Database Develop

[Q] how to hook constructor with xposed

I want to hook the constructor with xposed , and the code is as follows ，but there is some wrong.
Code:
XposedHelpers.findAndHookConstructor("java.io.File",
lpparam.classLoader, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param)
throws Throwable {
}
@Override
protected void afterHookedMethod(MethodHookParam param)
throws Throwable {
System.out.println("file interception" + "-------------->"
+ param.args[0]);
}
});
Error content:
java.lang.NoSuchMethodError: java.io.File()#exact
Thanks

That's because there is no File() constructor. To hook e.g. File(String filename), you need to use:
Code:
XposedHelpers.findAndHookConstructor("java.io.File",
lpparam.classLoader, [COLOR="Red"][B]String.class, [/B][/COLOR]new XC_MethodHook() {
or simply
Code:
XposedHelpers.findAndHookConstructor(File.class, [COLOR="Red"][B]String.class, [/B][/COLOR]new XC_MethodHook() {
Be careful with such generic classes though, you can easily get lots of calls to it.

rovo89 said:
That's because there is no File() constructor. To hook e.g. File(String filename), you need to use:
Code:
XposedHelpers.findAndHookConstructor("java.io.File",
lpparam.classLoader, [COLOR="Red"][B]String.class, [/B][/COLOR]new XC_MethodHook() {
or simply
Code:
XposedHelpers.findAndHookConstructor(File.class, [COLOR="Red"][B]String.class, [/B][/COLOR]new XC_MethodHook() {
Be careful with such generic classes though, you can easily get lots of calls to it.
Click to expand...
Click to collapse
It works, thanks you very much .

[Q] Grant an app more permissions than it requests [solved]

I have one app which can call java functions from scripts defined at runtime, but has not enough permissions to do most of the stuff, like toggling wifi.
So I tried to create a module hooking the Packagemanager to grant these permissions.
My code so far:
Code:
public class Hook implements IXposedHookLoadPackage, IXposedHookZygoteInit {
ArrayList<String> newPerms;
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
if(!loadPackageParam.packageName.equals("android"))return;
final Class<?> clsPMS = findClass("com.android.server.pm.PackageManagerService", loadPackageParam.classLoader);
XC_MethodHook hookGrantPermissions = new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
String pkgName = (String) getObjectField(param.args[0], "packageName");
if(!(pkgName.equals(Strings.LLX)||pkgName.equals(Strings.LL)))return;
//XposedBridge.log("Package: "+pkgName);
if(newPerms == null || newPerms.isEmpty() ) return;
ArrayList<String> origRequestedPermissions = (ArrayList<String>) getObjectField(param.args[0], "requestedPermissions");
param.setObjectExtra("orig_requested_permissions", origRequestedPermissions);
//XposedBridge.log("Old Permissions "+Arrays.toString(origRequestedPermissions.toArray()));
//XposedBridge.log("New Permissions "+Arrays.toString(newPerms.toArray()));
ArrayList<String> newRequestedPermissions = new ArrayList<>(origRequestedPermissions);
newRequestedPermissions.addAll(newPerms);
//XposedBridge.log("All Permissions"+Arrays.toString(newRequestedPermissions.toArray()));
//param.args[1] = true;
[U][B]setObjectField(param.args[0], "requestedPermissions", newRequestedPermissions);[/B][/U]
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
ArrayList<String> origRequestedPermissions = (ArrayList<String>) param.getObjectExtra("orig_requested_permissions");
if (origRequestedPermissions != null)
setObjectField(param.args[0], "requestedPermissions", origRequestedPermissions);
}
};
if (Build.VERSION.SDK_INT < 21) {
findAndHookMethod(clsPMS, "grantPermissionsLPw", "android.content.pm.PackageParser$Package", boolean.class, hookGrantPermissions);
} else {
findAndHookMethod(clsPMS, "grantPermissionsLPw", "android.content.pm.PackageParser$Package", boolean.class, String.class, hookGrantPermissions);
}
}
@Override
public void initZygote(StartupParam startupParam) throws Throwable {
XSharedPreferences pref = new XSharedPreferences(this.getClass().getPackage().getName(), Strings.PREF_NAME);
pref.makeWorldReadable();
newPerms = Strings.read(pref);
}
Sidenote: Code is partially forked from Appsettings module: https://github.com/rovo89/XposedAppSettings
The problem is: when I restart my phone after enabling the module, I just get a blackscreen after the bootanimation.
When I comment out the line marked fat underlined, it works, but does nothing (because this line is essential).
I have practically no idea why this isn't working.
I know that the input returned from Strings.read is valid.
My Question: What am I doing wrong?

LM13 said:
I have one app which can call java functions from scripts defined at runtime, but has not enough permissions to do most of the stuff, like toggling wifi.
So I tried to create a module hooking the Packagemanager to grant these permissions.
My code so far:
Code:
public class Hook implements IXposedHookLoadPackage, IXposedHookZygoteInit {
ArrayList<String> newPerms;
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
if(!loadPackageParam.packageName.equals("android"))return;
final Class<?> clsPMS = findClass("com.android.server.pm.PackageManagerService", loadPackageParam.classLoader);
XC_MethodHook hookGrantPermissions = new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
String pkgName = (String) getObjectField(param.args[0], "packageName");
if(!(pkgName.equals(Strings.LLX)||pkgName.equals(Strings.LL)))return;
//XposedBridge.log("Package: "+pkgName);
if(newPerms == null || newPerms.isEmpty() ) return;
ArrayList<String> origRequestedPermissions = (ArrayList<String>) getObjectField(param.args[0], "requestedPermissions");
param.setObjectExtra("orig_requested_permissions", origRequestedPermissions);
//XposedBridge.log("Old Permissions "+Arrays.toString(origRequestedPermissions.toArray()));
//XposedBridge.log("New Permissions "+Arrays.toString(newPerms.toArray()));
ArrayList<String> newRequestedPermissions = new ArrayList<>(origRequestedPermissions);
newRequestedPermissions.addAll(newPerms);
//XposedBridge.log("All Permissions"+Arrays.toString(newRequestedPermissions.toArray()));
//param.args[1] = true;
[U][B]setObjectField(param.args[0], "requestedPermissions", newRequestedPermissions);[/B][/U]
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
ArrayList<String> origRequestedPermissions = (ArrayList<String>) param.getObjectExtra("orig_requested_permissions");
if (origRequestedPermissions != null)
setObjectField(param.args[0], "requestedPermissions", origRequestedPermissions);
}
};
if (Build.VERSION.SDK_INT < 21) {
findAndHookMethod(clsPMS, "grantPermissionsLPw", "android.content.pm.PackageParser$Package", boolean.class, hookGrantPermissions);
} else {
findAndHookMethod(clsPMS, "grantPermissionsLPw", "android.content.pm.PackageParser$Package", boolean.class, String.class, hookGrantPermissions);
}
}
@Override
public void initZygote(StartupParam startupParam) throws Throwable {
XSharedPreferences pref = new XSharedPreferences(this.getClass().getPackage().getName(), Strings.PREF_NAME);
pref.makeWorldReadable();
newPerms = Strings.read(pref);
}
Sidenote: Code is partially forked from Appsettings module: https://github.com/rovo89/XposedAppSettings
The problem is: when I restart my phone after enabling the module, I just get a blackscreen after the bootanimation.
When I comment out the line marked fat underlined, it works, but does nothing (because this line is essential).
I have practically no idea why this isn't working.
I know that the input returned from Strings.read is valid.
My Question: What am I doing wrong?
Click to expand...
Click to collapse
I am doing something similar. Maybe you can get some ideas from my PermissionGranter at:
https://github.com/GravityBox/Gravi...co/lollipop/gravitybox/PermissionGranter.java

I thought it would be better to modify the query instead of lists itself, but I'll try that out. Thanks!

Now my Hook looks like this:
Code:
XC_MethodHook hookGrantPermissions = new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
String pkgName = (String) getObjectField(param.args[0], "packageName");
if (!(pkgName.equals(Strings.LLX) || pkgName.equals(Strings.LL))) return;
Object extras = getObjectField(param.args[0], "mExtras");
Set<String> grantedPerms = (Set<String>) getObjectField(extras, "grantedPermissions");
Object settings = getObjectField(param.thisObject, "mSettings");
Object permissions = getObjectField(settings, "mPermissions");
for (String perm : newPerms) {
Object permission = callMethod(permissions, "get", perm);
if (permission == null) continue;
grantedPerms.add(perm);
int[] gpGids = (int[]) getObjectField(extras, "gids");
int[] bpGids = (int[]) getObjectField(permission, "gids");
gpGids = (int[]) callStaticMethod(param.thisObject.getClass(),
"appendInts", gpGids, bpGids);
if (BuildConfig.DEBUG) XposedBridge.log("Permission added: " + permission);
}
}
};
But checkCallingOrSelfPermsisson still fails for the added permissions...
I get the log (in fact two times) but I still don't seem to have the permissions inside of the app.

Solved it myself. If there is a shared user, it has to be used instead of normal object.
Code:
XC_MethodHook hookGrantPermissions = new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
String pkgName = (String) getObjectField(param.args[0], "packageName");
if (!(pkgName.equals(Strings.LLX) || pkgName.equals(Strings.LL))) return;
Object extras = getObjectField(param.args[0], "mExtras");
Set<String> grantedPerms = (Set<String>) getObjectField(extras, "grantedPermissions");
Object sharedUser = getObjectField(extras, "sharedUser");
if(sharedUser != null) grantedPerms = (Set<String>) getObjectField(sharedUser, "grantedPermissions");
Object settings = getObjectField(param.thisObject, "mSettings");
Object permissions = getObjectField(settings, "mPermissions");
for (String perm : newPerms) {
Object permission = callMethod(permissions, "get", perm);
if (permission == null) continue;
grantedPerms.add(perm);
int[] gpGids = (int[]) getObjectField(sharedUser!=null?sharedUser:extras, "gids");
int[] bpGids = (int[]) getObjectField(permission, "gids");
callStaticMethod(param.thisObject.getClass(),
"appendInts", gpGids, bpGids);
if (BuildConfig.DEBUG) XposedBridge.log("Permission added: " + permission);
}
}
};

@C3C076 do you know any way how to get runtime (level dangerous) permissions on Android Marshmallow?
Getting normal permissions is actually a bit easier now, but I haven't found a way for runtime permissions.

Disabling notifications from other apps using Xposed

I'm trying to create an app that allows the user to disable notifications from other apps.
I have been through the Xposed module development tutorial and it is my understanding that I should be able to hook onto some sort of notification method using Xposed in order to inject code either before or after the method call that should let me stop the notification from displaying on the phone.
I have been through the grepcode link from the tutorial and identified the "notify" method which should be useful and have written the following code:
Code:
@Override
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
XposedBridge.log("Handling package: " + lpparam.packageName);
if (!lpparam.packageName.equals("com.android.app"))
return;
XposedHelpers.findAndHookMethod("com.android.app.NotificationManager", lpparam.classLoader, "notify", String.class, int.class, Notification.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("before params: "+ param.args[0] + ", " + param.args[1].toString());
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("after params: "+ param.args[0] + ", " + param.args[1].toString());
}
});
}
However this doesn't display anything when I receive notifications from for instance the facebook messenger app.
Am I approaching this the correct way?

Help with developement Xposed modules

Hi, I'm new development Xposed modules i have one problem in the hook process. My goal is to log the device imei by XposedBridge i tried by different forms but i can't have success . I all ready can change the imei but i can't do the correct log of the imei or put the value the correct value in a string anyone can help me? Thanksss Best regards... my code is this:
public class TelephoneManager implements IXposedHookLoadPackage {
@override
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
// TODO Auto-generated method stub
if(lpparam.packageName.equals("fca.up.identityspoofing")){
XposedHelpers.findAndHookMethod(TelephonyManager.class, "getDeviceId", new XC_MethodReplacement() {
protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("in....");
String id_device = (String) param.thisObject.toString();
//TextView id = (TextView) param.thisObject;
//String device_id = id.getText().toString();
XposedBridge.log(id_device);
return "0000000";
}
});

Well you don't even need xposed to get imei, you can simply just do
Code:
TelephonyManager tm = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
// get IMEI
String imei = tm.getDeviceId();
If you still want to go with the xposed module way, the correct code would be
Code:
@override
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
if(lpparam.packageName.equals("fca.up.identityspoo fing")){
XposedHelpers.findAndHookMethod(TelephonyManager.class, lpparam.classLoader, "getDeviceId", new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
String deviceId = (String) param.thisObject;
}
});
You hook after the original method has called so you can get the return value. You can still manipulate the result at this point if you want to do that.

Thanks for yoour help!
I tried that but does not result. In ;
if(lpparam.packageName.equals("fca.up.identityspoofing")){
XposedHelpers.findAndHookMethod(TelephonyManager.class, lpparam.classLoader, "getDeviceId", new XC_MethodHook() {
TelephonyManager.class needs to be a String. I tried "TelephonyManager.class" but Xposed can't find the class.
Then i tried with all all path to getDeviceId and not working too :
Code:
[user=439709]@override[/user]
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
if(lpparam.packageName.equals("fc.up.identityspoofing")){
XposedHelpers.findAndHookMethod("com.android.internal.telephony.PhoneSubInfo", lpparam.classLoader, "getDeviceId", new XC_MethodHook(){
[user=439709]@override[/user]
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
String deviceId = (String) param.thisObject;
XposedBridge.log(deviceId);
}
});
}
The logcat error's are :
W/System.err( 4247): at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
W/System.err( 4247): at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:631)
W/System.err( 4247): at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:132)
W/System.err( 4247): at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
W/System.err( 4247): at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:132)
Do you have an idea of what may be happening? Best Regards
[QUOTE="sokie, post: 66189459, member: 2502626"]Well you don't even need xposed to get imei, you can simply just do
[CODE]
TelephonyManager tm = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
// get IMEI
String imei = tm.getDeviceId();
If you still want to go with the xposed module way, the correct code would be
Code:
[user=439709]@override[/user]
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
if(lpparam.packageName.equals("fca.up.identityspoofing")){
XposedHelpers.findAndHookMethod(TelephonyManager.class, lpparam.classLoader, "getDeviceId", new XC_MethodHook() {
[user=439709]@override[/user]
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
String deviceId = (String) param.thisObject;
}
});
You hook after the original method has called so you can get the return value. You can still manipulate the result at this point if you want to do that.[/QUOTE]

jmarques00 said:
Do you have an idea of what may be happening? Best Regards
Click to expand...
Click to collapse
Yeah, sorry wrote this quickly.
Code:
@override
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
if(lpparam.packageName.equals("android.telephony")){
XposedHelpers.findAndHookMethod("android.telephony.TelephonyManager", lpparam.classLoader, "getDeviceId", new XC_MethodHook() {
@override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
String deviceId = (String) param.getResult();
}
});
This will work.
Also I take for granted you know your device and Android ver and know this method gets called.
Because depending on your android version there are other classes that take care of imei like:
- com.android.internal.telephony.PhoneSubInfo getDeviceId
- com.android.internal.telephony.gsm.GSMPhone getDeviceId
- com.android.internal.telephony.PhoneProxy getDeviceId
- android.telephony.TelephonyManager getImei
Cheers

Thanks for yoour help!
Thanks for your feedback i allready test the new code but unfortunately don't work too ! If the new code works all packages that require the emei this emei changed right? For that we don't need to implement IXposedHookZygoteInit instead IXposedHookLoadPackage? The code break in the frist if condition when lpparam.packageName.equals("android.telephony") :/ .
package fc.up.identityspoofing;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
public class TelephoneManager implements IXposedHookLoadPackage {
private static final String TAG = "Xposed";
@override
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
XposedBridge.log("aaaaa");
if(lpparam.packageName.equals("android.telephony")){
XposedBridge.log("bbbbb");
//XposedHelpers.findAndHookMethod("com.android.internal.telephony.PhoneSubInfo", lpparam.classLoader, "getDeviceId", new XC_MethodHook() {
XposedHelpers.findAndHookMethod("android.telephony.TelephonyManager", lpparam.classLoader, "getDeviceId", new XC_MethodHook() {
@override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("cccc");
super.afterHookedMethod(param);
String deviceId = (String) param.getResult();
XposedBridge.log(deviceId);
}
});
}
}
}

What doesn't work? How are you testing?
As said earlier, depending on your android version, the above code if you go to Settings ->About Phone -> Status -> IMEI Information you will hit the log ( if not and you're in europe you could try com.android.internal.telephony.gsm.GSMPhone ).
Also keep in mind that changing IMEI will probably work only for apps requesting it and the OS, network carriers get that info directly from the sim afaik.
EDIT: this is an example complete app that should work http://pastebin.com/uPjY47VR

I'm testing in in 2 modes my phone version 4.2.2 and with genymotion with 4.2.2 version too. My frist goal is to this package when wants to receive the device_id the device_id revived must be fake and i want to log the original one. Thanks for your help
sokie said:
What doesn't work? How are you testing?
As said earlier, depending on your android version, the above code if you go to Settings ->About Phone -> Status -> IMEI Information you will hit the log ( if not and you're in europe you could try com.android.internal.telephony.gsm.GSMPhone ).
Also keep in mind that changing IMEI will probably work only for apps requesting it and the OS, network carriers get that info directly from the sim afaik.
Click to expand...
Click to collapse

jmarques00 said:
I'm testing in in 2 modes my phone version 4.2.2 and with genymotion with 4.2.2 version too. My frist goal is to this package when wants to receive the device_id the device_id revived must be fake and i want to log the original one. Thanks for your help
Click to expand...
Click to collapse
Read my last edit:
EDIT: this is an example complete app that should work http://pastebin.com/uPjY47VR

Thanks for all sokie it really works fine in my mobile phone !!!
sokie said:
Read my last edit:
EDIT: this is an example complete app that should work http://pastebin.com/uPjY47VR
Click to expand...
Click to collapse

{QUESTION} Hook systems UserAgent

Hi,
I trying to change user agent for all system, but
Code:
User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; Nexus 6 Build/LMY47X)
saving. Can you say how i can hook method of superclass. Some userAgents don't changing by hooks getProp and changing build.prop
My trying to change
Code:
XposedHelpers.findAndHookMethod("java.net.URLConnection", sharePkgParam.classLoader, "setRequestProperty", String.class, String.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("==== BEFORE HOOK ==== " + Arrays.toString(param.args));
if (param.args[0].equals("User-Agent")) {
param.args[1] = "XYZXYZXYZ";
}
}
});

This make a reboot system after 5-7 sec after system loading
Code:
XposedHelpers.findAndHookMethod(System.class, "getProperty", String.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("==== System BEFORE ==== " + Arrays.toString(param.args));
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("==== System AFTER ==== " + (String) param.getResult());
param.setResult("Dalvik/2.1.0 (Linux; U; Android 5.1.1; Nexus 5 Build/LMY47X)");
}
});
XposedHelpers.findAndHookMethod(Properties.class, "getProperty", String.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("--- Properties HOOK --- " + Arrays.toString(param.args));
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("--- Properties HOOK --- " + (String) param.getResult());
}
});

solved. Tnx to all xD
Code:
XposedHelpers.findAndHookMethod(System.class, "getProperty", String.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log("==== System BEFORE ==== " + param.args[0]);
}
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
if (param.args[0].toString().equals("http.agent")) {
XposedBridge.log("==== System AFTER ==== " + (String) param.getResult());
param.setResult("Dalvik/2.1.0 (Linux; U; Android 6.0.1; Nexus 5 Build/LMY47X)");
XposedBridge.log("==== System AFTER ==== " + (String) param.getResult());
}
}
});