper.currentApplication() provides a usable Context instance \o/
Thanks, GermainZ. Now I can go on...

[Q] Sending information from hooks TO the settings screen?

I've read a couple of threads on the "context" that my module runs in, but I'm not clear on how I send data from my module (running in the hooked application context) back to my settings screen (running in the Xposed context?)
XSharedPreferences is obviously read only, so that doesn't work. I'm guessing I need to write to a file and parse it back from settings, but I'm hoping someone can set me in the right direction. Is there a module that already does this so I can look at the source? Or can someone give me a high level of the file permissions/location/settings to use so that it's readable/writable from both contexts?
Thanks!
Ryan

I'd say your best option is to register a broadcast receiver in your app, and send a broadcast from the hooked app (you just need a Context to do that.
If you can't get one from the app, you could use AndroidAppHelper.currentApplication()).

GermainZ said:
I'd say your best option is to register a broadcast receiver in your app, and send a broadcast from the hooked app (you just need a Context to do that.
If you can't get one from the app, you could use AndroidAppHelper.currentApplication()).
Click to expand...
Click to collapse
Thank you! I got it. I guess that was obvious, but it seemed like there might be a "tighter" way to do the cross-process communication using Xposed as a bridge.
Thanks for all of your help in this forum,
Ryan

Put Settings from hook

Hook is in PhoneWindowManager class, I need to put a value to Settings.System. ContentResolver from the available mContext variable is used.
I get the following:
Code:
InvocationTargetError: java.lang.SecurityException: Package android does not belong to 10036
10036 is UID of my module.

- Which context did you use to get content resolver?
- Depends on where your hook is.
Although your hook is in phone window manager, it still depends from where method you are hooking was called from. If it was called from different package that has different permissions (such as your module app), you will have to clear an identity of calling package while using system settings.
Something like:
Code:
long ident = Binder.clearCallingIdentity();
try {
// store to system settings or whatever
} finally {
Binder.restoreCallingIdentity(ident);
}
- Another option is to add necessary permission to your module's manifest

My module already has WRITE_SETTINGS permission. I use mContext variable that is available in PhoneWindowManager, never had a problem with it. Calling from a separate thread that is created in screenTurnedOff() method.
PhoneWindowManager has a lot of similar code involving Settings.System:
Code:
android.provider.Settings.System.putIntForUser(mContext.getContentResolver(), "screen_brightness_mode", 0, -3);
I tried ...ForUser methods with -2, -3 and 1000 UIDs - still the same error. Regular methods should use current process UID, so it's 1000 anyway.
No idea how it still knows that Xposed module is involved, code is supposed to be executed as if it's a part of a hooked app.
But I guess it knows) so clearing calling identity works perfectly, thanks.

I assume thread in screenTurnedOff you mentioned is your own you created? If yes, then for some reason thread in which runs phone window manager is thinking it's some kind of a foreign thread although created within phone window manager. Question is where screenTurnedOff was called from. If it's an IPC call then it's clear it has different identity. If it's not that case then it's definitely strange.

C3C076 said:
Question is where screenTurnedOff was called from. If it's an IPC call then it's clear it has different identity. If it's not that case then it's definitely strange.
Click to expand...
Click to collapse
screenTurnedOff is a stock method, it's called whenever it's called Definitely not from my module. I bet there is an explanation, something complicated)

[Q] Hook and run outside

Hello,
Im looking to hook a method(gaining some info) and then execute command externally from the hook. Is there a way to run code from the xposed module app after the hook is applied?

Yes,
If method from class then XposedHelpers.callMethod(params);
If from helper (nothing with UI, activity, etc) then simply Helper.doSomething()
If something other, try to use intents (broadcast intent after executing method, receive it via receiver and perform your code.

[Q] call startService from hook method

Hello,
I've succeeded to hook method that gives me the accelerometer events.
so now all the application which use the accelerometer are generating events.
I wanted to send all those events from the hooking method to a service using intents that will aggregate them
and write them into a sqlite db (the db is not relevant for now, only the service).
The problem is that i can't start the intentService from the hook method.
Things that i tried already:
-- getting the Context from the activity on load by hooking the onStart in the Activity.class (succeeded getting the context but not starting the Service with an intent)
-- using the same context as above but start a broadcast receiver with implicit intent (define intent-filter in the manifest), and from the
broadcast to start the service (not worked either, the broadcast never got the sent message)
is there some guide or tutorial that can show me how to start a service or broadcast receiver from the hook method?
thanks ahead...

- make sure your service is defined in the manifest
- instead of IntentService, consider using standard service to which you can bind using context.bindService together with ServiceConnection object (see developer.android.com). You can use messenger approach for data exchange. This would be more efficient in your case.
As an example, I am using that approach in the following scenario:
I need to process screenshot taken during screen off in DisplayPowerController using my application context as I need to write image file within my module's filesDir
- I have a service within my module that receives image data and writes them to a file.
- I am binding to this service using bindService from within DisplayPowerController. It sends image data in chunks.
See this commit for more info:
https://github.com/GravityBox/GravityBox/commit/ad09553eaf0c669c4dcb8233a6b9706d1d939761

Call from other app context
First thanks for your answer,
Just to make it clear lets say i don't have any application,
i want to make some monitoring module on my phone which record all the Accelerometer events
request by different apps installed on my phone.
So there is general hook that tracking all the Accelerometer events, but when from those apps
or hook (the apps not mine but some apps i downloaded from the google play store), i want to
start a service or broadcast using their app context (taken from the activity or something).
The broadcast or service will not start (i think something with sandbox or that the apps and the service are not under the same context)
**that what i understood, maybe it's just some mistake in my code**
For example that some test i made:
Main Hook class:
public class TestHook implements IXposedHookLoadPackage{
@override
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
XposedBridge.hookAllMethods(Activity.class,"onStart", new XC_MethodHook()
{
@override
protected void beforeHookedMethod(MethodHookParam param)
throws Throwable {
Context context = (Context)param.thisObject;
if(context != null){
XposedBridge.log("sending brod...");
context.sendBroadcast(new Intent("com.example.logging"));
} else {
XposedBridge.log("not sending");
}
}
});
}
}
The receiver:
public class BrodTest extends BroadcastReceiver{
@override
public void onReceive(Context context, Intent intent) {
// TODO Auto-generated method stub
Toast.makeText(context, "Got BroadCast", Toast.LENGTH_LONG).show();
}
}
and the manifest:
<manifest xmlns:android=
package="com.example.testproject"
android:versionCode="1"
android:versionName="1.0" >
<uses-sdk
android:minSdkVersion="14"
android:targetSdkVersion="19" />
<application
android:allowBackup="true"
android:icon="@drawable/ic_launcher"
android:label="@string/app_name"
android:theme="@style/AppTheme" >
<receiver android:name=".BrodTest">
<intent-filter>
<action android:name="com.example.logging"/>
</intent-filter>
</receiver>
<!--Declaration of the Xposed framework -->
<meta-data
android:name="xposedmodule"
android:value="true" />
<meta-data
android:name="xposedminversion"
android:value="30+" />
<meta-data android:name="xposeddescription"
android:value="Recording Sensors and Transmission events"/>
</application>
</manifest>
just tried to make some hook that will send to broadcast and show Toast message...
Thanks again...

I don't see anything wrong with the code. It should work.
Do you get a log message that the broadcast was sent?

Exported receiver?

Receiver log
The log shows me the sending message to the receiver so i know i have the context correctly,
and i at first put my broadcast exported to false, but than i thought about permissions problem
so i deleted the exported attribute for being exported=true by default..
bottom line, i see the logs messages but not the toast that the receiver should show me...
if there is any other suggestions i be grateful,
thx

Try creating a different receiver with a different class name. Try using fully qualified class name. Also make sure to change intent action string for a new one. Use something more standard like "testproject.intent.action.LOGGING".
Maybe something got messed up while you were changing receiver properties.
This info from doc is interesting:
android:name
Once you publish your application, you*should not change this name*(unless you've setandroid:exported="false").
Click to expand...
Click to collapse
Regarding "exported" attribute. Safely omit it as it defaults to true automatically when you have intent-filter defined.
And maybe also try Log.d() instead of toast and check logcat.

Log.d
about the Log.d you suggested, when i run even with debug mode from eclipse and install the new module
its require me to restart the phone first, how can i debug like normal application?
when i restart the phone the adb is closed and i loose the debugging ability?
thanks anyway i will try it out...

Use adb logcat from command line.