android - Xposed:如何获取 Hook 的应用程序的上下文？

Question

如题，我想hook第三个app，可以从第三个app的activity调用我的application activity。所以我想获取第三个app的context，怎么办？

第三个app的包是com.ss.android.gallery.heavy，我项目的包是com.example.hao.hookstartupinterfacetest;

我的Xposed Module.java(这里的MainActivity是我项目的activity)

XposedHelpers.findAndHookMethod("com.ss.android.gallery.heavy.activity.SplashActivity",
                loadPackageParam.classLoader, "getMainIntent", new XC_MethodReplacement() {
                    @Override
                    protected Object replaceHookedMethod(MethodHookParam methodHookParam) throws Throwable {
                        Context context = (Activity)methodHookParam.getResult();
                        return new Intent(context, MainActivity.class);
                    }
                });

SplashActivity.class(在第三个app里面，这里的MainActivity属于第三个app)

   public class SplashActivity extends BaseSplashActivity{
       protected Intent getMainIntent(){
           return new Intent(this, MainActivity.class);
       }
   }

错误

01-18 20:38:23.669 4730-4730/com.ss.android.gallery.heavy E/AndroidRuntime: FATAL EXCEPTION: main
    Process: com.ss.android.gallery.heavy, PID: 4730
    android.content.ActivityNotFoundException: Unable to find explicit activity class {com.ss.android.gallery.heavy/com.example.hao.hookstartupinterfacetest.MainActivity}; have you declared this activity in your AndroidManifest.xml?
        at android.app.Instrumentation.checkStartActivityResult(Instrumentation.java:1777)
        at android.app.Instrumentation.execStartActivity(Instrumentation.java:1501)
        at android.app.Activity.startActivityForResult(Activity.java:3745)
        at android.app.Activity.startActivityForResult(Activity.java:3706)
        at android.app.Activity.startActivity(Activity.java:4016)
        at android.app.Activity.startActivity(Activity.java:3984)
        at com.ss.android.gallery.base.activity.BaseSplashActivity.goMainActivity(BaseSplashActivity.java:61)
        at com.ss.android.gallery.base.activity.BaseSplashActivity.access$000(BaseSplashActivity.java:17)
        at com.ss.android.gallery.base.activity.BaseSplashActivity$1.run(BaseSplashActivity.java:76)
        at android.os.Handler.handleCallback(Handler.java:739)
        at android.os.Handler.dispatchMessage(Handler.java:95)
        at android.os.Looper.loop(Looper.java:135)
        at android.app.ActivityThread.main(ActivityThread.java:5254)
        at java.lang.reflect.Method.invoke(Native Method)
        at java.lang.reflect.Method.invoke(Method.java:372)
        at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)
        at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:102)

Answer 1

您正在尝试使用 Hook 应用的上下文直接启动应用的 Activity，这不起作用，因为该 Activity 实际上不是 Hook 应用的一部分(因此出现“未在 AndroidManifest.xml 中定义”错误)。您必须在创建 Intent 时明确指定您的应用程序包和类的全名:

Intent intent = new Intent();
intent.setClassName(
    // Your app's package name
    "com.example.hao.hookstartupinterfacetest",
    // The full class name of the activity you want to start
    "com.example.hao.hookstartupinterfacetest.MainActivity");
return intent;

您还应该在 AndroidManifest.xml 中将 MainActivity 的 android:exported 属性设置为 true , 以便它可以被 Hook 的应用程序启动。

另外，Context context = (Activity)methodHookParam.getResult(); 可能应该是 Context context = (Activity)methodHookParam.thisObject;，虽然你不知道使用此方法实际上完全需要它。