基於xposed實現android注冊系統服務，解決跨進程共享數據問題

昨花了點時間，參考github issues 總算實現了基於xposed的系統服務注入，本文目的是為了“解決應用之間hook后數據共享，任意app ServiceManager.getService就可以直接調用aidl實現了進程通信”（比如aidl service實現socket,http server等，或者從某app獲取數據傳遞給另外個app等場景，能做什么大家自己想吧，當然也可以實現非xposed版本的，需要通過直接smali方式。因為需快速實現，我就基於xposed的方案湊活用着用吧）

Xposed我就不介紹了，Xposed有2個重要接口，一個是針對應用級別hook：IXposedHookLoadPackage，另一個就是針對系統級別的：IXposedHookZygoteInit

這里將使用IXposedHookZygoteInit實現aidl添加到系統服務中，當然，通過IXposedHookLoadPackage也是可以實現的，但是因為我們注入的服務是希望像系統服務一樣，開機啟動，關機停止，另外IXposedHookZygoteInit本身就是定位在針對系統hook，所以還是建議使用IXposedHookZygoteInit。

直接進入正題：

1.創建 android.os.ICustomService.aidl

 

package android.os;

// Declare any non-default types here with import statements

interface ICustomService {
    String sayHello();
}

 

2.創建CustomService實現類

public class CustomService extends ICustomService.Stub {
    private Context mContext;
    public CustomService(Context context) {
        mContext = context;
    }

    @Override
    public String sayHello() throws RemoteException {
        return "Just Hello World";
    }

    //ActivityManagerService的systemReady在所有服務初始化完成后觸發，這定義這個是為了實現自定義服務的初始化代碼實現
    public void systemReady() {
        // Make your initialization here
    }
}

 

3.創建ApplicationSocket，實現IXposedHookZygoteInit接口，這實現系統啟動時候觸發hook

public class ApplicationSocket implements IXposedHookZygoteInit{
    public static String TAG = "ApplicationSocket";
    @Override
    public void initZygote(StartupParam startupParam) throws Throwable {
        XposedBridge.hookAllMethods(ActivityThread.class, "systemMain", new SystemServiceHook());
    }
}

 

4.創建SystemServiceHook 重寫XC_MethodHook,實現注冊服務，這也是最核心的類

import android.content.Context;
import android.os.Build;
import android.os.CustomService;
import android.os.ICustomService;
import android.os.ServiceManager;

import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;

/**
 * Created by bluce on 17/12/5.
 */

public class SystemServiceHook extends XC_MethodHook {
    private static CustomService oInstance;
    private static boolean systemHooked;

    @Override
    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        if (systemHooked) {
            return;
        }
        final ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
        Class activityManagerServiceClazz = null;
        try {
            activityManagerServiceClazz = XposedHelpers.findClass("com.android.server.am.ActivityManagerService", classLoader);
        } catch (RuntimeException e) {
            // do nothing
        }
        if (!systemHooked && activityManagerServiceClazz!=null) {
            systemHooked = true;
            //系統服務啟動完畢，通知自定義服務
            XposedBridge.hookAllMethods(
                    activityManagerServiceClazz,
                    "systemReady",
                    new XC_MethodHook() {
                        @Override
                        protected final void afterHookedMethod(final MethodHookParam param) {
                            oInstance.systemReady();
                            XposedBridge.log(">>>systemReady!!!!");
                        }
                    }
            );
            //注冊自定義服務到系統服務中
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
                XposedBridge.hookAllConstructors(activityManagerServiceClazz, new XC_MethodHook() {
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        Context context = (Context) XposedHelpers.getObjectField(param.thisObject, "mContext");
                        registerService(classLoader,context);
                    }
                });
            }else{
                XposedBridge.hookAllMethods(
                        activityManagerServiceClazz,
                        "main",
                        new XC_MethodHook() {
                            @Override
                            protected final void afterHookedMethod(final MethodHookParam param) {
                                Context context = (Context) param.getResult();
                                registerService(classLoader,context);
                            }
                        }
                );
            }
        }
    }
    
    private static void registerService(final ClassLoader classLoader, Context context) {
        XposedBridge.log(">>>register service, Build.VERSION.SDK_INT"+Build.VERSION.SDK_INT);
        oInstance = new CustomService(context);
        Class<?> ServiceManager = XposedHelpers.findClass("android.os.ServiceManager",classLoader);
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
            //避免java.lang.SecurityException錯誤,從5.0開始，selinux服務名稱需要加前綴"user."
            XposedHelpers.callStaticMethod(
                    ServiceManager,
                    "addService",
                    "user.custom.service",
                    oInstance,
                    true
            );
        } else {
            XposedHelpers.callStaticMethod(
                    ServiceManager,
                    "addService",
                    "custom.service",
                    oInstance
            );
        }
    }


    //use service demo
    public static ICustomService mService;
    public static String someMethod(Context context) {
        try {
            if (mService == null) {
                mService=ICustomService.Stub.asInterface(ServiceManager.getService("user.wx_custom.service"));
                //mService =(ICustomService)context.getSystemService("wx_custom.service");
            }
            return mService.sayHello();
        } catch (Exception e) {
            System.out.println(e.getMessage());
            e.printStackTrace();
        }
        return  ">>> someMethod failed!!! ";
    }
}

 

5.在當前應用activity中調用系統服務,service實現可以創建成單獨的module,這樣就實現不同項目直接使用，最重要的是在當前項目xposed hook代碼中可以直接使用了，這也是本文的最初衷。

 button = (Button) findViewById(R.id.testButton);
        button.setOnClickListener(new View.OnClickListener(){
            @Override
            public  void  onClick(View v){
                if(true){
                    //testPattern();return;
                    //HookTest.registerReceiver(context);
                    String str = SystemServiceHook.someMethod(MainActivity.context);
                    if(str!=null){
                        System.out.println(">>>>:::"+str);
                    }
                    return;
                }
            }
    } ;

 

基於以上，CustomService整體的代碼就實現了，重啟系統就變成了系統服務，可以直接使用。但是以下2點需要特別注意：

1.com.android.server.am.ActivityManagerService是framework不公開的方法和類，所以項目需要導入AndroidHiddenAPI.jar這個包

2.android5.0之前SystemContext通過call ActivityManagerService的main方法就可以直接獲取，但是5.0開始是通過createSystemContext方法生產，所以只能判斷下版本，然后一個通過構造取獲取，一個通過main返回結果獲取