昨花了点时间，参考github issues 总算实现了基于xposed的系统服务注入，本文目的是为了“解决应用之间hook后数据共享，任意app ServiceManager.getService就可以直接调用aidl实现了进程通信”（比如aidl service实现socket,http server等，或者从某app获取数据传递给另外个app等场景，能做什么大家自己想吧，当然也可以实现非xposed版本的，需要通过直接smali方式。因为需快速实现，我就基于xposed的方案凑活用着用吧）
Xposed我就不介绍了，Xposed有2个重要接口，一个是针对应用级别hook：IXposedHookLoadPackage，另一个就是针对系统级别的：IXposedHookZygoteInit
这里将使用IXposedHookZygoteInit实现aidl添加到系统服务中，当然，通过IXposedHookLoadPackage也是可以实现的，但是因为我们注入的服务是希望像系统服务一样，开机启动，关机停止，另外IXposedHookZygoteInit本身就是定位在针对系统hook，所以还是建议使用IXposedHookZygoteInit。
直接进入正题：
1.创建 android.os.ICustomService.aidl
package android.os;
// Declare any non-default types here with import statements
interface ICustomService {
String sayHello();
}
2.创建CustomService实现类
1 public class CustomService extends ICustomService.Stub {
2 private Context mContext;
3 public CustomService(Context context) {
4 mContext = context;
5 }
6
7 @Override
8 public String sayHello() throws RemoteException {
9 return "Just Hello World";
10 }
11
12 //ActivityManagerService的systemReady在所有服务初始化完成后触发，这定义这个是为了实现自定义服务的初始化代码实现
13 public void systemReady() {
14 // Make your initialization here
15 }
16 }
3.创建ApplicationSocket，实现IXposedHookZygoteInit接口，这实现系统启动时候触发hook
1 public class ApplicationSocket implements IXposedHookZygoteInit{
2 public static String TAG = "ApplicationSocket";
3 @Override
4 public void initZygote(StartupParam startupParam) throws Throwable {
5 XposedBridge.hookAllMethods(ActivityThread.class, "systemMain", new SystemServiceHook());
6 }
7 }
4.创建SystemServiceHook 重写XC_MethodHook,实现注册服务，这也是最核心的类
import android.content.Context;
import android.os.Build;
import android.os.CustomService;
import android.os.ICustomService;
import android.os.ServiceManager;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
/**
* Created by bluce on 17/12/5.
*/
public class SystemServiceHook extends XC_MethodHook {
private static CustomService oInstance;
private static boolean systemHooked;
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
if (systemHooked) {
return;
}
final ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
Class activityManagerServiceClazz = null;
try {
activityManagerServiceClazz = XposedHelpers.findClass("com.android.server.am.ActivityManagerService", classLoader);
} catch (RuntimeException e) {
// do nothing
}
if (!systemHooked && activityManagerServiceClazz!=null) {
systemHooked = true;
//系统服务启动完毕，通知自定义服务
XposedBridge.hookAllMethods(
activityManagerServiceClazz,
"systemReady",
new XC_MethodHook() {
@Override
protected final void afterHookedMethod(final MethodHookParam param) {
oInstance.systemReady();
XposedBridge.log(">>>systemReady!!!!");
}
}
);
//注册自定义服务到系统服务中
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
XposedBridge.hookAllConstructors(activityManagerServiceClazz, new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Context context = (Context) XposedHelpers.getObjectField(param.thisObject, "mContext");
registerService(classLoader,context);
}
});
}else{
XposedBridge.hookAllMethods(
activityManagerServiceClazz,
"main",
new XC_MethodHook() {
@Override
protected final void afterHookedMethod(final MethodHookParam param) {
Context context = (Context) param.getResult();
registerService(classLoader,context);
}
}
);
}
}
}
private static void registerService(final ClassLoader classLoader, Context context) {
XposedBridge.log(">>>register service, Build.VERSION.SDK_INT"+Build.VERSION.SDK_INT);
oInstance = new CustomService(context);
Class ServiceManager = XposedHelpers.findClass("android.os.ServiceManager",classLoader);
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
//避免java.lang.SecurityException错误,从5.0开始，selinux服务名称需要加前缀"user."
XposedHelpers.callStaticMethod(
ServiceManager,
"addService",
"user.custom.service",
oInstance,
true
);
} else {
XposedHelpers.callStaticMethod(
ServiceManager,
"addService",
"custom.service",
oInstance
);
}
}
//use service demo
public static ICustomService mService;
public static String someMethod(Context context) {
try {
if (mService == null) {
mService=ICustomService.Stub.asInterface(ServiceManager.getService("user.wx_custom.service"));
//mService =(ICustomService)context.getSystemService("wx_custom.service");
}
return mService.sayHello();
} catch (Exception e) {
System.out.println(e.getMessage());
e.printStackTrace();
}
return ">>> someMethod failed!!! ";
}
}
5.在当前应用activity中调用系统服务,service实现可以创建成单独的module,这样就实现不同项目直接使用，最重要的是在当前项目xposed hook代码中可以直接使用了，这也是本文的最初衷。
button = (Button) findViewById(R.id.testButton);
button.setOnClickListener(new View.OnClickListener(){
@Override
public void onClick(View v){
if(true){
//testPattern();return;
//HookTest.registerReceiver(context);
String str = SystemServiceHook.someMethod(MainActivity.context);
if(str!=null){
System.out.println(">>>>:::"+str);
}
return;
}
}
} ;
基于以上，CustomService整体的代码就实现了，重启系统就变成了系统服务，可以直接使用。但是以下2点需要特别注意：
1.com.android.server.am.ActivityManagerService是framework不公开的方法和类，所以项目需要导入AndroidHiddenAPI.jar这个包
2.android5.0之前SystemContext通过call ActivityManagerService的main方法就可以直接获取，但是5.0开始是通过createSystemContext方法生产，所以只能判断下版本，然后一个通过构造取获取，一个通过main返回结果获取
