Skip to content

更加优雅的绕过Activity 验证 #19

@keger

Description

@keger

public class ZeusInstrumentation extends Instrumentation {

public static final String TAG = "Instrumentation";
public static final String EXEC_START_ACTIVITY = "execStartActivity";

public Instrumentation oldInstrumentation;

public PAInstrumentation(Instrumentation mInstrumentation) {
    oldInstrumentation = mInstrumentation;
}

@Override
public Activity newActivity(ClassLoader cl, String className, Intent intent) throws InstantiationException, IllegalAccessException, ClassNotFoundException {
    if (className.equals(PluginConstant.PLUGIN_ACTIVITY_FOR_STANDARD) && intent != null) {
        Bundle bundle = intent.getExtras();
        if (bundle != null) {
            String realActivity = bundle.getString(PluginConstant.PLUGIN_REAL_ACTIVITY);
            if (!TextUtils.isEmpty(realActivity)) {
                return super.newActivity(cl, realActivity, intent);
            }
        }
    }
    return super.newActivity(cl, className, intent);
}

public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token, Activity target,
                                        Intent intent, int requestCode, Bundle options) {

    markIntentIfNeeded(who, intent);

    try {
        Method execStartActivity = Instrumentation.class.getDeclaredMethod(
                EXEC_START_ACTIVITY,
                Context.class, IBinder.class, IBinder.class, Activity.class,
                Intent.class, int.class, Bundle.class);
        execStartActivity.setAccessible(true);
        return (ActivityResult) execStartActivity.invoke(oldInstrumentation, who,
                contextThread, token, target, intent, requestCode, options);
    } catch (Exception e) {
        throw new RuntimeException("if Instrumentation paramerter is mInstrumentation, hook will fail");
    }
}

public void markIntentIfNeeded(Context who, Intent intent) {
    if (intent.getComponent() == null) {
        return;
    }

    String targetClassName = intent.getComponent().getClassName();
    List<ResolveInfo> list = who.getPackageManager().queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY);
    boolean internalOnly = !(list != null && list.size() != 0);
    if (internalOnly) {
        intent.setClassName(who.getPackageName(), PluginConstant.PLUGIN_ACTIVITY_FOR_STANDARD);
        intent.putExtra(PluginConstant.PLUGIN_REAL_ACTIVITY, targetClassName);
    }
}

}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions