Database Develop

[Q] Xposed | Before and After Hooks are not being called

Hello,
I'm trying to create my own first xposed module after completing the tutorial successfully
What I'm trying to do is to hook the sendTextMessage from the class android.telephony.SmsManager
I've a modified ROM, so i added logs to this API and I see that when I'm sending SMS, i enter this API for sure.
I also know that the class loading and method getting works fine, but the before and after hooks are not called...
this is my module code:
Code:
package com.example.xpossedexample;
import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;
import android.app.PendingIntent;
import android.graphics.Color;
import android.os.Message;
import android.widget.TextView;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XC_MethodHook.MethodHookParam;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
public class Smstry implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
// XposedBridge.log("handleLoadPackage:: Enter:: package name is:: " + lpparam.packageName);
if (!lpparam.packageName.equals("android")) {
// XposedBridge.log("not android package");
return;
}
XposedBridge.log("this is android package");
findAndHookMethod("android.telephony.SmsManager", lpparam.classLoader, "sendTextMessage",String.class,String.class,String.class,PendingIntent.class,PendingIntent.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("Enter:: before sendTextMessage hook");
}
});
}
}
any idea why the hooks are not called? any good way to debug this?
Thanks,
Gidi

Is the method being hooked correctly? Check your Xposed log and see if there are any errors. If not, then that method probably isn't getting called.
PS. You may want to use IXposedHookZygote/initZygote instead of IXposedHookLoadPackage/handleLoadPackage for "android".

GermainZ said:
Is the method being hooked correctly? Check your Xposed log and see if there are any errors. If not, then that method probably isn't getting called.
PS. You may want to use IXposedHookZygote/initZygote instead of IXposedHookLoadPackage/handleLoadPackage for "android".
Click to expand...
Click to collapse
Hi,
Thanks for your reply.
from the test i did, the method is being correctly hooked, there are no errors in the logs.
The method is definitely being called, I added logs to the original method, so I see that it's being called.
Since i need to hook this method, I'm not sure if IXposedHookZygote/initZygote will work here (at least from the examples i saw).
can I use IXposedHookZygote/initZygote to hook a method?
Thanks,
Gidi

Ok, I managed to hook my method as you suggested.
Now, I've a problem I don't understand.
in AOSP, there's a class called RIL (com.android.internal.telephony.RIL), when i try to hook it, and give it as com.android.internal.telephony.RIL.class, I get an error, the IDE doesn't recognize this class (only com.android.internal.util) can be found...
any idea?
Thanks,
Gidi

shnapsi said:
Ok, I managed to hook my method as you suggested.
Now, I've a problem I don't understand.
in AOSP, there's a class called RIL (com.android.internal.telephony.RIL), when i try to hook it, and give it as com.android.internal.telephony.RIL.class, I get an error, the IDE doesn't recognize this class (only com.android.internal.util) can be found...
any idea?
Thanks,
Gidi
Click to expand...
Click to collapse
Use "com.android.internal.telephony.RIL" (as a string).

GermainZ said:
Use "com.android.internal.telephony.RIL" (as a string).
Click to expand...
Click to collapse
Thanks, but then i need to give a classLoader as a parameter which i don't have when i'm using initZygote method.
Have i missed something?

shnapsi said:
Thanks, but then i need to give a classLoader as a parameter which i don't have when i'm using initZygote method.
Have i missed something?
Click to expand...
Click to collapse
I found the solution: i'm using the startupParam class's classloader
startupParam.getClass().getClassLoader(),
Thanks a lot!

If you're using initZygote the classloader argument can be null as well.

GermainZ said:
If you're using initZygote the classloader argument can be null as well.
Click to expand...
Click to collapse
So now I'm confused...
In that case, if i want to hook this specific method (or method located in packages that are not recognized, it's better to use handleLoadPackage and not initZygote?

No, just replace "startupParam.getClass().getClassLoader()" by "null".

GermainZ said:
No, just replace "startupParam.getClass().getClassLoader()" by "null".
Click to expand...
Click to collapse
Sorry, now i lost you completely

shnapsi said:
Sorry, now i lost you completely
Click to expand...
Click to collapse
Here's an example that should show the difference clearly. Both methods (initZygote and handleLoadPackage) will have the same effect (this is only true if you're hooking the "android" package; if you're hooking anything else, you must use handleLoadPackage).
Java:
public class XposedMod implements IXposedHookLoadPackage, IXposedHookZygoteInit {
[PLAIN]@Override[/PLAIN]
public void initZygote(StartupParam startupParam) throws Throwable {
XC_MethodHook myHook = new XC_MethodHook() {
[PLAIN]@Override[/PLAIN]
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
// Do something.
}
};
findAndHookMethod(SomeSdkClass.class, "methodName", myHook);
findAndHookMethod("SomeOtherClass", null , "methodName", myHook);
}
[PLAIN]@Override[/PLAIN]
public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
if (!lpparam.packageName.equals("android"))
return;
XC_MethodHook myHook = new XC_MethodHook() {
[PLAIN]@Override[/PLAIN]
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
// Do something.
}
};
findAndHookMethod(SomeSdkClass.class, "methodName", myHook);
findAndHookMethod("SomeOtherClass", lpparam.classLoader , "methodName", myHook);
}
}

GermainZ said:
Here's an example that should show the difference clearly. Both methods (initZygote and handleLoadPackage) will have the same effect (this is only true if you're hooking the "android" package; if you're hooking anything else, you must use handleLoadPackage).
Java:
public class XposedMod implements IXposedHookLoadPackage, IXposedHookZygoteInit {
[PLAIN]@Override[/PLAIN]
public void initZygote(StartupParam startupParam) throws Throwable {
XC_MethodHook myHook = new XC_MethodHook() {
[PLAIN]@Override[/PLAIN]
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
// Do something.
}
};
findAndHookMethod(SomeSdkClass.class, "methodName", myHook);
findAndHookMethod("SomeOtherClass", null , "methodName", myHook);
}
[PLAIN]@Override[/PLAIN]
public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
if (!lpparam.packageName.equals("android"))
return;
XC_MethodHook myHook = new XC_MethodHook() {
[PLAIN]@Override[/PLAIN]
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
// Do something.
}
};
findAndHookMethod(SomeSdkClass.class, "methodName", myHook);
findAndHookMethod("SomeOtherClass", lpparam.classLoader , "methodName", myHook);
}
}
Click to expand...
Click to collapse
Thanks a lot!!! :laugh:

Replace method. Need help. PLease

Hi everyone. I ask for help. I literally beg for it..
com.android.dialer.dialpad.LatinSmartDialMap
You can see it here http://grepcode.com/file/repository...id/dialer/dialpad/LatinSmartDialMap.java?av=f
I only want to replace method . Any of them.
For example I want this method returns FALSE every time it's called.
Code:
@Override
public boolean isValidDialpadAlphabeticChar(char ch) {
return (ch >= 'a' && ch <= 'z');
}
Here is my code
Code:
public class Fm implements IXposedHookLoadPackage {
public void handleLoadPackage(final LoadPackageParam loadpkg) throws Throwable {
if (loadpkg.packageName.equals("com.android.dialer")) {
ClassLoader classLoader = loadpkg.classLoader;
XC_MethodReplacement methodreplacer = new XC_MethodReplacement() {
protected Object replaceHookedMethod(
XC_MethodHook.MethodHookParam paramAnonymousMethodHookParam)
throws Throwable {
XposedBridge.log("ALLLLL RIGHTTTT . NOW We ARE IN. AND MADE IT FALSe");
return false;
}
};
XposedHelpers.findAndHookMethod("com.android.dialer.dialpad.LatinSmartDialMap", loadpkg.classLoader,
"[COLOR="Red"]isValidDialpadAlphabeticChar[/COLOR]", Character.class, methodreplacer);
}
}
}
But this doesn't work
Here what I see in xposed log file:
java.lang.NoSuchMethodError: com.android.dialer.dialpad.LatinSmartDialMap#isValidDialpadAlphabeticChar(java.lang.Character)#exact
at de.robv.android.xposed.XposedHelpers.findMethodExact(XposedHelpers.java:179)
at de.robv.android.xposed.XposedHelpers.findAndHookMethod(XposedHelpers.java:129)
at de.robv.android.xposed.XposedHelpers.findAndHookMethod(XposedHelpers.java:136)
at com.s0bes.fmspeaker.Fm.handleLoadPackage(Fm.java:30)
at de.robv.android.xposed.IXposedHookLoadPackage
BUUUT. If I will try to replace other method. For example
matchesCombination in com.android.dialer.dialpad.SmartDialNameMatcher (http://grepcode.com/file/repository...dialer/dialpad/SmartDialNameMatcher.java?av=f)
Here the part of code which was changed:
Code:
XposedHelpers.findAndHookMethod("com.android.dialer.dialpad.SmartDialNameMatcher", loadpkg.classLoader,
"matchesCombination", String.class, String.class, ArrayList.class, methodreplacer);
Now everything work...
So, it works with one thing and doesnt work with method I need

If you want to replace a method to return a consatnt, you can use the XC_MethodReplacement.returnConstant(…) shortcut. For example:
Java:
XposedHelpers.findAndHookMethod("com.android.dialer.dialpad.SmartDialNameMatcher", loadpkg.classLoader,
"matchesCombination", String.class, String.class, ArrayList.class, XC_MethodReplacement.returnConstant(false));
As for your problem, you're trying to hook isValidDialpadAlphabeticChar(Character.class), but you should be hooking isValidDialpadAlphabeticChar(char.class). Just replace "Character.class" by "char.class" in your findAndHookMethod call.

[Q] Grant an app more permissions than it requests [solved]

I have one app which can call java functions from scripts defined at runtime, but has not enough permissions to do most of the stuff, like toggling wifi.
So I tried to create a module hooking the Packagemanager to grant these permissions.
My code so far:
Code:
public class Hook implements IXposedHookLoadPackage, IXposedHookZygoteInit {
ArrayList<String> newPerms;
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
if(!loadPackageParam.packageName.equals("android"))return;
final Class<?> clsPMS = findClass("com.android.server.pm.PackageManagerService", loadPackageParam.classLoader);
XC_MethodHook hookGrantPermissions = new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
String pkgName = (String) getObjectField(param.args[0], "packageName");
if(!(pkgName.equals(Strings.LLX)||pkgName.equals(Strings.LL)))return;
//XposedBridge.log("Package: "+pkgName);
if(newPerms == null || newPerms.isEmpty() ) return;
ArrayList<String> origRequestedPermissions = (ArrayList<String>) getObjectField(param.args[0], "requestedPermissions");
param.setObjectExtra("orig_requested_permissions", origRequestedPermissions);
//XposedBridge.log("Old Permissions "+Arrays.toString(origRequestedPermissions.toArray()));
//XposedBridge.log("New Permissions "+Arrays.toString(newPerms.toArray()));
ArrayList<String> newRequestedPermissions = new ArrayList<>(origRequestedPermissions);
newRequestedPermissions.addAll(newPerms);
//XposedBridge.log("All Permissions"+Arrays.toString(newRequestedPermissions.toArray()));
//param.args[1] = true;
[U][B]setObjectField(param.args[0], "requestedPermissions", newRequestedPermissions);[/B][/U]
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
ArrayList<String> origRequestedPermissions = (ArrayList<String>) param.getObjectExtra("orig_requested_permissions");
if (origRequestedPermissions != null)
setObjectField(param.args[0], "requestedPermissions", origRequestedPermissions);
}
};
if (Build.VERSION.SDK_INT < 21) {
findAndHookMethod(clsPMS, "grantPermissionsLPw", "android.content.pm.PackageParser$Package", boolean.class, hookGrantPermissions);
} else {
findAndHookMethod(clsPMS, "grantPermissionsLPw", "android.content.pm.PackageParser$Package", boolean.class, String.class, hookGrantPermissions);
}
}
@Override
public void initZygote(StartupParam startupParam) throws Throwable {
XSharedPreferences pref = new XSharedPreferences(this.getClass().getPackage().getName(), Strings.PREF_NAME);
pref.makeWorldReadable();
newPerms = Strings.read(pref);
}
Sidenote: Code is partially forked from Appsettings module: https://github.com/rovo89/XposedAppSettings
The problem is: when I restart my phone after enabling the module, I just get a blackscreen after the bootanimation.
When I comment out the line marked fat underlined, it works, but does nothing (because this line is essential).
I have practically no idea why this isn't working.
I know that the input returned from Strings.read is valid.
My Question: What am I doing wrong?

LM13 said:
I have one app which can call java functions from scripts defined at runtime, but has not enough permissions to do most of the stuff, like toggling wifi.
So I tried to create a module hooking the Packagemanager to grant these permissions.
My code so far:
Code:
public class Hook implements IXposedHookLoadPackage, IXposedHookZygoteInit {
ArrayList<String> newPerms;
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
if(!loadPackageParam.packageName.equals("android"))return;
final Class<?> clsPMS = findClass("com.android.server.pm.PackageManagerService", loadPackageParam.classLoader);
XC_MethodHook hookGrantPermissions = new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
String pkgName = (String) getObjectField(param.args[0], "packageName");
if(!(pkgName.equals(Strings.LLX)||pkgName.equals(Strings.LL)))return;
//XposedBridge.log("Package: "+pkgName);
if(newPerms == null || newPerms.isEmpty() ) return;
ArrayList<String> origRequestedPermissions = (ArrayList<String>) getObjectField(param.args[0], "requestedPermissions");
param.setObjectExtra("orig_requested_permissions", origRequestedPermissions);
//XposedBridge.log("Old Permissions "+Arrays.toString(origRequestedPermissions.toArray()));
//XposedBridge.log("New Permissions "+Arrays.toString(newPerms.toArray()));
ArrayList<String> newRequestedPermissions = new ArrayList<>(origRequestedPermissions);
newRequestedPermissions.addAll(newPerms);
//XposedBridge.log("All Permissions"+Arrays.toString(newRequestedPermissions.toArray()));
//param.args[1] = true;
[U][B]setObjectField(param.args[0], "requestedPermissions", newRequestedPermissions);[/B][/U]
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
ArrayList<String> origRequestedPermissions = (ArrayList<String>) param.getObjectExtra("orig_requested_permissions");
if (origRequestedPermissions != null)
setObjectField(param.args[0], "requestedPermissions", origRequestedPermissions);
}
};
if (Build.VERSION.SDK_INT < 21) {
findAndHookMethod(clsPMS, "grantPermissionsLPw", "android.content.pm.PackageParser$Package", boolean.class, hookGrantPermissions);
} else {
findAndHookMethod(clsPMS, "grantPermissionsLPw", "android.content.pm.PackageParser$Package", boolean.class, String.class, hookGrantPermissions);
}
}
@Override
public void initZygote(StartupParam startupParam) throws Throwable {
XSharedPreferences pref = new XSharedPreferences(this.getClass().getPackage().getName(), Strings.PREF_NAME);
pref.makeWorldReadable();
newPerms = Strings.read(pref);
}
Sidenote: Code is partially forked from Appsettings module: https://github.com/rovo89/XposedAppSettings
The problem is: when I restart my phone after enabling the module, I just get a blackscreen after the bootanimation.
When I comment out the line marked fat underlined, it works, but does nothing (because this line is essential).
I have practically no idea why this isn't working.
I know that the input returned from Strings.read is valid.
My Question: What am I doing wrong?
Click to expand...
Click to collapse
I am doing something similar. Maybe you can get some ideas from my PermissionGranter at:
https://github.com/GravityBox/Gravi...co/lollipop/gravitybox/PermissionGranter.java

I thought it would be better to modify the query instead of lists itself, but I'll try that out. Thanks!

Now my Hook looks like this:
Code:
XC_MethodHook hookGrantPermissions = new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
String pkgName = (String) getObjectField(param.args[0], "packageName");
if (!(pkgName.equals(Strings.LLX) || pkgName.equals(Strings.LL))) return;
Object extras = getObjectField(param.args[0], "mExtras");
Set<String> grantedPerms = (Set<String>) getObjectField(extras, "grantedPermissions");
Object settings = getObjectField(param.thisObject, "mSettings");
Object permissions = getObjectField(settings, "mPermissions");
for (String perm : newPerms) {
Object permission = callMethod(permissions, "get", perm);
if (permission == null) continue;
grantedPerms.add(perm);
int[] gpGids = (int[]) getObjectField(extras, "gids");
int[] bpGids = (int[]) getObjectField(permission, "gids");
gpGids = (int[]) callStaticMethod(param.thisObject.getClass(),
"appendInts", gpGids, bpGids);
if (BuildConfig.DEBUG) XposedBridge.log("Permission added: " + permission);
}
}
};
But checkCallingOrSelfPermsisson still fails for the added permissions...
I get the log (in fact two times) but I still don't seem to have the permissions inside of the app.

Solved it myself. If there is a shared user, it has to be used instead of normal object.
Code:
XC_MethodHook hookGrantPermissions = new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
String pkgName = (String) getObjectField(param.args[0], "packageName");
if (!(pkgName.equals(Strings.LLX) || pkgName.equals(Strings.LL))) return;
Object extras = getObjectField(param.args[0], "mExtras");
Set<String> grantedPerms = (Set<String>) getObjectField(extras, "grantedPermissions");
Object sharedUser = getObjectField(extras, "sharedUser");
if(sharedUser != null) grantedPerms = (Set<String>) getObjectField(sharedUser, "grantedPermissions");
Object settings = getObjectField(param.thisObject, "mSettings");
Object permissions = getObjectField(settings, "mPermissions");
for (String perm : newPerms) {
Object permission = callMethod(permissions, "get", perm);
if (permission == null) continue;
grantedPerms.add(perm);
int[] gpGids = (int[]) getObjectField(sharedUser!=null?sharedUser:extras, "gids");
int[] bpGids = (int[]) getObjectField(permission, "gids");
callStaticMethod(param.thisObject.getClass(),
"appendInts", gpGids, bpGids);
if (BuildConfig.DEBUG) XposedBridge.log("Permission added: " + permission);
}
}
};

@C3C076 do you know any way how to get runtime (level dangerous) permissions on Android Marshmallow?
Getting normal permissions is actually a bit easier now, but I haven't found a way for runtime permissions.

Hook parcel readString, IBinder transact

Hello. I have this code.
Code:
public String getId() throws RemoteException {
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
String id;
try {
data.writeInterfaceToken("com.google.android.gms.ads.identifier.internal.IAdvertisingIdService");
binder.transact(1, data, reply, 0);
reply.readException();
id = reply.readString();
} finally {
reply.recycle();
data.recycle();
}
return id;
}
How i can hook " id = reply.readString();" when a don't know method name like "getId()". Thanks.
PS: Sorry for my bad English.

Now i can hook "transact" method like this:
Code:
XposedHelpers.findAndHookMethod("android.os.BinderProxy", loadPackageParam.classLoader, "transact", int.class, Parcel.class, Parcel.class, int.class, new XC_MethodHook() {
protected void afterHookedMethod(XC_MethodHook.MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
IBinder binder = (IBinder) param.thisObject;
String interfaceBinder = binder.getInterfaceDescriptor();
if (interfaceBinder.equals("com.google.android.gms.ads.identifier.internal.IAdvertisingIdService")) {
// change result for readString
}
}
});
But i cant override "readString" result for Parcel (args[2]) object. How can i do this? Thanks.

afterHookedMethod Variable assignment method

Code:
public class SuperHook implements IXposedHookLoadPackage, IXposedHookZygoteInit {
Config mConfig;
Gson mGson;
@Override
public void initZygote(StartupParam startupParam) throws Throwable {
mConfig = new Config();
mGson = new Gson();
}
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
Log.d("SuperHook", "handleLoadPackage imei:" + mConfig.getmImei());
if (loadPackageParam.packageName.equals("cn.superscript.supertools")) {
Class<?> classSuperService = XposedHelpers.findClass(SuperService.class.getName(), loadPackageParam.classLoader);
XposedHelpers.findAndHookMethod(classSuperService, "onStartCommand", Intent.class, int.class, int.class, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Intent intent = (Intent) param.args[0];
String json = intent.getStringExtra("json");
mConfig = mGson.fromJson(json, new TypeToken<Config>() {
}.getType());
Log.d("SuperHook", "onStartCommand: imei = " + mConfig.getmImei());
}
});
}
}
}
Log:
01-21 18:49:56.220 664-664/? D/SuperHook: handleLoadPackage imei:null
01-21 18:49:56.240 664-664/? D/SuperHook: onStartCommand: imei = 3333333
01-21 18:50:00.930 757-757/com.android.settings D/SuperHook: handleLoadPackage imei:null
why handleLoadPackage imei = null , onStartCommand: imei = 3333333 successful.
Please help me, thank you