Skip to content

更加优雅的绕过Activity 验证 #19

@keger

Description

@keger

public class ZeusInstrumentation extends Instrumentation {

public static final String TAG = "Instrumentation";
public static final String EXEC_START_ACTIVITY = "execStartActivity";

public Instrumentation oldInstrumentation;

public PAInstrumentation(Instrumentation mInstrumentation) {
    oldInstrumentation = mInstrumentation;
}

@Override
public Activity newActivity(ClassLoader cl, String className, Intent intent) throws InstantiationException, IllegalAccessException, ClassNotFoundException {
    if (className.equals(PluginConstant.PLUGIN_ACTIVITY_FOR_STANDARD) && intent != null) {
        Bundle bundle = intent.getExtras();
        if (bundle != null) {
            String realActivity = bundle.getString(PluginConstant.PLUGIN_REAL_ACTIVITY);
            if (!TextUtils.isEmpty(realActivity)) {
                return super.newActivity(cl, realActivity, intent);
            }
        }
    }
    return super.newActivity(cl, className, intent);
}

public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token, Activity target,
                                        Intent intent, int requestCode, Bundle options) {

    markIntentIfNeeded(who, intent);

    try {
        Method execStartActivity = Instrumentation.class.getDeclaredMethod(
                EXEC_START_ACTIVITY,
                Context.class, IBinder.class, IBinder.class, Activity.class,
                Intent.class, int.class, Bundle.class);
        execStartActivity.setAccessible(true);
        return (ActivityResult) execStartActivity.invoke(oldInstrumentation, who,
                contextThread, token, target, intent, requestCode, options);
    } catch (Exception e) {
        throw new RuntimeException("if Instrumentation paramerter is mInstrumentation, hook will fail");
    }
}

public void markIntentIfNeeded(Context who, Intent intent) {
    if (intent.getComponent() == null) {
        return;
    }

    String targetClassName = intent.getComponent().getClassName();
    List<ResolveInfo> list = who.getPackageManager().queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY);
    boolean internalOnly = !(list != null && list.size() != 0);
    if (internalOnly) {
        intent.setClassName(who.getPackageName(), PluginConstant.PLUGIN_ACTIVITY_FOR_STANDARD);
        intent.putExtra(PluginConstant.PLUGIN_REAL_ACTIVITY, targetClassName);
    }
}

}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions