adb connect 127.0.0.1:62001
adb forward tcp:27042 tcp:27042
adb forward tcp:27043 tcp:27043

# 列出类的所有函数
android hooking list class_methods com.uzmap.pkg.uzmodules.photoBrowserSu.PhotoBrowser

# hook方法，列出其参数和返回值，还有堆栈
android hooking watch class_method com.uzmap.pkg.uzmodules.photoBrowserSu.ImageBrowserAdapter.$init --dump-args --dump-backtrace --dump-return

# hook整个类的所有方法
android hooking watch class android.support.v4.view.PagerAdapter

uiautomator dump /sdcard/ui.xml
# 获取顶层的布局

dumpsys window | grep  mCurrentFocus
# 获取顶层的Activity

package com.example.startu.myapplication233;

import android.app.Application;
import android.content.Context;
import android.os.Environment;
import android.view.View;
import android.widget.Toast;

import java.io.File;
import java.io.FileOutputStream;
import java.io.UnsupportedEncodingException;
import java.lang.reflect.Field;
import java.lang.reflect.Modifier;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

public class HookTest implements IXposedHookLoadPackage {

    public void writefile(String str) throws Throwable{
        String sdCardDir =Environment.getExternalStorageDirectory().getAbsolutePath();
        File saveFile = new File(sdCardDir, "aaaa.txt");
        FileOutputStream outStream = new FileOutputStream(saveFile,true);
        outStream.write((str+"\n").getBytes());
        outStream.close();
    }
	// 这地方没有去找软件里面的方法，觉得太麻烦了。所以直接去网络上找到代码复制过来了
    private static String getMD5(String info) {
        try {
            //获取 MessageDigest 对象，参数为 MD5 字符串，表示这是一个 MD5 算法（其他还有 SHA1 算法等）：
            MessageDigest md5 = MessageDigest.getInstance("MD5");
            //update(byte[])方法，输入原数据
            //类似StringBuilder对象的append()方法，追加模式，属于一个累计更改的过程
            md5.update(info.getBytes("UTF-8"));
            //digest()被调用后,MessageDigest对象就被重置，即不能连续再次调用该方法计算原数据的MD5值。可以手动调用reset()方法重置输入源。
            //digest()返回值16位长度的哈希值，由byte[]承接
            byte[] md5Array = md5.digest();
            //byte[]通常我们会转化为十六进制的32位长度的字符串来使用,本文会介绍三种常用的转换方法
            return bytesToHex1(md5Array);
        } catch (NoSuchAlgorithmException e) {
            return "";
        } catch (UnsupportedEncodingException e) {
            return "";
        }
    }

    private static String bytesToHex1(byte[] md5Array) {
        StringBuilder strBuilder = new StringBuilder();
        for (int i = 0; i < md5Array.length; i++) {
            int temp = 0xff & md5Array[i];//TODO:此处为什么添加 0xff & ？
            String hexString = Integer.toHexString(temp);
            if (hexString.length() == 1) {//如果是十六进制的0f，默认只显示f，此时要补上0
                strBuilder.append("0").append(hexString);
            } else {
                strBuilder.append(hexString);
            }
        }
        return strBuilder.toString();
    }

   	// 依旧不想使用软件里面的复制方法，直接复制网上的代码了。但是可能在Android11上面出现问题，具体看下面说明
    public void copyfile(File fromFile, File toFile,Boolean rewrite ) throws Throwable
    {
        if (!fromFile.exists()) {
            return;
        }
        if (!fromFile.isFile()) {
            return ;
        }
        if (!fromFile.canRead()) {
            return ;
        }
        if (!toFile.getParentFile().exists()) {
            toFile.getParentFile().mkdirs();
        }
        if (toFile.exists() && rewrite) {
            toFile.delete();
        }

        try {
            java.io.FileInputStream fosfrom = new java.io.FileInputStream(fromFile);
            java.io.FileOutputStream fosto = new FileOutputStream(toFile);
            byte bt[] = new byte[1024];
            int c;
            while ((c = fosfrom.read(bt)) > 0) {
                fosto.write(bt, 0, c); //将内容写到新文件当中
            }
            fosfrom.close();
            fosto.close();

        } catch (Exception ex) {
            writefile(ex.toString());
        }
    }

    public void handleLoadPackage(final LoadPackageParam loadPackageParam) throws Throwable {
        XposedBridge.log("Loaded app: " + loadPackageParam.packageName);
        // writefile("启动包: "+loadPackageParam.packageName);
        if (loadPackageParam.packageName.equals("com.mmzztt.app")) {
            writefile("发现目标: "+loadPackageParam.packageName);
            Class<?> clazz = XposedHelpers.findClass("com.stub.StubApp", loadPackageParam.classLoader);
            // Class clazz = loadPackageParam.classLoader.loadClass("ceui.lisa.download.IllustDownload");
            XposedHelpers.findAndHookMethod(clazz, "interface7",Application.class,Context.class, new XC_MethodHook() {
                protected void beforeHookedMethod(XC_MethodHook.MethodHookParam param) throws Throwable {
                    super.beforeHookedMethod(param);
                    writefile("进入函数: ");
                    Context context = (Context) param.args[1];
                    //获取classloader，之后hook加固后的就使用这个classloader
                    ClassLoader realClassLoader = context.getClassLoader();
                    hookCheckoutXposed(realClassLoader,loadPackageParam);
                    writefile("hook结束");
                }

                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    // param.setResult("你已被劫持");
                    // writefile("新的图片:");
                }
            });
        }
    }

    private ArrayList<String> mImagePaths;
    private int pos;
    private  String cache_files="/sdcard/Android/data/com.mmzztt.app/cache/UIPhotoViewer/";
    private String mmttzz_files = "/sdcard/mmzztt/";
    private boolean is_copy = false;
    Context context;

    public void hookCheckoutXposed(ClassLoader classLoader,final LoadPackageParam loadPackageParam) throws Throwable {
        writefile("进入hook函数");

        Class Context_c = loadPackageParam.classLoader.loadClass("android.content.Context");

        // 获取 Context
        XposedHelpers.findAndHookMethod("com.uzmap.pkg.uzcore.uzmodule.UZModule", classLoader, "initPlatform", Context_c, new XC_MethodHook() {
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                if(param.args[0] != null) {
                    context = (Context)param.args[0];
                    cache_files = context.getExternalCacheDir().getAbsolutePath() + "/UIPhotoViewer/";
                    writefile("cache_files: "+cache_files);
                }
            }
        });

        XposedHelpers.findAndHookMethod("android.support.v4.view.PagerAdapter", classLoader, "setPrimaryItem", View.class,int.class,Object.class, new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                if(param.args[1] == null){
                    pos = 0;
                }else{
                    pos = (int)param.args[1];
                }
                is_copy = false;

            }
        });

        XposedHelpers.findAndHookMethod("com.uzmap.pkg.uzmodules.photoBrowserSu.view.largeImage.LargeImageView", classLoader, "smoothScale", float.class,int.class,int.class, new XC_MethodHook() {
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                writefile("双击了");

                String url = mImagePaths.get(pos);
                if(url == null){
                    Toast.makeText(context,"获取图片url失败",Toast.LENGTH_SHORT).show();
                    return ;
                }
                String md5_string = getMD5(url);
                String md5_name = md5_string+".jpg";
                String file_name = md5_name;

                writefile("定位"+pos+", 内容: " + url + ", md5: "+md5_string);

                String[] l_list = url.split("/");
                if(l_list != null){
                    file_name = l_list[l_list.length-1];
                }
                writefile("file_name: "+file_name+", l_list.length: "+l_list.length);
                if(!is_copy) {
                    copyfile(new File(cache_files + md5_string), new File(mmttzz_files + file_name), true);
                    Toast.makeText(context,"保存图片"+file_name,Toast.LENGTH_SHORT).show();
                    is_copy = true;
                }
            }
        });

        Class UZModuleContext_c = loadPackageParam.classLoader.loadClass("com.uzmap.pkg.uzcore.uzmodule.UZModuleContext");
        XposedHelpers.findAndHookMethod("com.apicloud.dialogBox.DialogBox", classLoader, "jsmethod_alert",UZModuleContext_c, new XC_MethodReplacement() {
            @Override
            protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
                writefile("禁止一个 alert弹窗");
                Toast.makeText(context,"你是真的想更新嘛？",Toast.LENGTH_SHORT).show();
                return null;
            }
        });

        Class ImageLoader_c = loadPackageParam.classLoader.loadClass("com.uzmap.pkg.uzmodules.photoBrowserSu.ImageLoader");
        Class ImageBrowserAdapter_c = loadPackageParam.classLoader.loadClass("com.uzmap.pkg.uzmodules.photoBrowserSu.ImageBrowserAdapter");

        XposedHelpers.findAndHookConstructor(ImageBrowserAdapter_c, Context_c,UZModuleContext_c,ArrayList.class,ImageLoader_c,String.class,  new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                writefile("进入 ImageBrowserAdapter 的构造函数了");
                try {
                    mImagePaths = (ArrayList<String>) param.args[2];
//                    for(int i=0;i<mImagePaths.size();i++){
//                        writefile(mImagePaths.get(i));
//                    }
                    writefile("数组长度: " + mImagePaths.size());
                }catch (Exception e){
                    writefile(e.toString());
                }
            }
        });
    }
}

TCP/IP方式：
setprop service.adb.tcp.port 5555
stop adbd
start adbd
 
usb方式：
setprop service.adb.tcp.port -1
stop adbd
start adbd

setenforce 0

apktool.jar d Shaft_3.1.5.apk -o Sha

apktool.bat b [资源文件夹] [打包生成的apk文件] 

repositories {
    jcenter()
}

compileOnly 'de.robv.android.xposed:api:82'
compileOnly 'de.robv.android.xposed:api:82:sources'

        <meta-data
            android:name="xposedmodule"
            android:value="true" />
        <meta-data
            android:name="xposeddescription"
            android:value="模块描述" />
        <meta-data
            android:name="xposedminversion"
            android:value="54" />