Android免root实现hook系统服务拦截方法

//获取剪切板服务
ClipboardManager cm =(ClipboardManager)getSystemService(Context.CLIPBOARD_SERVICE);
//设置剪切板内容
cm.setPrimaryClip(ClipData.newPlainText("data","jack"));
//获取剪切板数据对象
ClipData cd = cm.getPrimaryClip();
String msg = cd.getItemAt(0).getText().toString();
Log.d("jw", "msg:"+ msg);

@Override
public Object getSystemService(String name) {
   ServiceFetcher fetcher = SYSTEM_SERVICE_MAP.get(name);
   return fetcher == null ? null : fetcher.getService(this);
}

private static void registerService(String serviceName, ServiceFetcher fetcher) {
    if (!(fetcher instanceof StaticServiceFetcher)) {
        fetcher.mContextCacheIndex = sNextPerContextServiceCacheIndex++;
    }
    SYSTEM_SERVICE_MAP.put(serviceName, fetcher);
}

static {
    registerService(ACCESSIBILITY_SERVICE, new ServiceFetcher() {
            public Object getService(ContextImpl ctx) {
                return AccessibilityManager.getInstance(ctx);
            }});
    //...
    registerService(CLIPBOARD_SERVICE, new ServiceFetcher() {
            public Object createService(ContextImpl ctx) {
                return new ClipboardManager(ctx.getOuterContext(),
                            ctx.mMainThread.getHandler());
            }});        
    //....

    registerService(CONNECTIVITY_SERVICE, new ServiceFetcher() {
            public Object createService(ContextImpl ctx) {
                IBinder b = ServiceManager.getService(CONNECTIVITY_SERVICE);
                return new ConnectivityManager(IConnectivityManager.Stub.asInterface(b));
            }});
    //....
}

public void setPrimaryClip(ClipData clip) {
    try {
        if (clip != null) {
            clip.prepareToLeaveProcess();
        }
        getService().setPrimaryClip(clip, mContext.getOpPackageName());
    } catch (RemoteException e) {
    }
}

static private IClipboard getService() {
    synchronized (sStaticLock) {
        if (sService != null) {
            return sService;
        }
        IBinder b = ServiceManager.getService("clipboard");
        sService = IClipboard.Stub.asInterface(b);
        return sService;
    }
}

public class IContentProviderProxy implements InvocationHandler {

  //.....代码省略
  public static IContentProvider newInstance(Context context, IContentProvider iContentProvider) {
      return (IContentProvider) Proxy.newProxyInstance(iContentProvider.getClass().getClassLoader(),
              new Class[] { IContentProvider.class }, new IContentProviderProxy(context, iContentProvider));
  }

  @Override
  public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
      Log.v(TAG, method.toGenericString() + " : " + Arrays.toString(args));
      wrapperUri(method, args);

      try {
          return method.invoke(mBase, args);
      } catch (InvocationTargetException e) {
          throw e.getTargetException();
      }
  }

  //...代码省略
}

public interface Account {
    void operation();
}

public class AccountImpl extends Account{
    public void operation() {
        System.out.println("operation...");
        //TODO real operation
    }
}

class SecurityProxyInvocationHandler implements InvocationHandler {
    private Object proxyedObject;
    public SecurityProxyInvocationHandler(Object o) {
        proxyedObject = o;
    }

    @Override
    public Object invoke(Object object, Method method, Object[] arguments)
        throws Throwable {             
        if (object instanceof Account && method.getName().equals("opertaion")) {
            SecurityChecker.checkSecurity();
        }
        return method.invoke(proxyedObject, arguments);
    }
}

public static void main(String[] args) {
    Account account = (Account) Proxy.newProxyInstance(
        Account.class.getClassLoader(),
        new Class[] { Account.class },
        new SecurityProxyInvocationHandler(new AccountImpl())
    );
    account.function();
}

private void wrapperUri(Method method, Object[] args) {
    Uri uri = null;
    int index = 0;
    if (args != null) {
        for (int i = 0; i < args.length; i++) {
            if (args[i] instanceof Uri) {
                uri = (Uri) args[i];
                index = i;
                break;
            }
        }
    }

    //如果挂钩的是call方法
    Bundle bundleInCallMethod = null;
    if (method.getName().equals("call")) {
        bundleInCallMethod = getBundleParameter(args);
        if (bundleInCallMethod != null) {
            String uriString = bundleInCallMethod.getString(KEY_WRAPPER_URI);
            if (uriString != null) {
                uri = Uri.parse(uriString);
            }
        }
    }
    //...

    PluginManager pluginManager = PluginManager.getInstance(mContext);
    //这里根据uri找到对应的ContentProvider
    ProviderInfo info = pluginManager.resolveContentProvider(uri.getAuthority(), 0);
    if (info != null) {
        String pkg = info.packageName;
        LoadedPlugin plugin = pluginManager.getLoadedPlugin(pkg);
        String pluginUri = Uri.encode(uri.toString());
        StringBuilder builder = new StringBuilder(PluginContentResolver.getUri(mContext));
        builder.append("/?plugin=" + plugin.getLocation());
        builder.append("&pkg=" + pkg);
        builder.append("&uri=" + pluginUri);
        Uri wrapperUri = Uri.parse(builder.toString());
        if (method.getName().equals("call")) {
            bundleInCallMethod.putString(KEY_WRAPPER_URI, wrapperUri.toString());
        } else {
            args[index] = wrapperUri;
        }
    }
}

public static IBinder getService(String name) {
   try {
       IBinder service = sCache.get(name);
       if (service != null) {
           return service;
       } else {
           return getIServiceManager().getService(name);
       }
   } catch (RemoteException e) {
       Log.e(TAG, "error in getService", e);
   }
   return null;
}

private static HashMap<String, IBinder> sCache = new HashMap<String, IBinder>();

try {
  //下面这一段的意思其实就是ServiceManager.getService("clipboard")
  //只不过ServiceManager这个类是@hide的
  Class<?> serviceManager = Class.forName("android.os.ServiceManager");
  Method getService = serviceManager.getDeclaredMethod("getService", String.class);
  //取得ServiceManager里的原始的clipboard binder对象
  //一般来说这是一个Binder代理对象
  IBinder rawBinder =(IBinder) getService.invoke(null, Context.CLIPBOARD_SERVICE);

  //Hook掉这个Binder代理的queryLocalInterface 方法
  //然后在queryLocalInterface返回一个IInterface对象，hook掉我们感兴趣的方法即可
  IBinder hookedBinder =(IBinder) Proxy.newProxyInstance(
      serviceManager.getClassLoader,
      new Class<?>[](IBinder.class),
      new IClipboardHookBinderHandler(rawBinder)
  );

  //放回ServiceManager中，替换掉原有的
  Field cacheField = serviceManager.getDeclaredField("sCache");
  cacheField.setAccessible(true);
  @SuppressWarnings({"unchecked"})
  Map<String, IBinder> cache = (Map<String,IBinder>) cacheField.get(null);
  cache.put(Context.CLIPBOARD_SERVICE, hookedBinder);
}catch (Exception e){

}

@Override
public Object invoke(Object object, Method method, Object[] args)
    throws Throwable {             
    if (method.getName().equals("queryLocalInterface")) {
        Log.d(TAG, "hook queryLocalInterface");

        //这里直接返回真正被hook掉的Service接口
        //这个代理类必须实现IInterface接口
        return Proxy.newProxyInstance(
            base.getClassLoader,
            new Class<?>[](this.iinterface),
            new HookBinderInvocationHander(base,stub)
            );
    }
    return method.invoke(base, args);
}

public static com.agehua.aidldemo.Demo asInterface(android.os.IBinder obj) {
    if ((obj == null)) {
        return null;
    }
    //这里的obj就是远端对象，它通过queryLocalInterface()方法获取本进程中的服务，这里就是hook点
    android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
    if (((iin != null) && (iin instanceof com.agehua.aidldemo.Demo))) {
        return ((com.agehua.aidldemo.Demo) iin);
    }
    return new com.agehua.aidldemo.Demo.Stub.Proxy(obj);
}

public IClipboardHookBinderHandler(IBinder base) {
  this.base = base;
  try {
    this.stub =Class.forName("android.content.IClipboard$Stub");
    this.iinterface = Class.forName("android.content.IClipboard");
  }catch (ClassNotFoundException e){

  }
}

public IClipboardHookBinderHandler(IBinder base, Class<?> stubClass) {
  try {
    Method asInterfaceMethod = stubClass.getDeclaredMethod("asInterface", IBinder.class);
    this.base = asInterfaceMethod.invoke(null, base);
  }catch (Exception e){
    throw new RuntimeException("hooked failed")
  }
}

@Override
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable{
  if ("getPrimaryClip".equals(method.getName())) {
      return ClipData.newPlainText(null, "you are hooked");
  }
  //欺骗系统，使之认为剪切板上一直有内容
  if ("hasPrimaryClip".equals(method.getName())) {
    return true;
  }
  //千万不要忘了调用原始对象的方法
  return method.invoke(base, args);
}