Introduction

Plugin loading system for Xposed and LSPosed frameworks, supporting Java and native hooks.

Example

1. Hook is a regular app

Preparation

  • HookApp
  • Hook plugin apk
  • Connect to the device terminal and run the apmt command to load the Hook plugin (before executing the apmt command, use the "vu" command to switch to the root environment)
HookApp content
public class MainActivity extends AppCompatActivity {

    static {
        System.loadLibrary("test");
    }

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        EdgeToEdge.enable(this);
        setContentView(R.layout.activity_main);
        ViewCompat.setOnApplyWindowInsetsListener(findViewById(R.id.main), (v, insets) -> {
            Insets systemBars = insets.getInsets(WindowInsetsCompat.Type.systemBars());
            v.setPadding(systemBars.left, systemBars.top, systemBars.right, systemBars.bottom);
            return insets;
        });

        Log.d("___TestApp___", "call onCreate");
        Log.d("___TestApp___", "call stringFromJNI(\"haha\") return:" + stringFromJNI("haha"));
        Log.d("___TestApp___", "call add(10, 5) return:" + add(10, 5));
        Log.d("___TestApp___", "call add(1, 5) return:" + add(1, 5));
    }

    public native String stringFromJNI(String str);

    public native int add(int a, int b);
}
Hook plugin content
public class Entry {

    private static final String TAG = "___HKAPP___";
    private static Context globalContext;

    public static void appMain(ClassLoader loader, Context context, String appClass, String pkg, String process) {
        Log.d(TAG, "appClass=" + appClass + ", filesDir=" + context.getFilesDir() + ", pid=" + Process.myPid() + ", process=" + process);
        if (process.contains("sandboxed_process")) {
            return;//Temporarily ignore webview-related matters
        }
        if (pkg.equals("com.armcloud.testapp")) {
            try {
                Log.d(TAG, "do hookTestApp");
                Class<?> MainActivity = loader.loadClass("com.armcloud.testapp.MainActivity");
                XSHelpers.findAndHookMethod(MainActivity, "stringFromJNI", String.class, new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        Log.d(TAG, "call MainActivity->stringFromJNI arg=" + param.args[0]);
                    }

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        super.afterHookedMethod(param);
                        Log.d(TAG, "call stringFromJNI return:" + param.getResult());
                        param.setResult("byebye");
                    }
                });

                // android.app.Activity
                XSHelpers.findAndHookMethod(Activity.class, "onCreate", Bundle.class, new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        super.beforeHookedMethod(param);
                        Log.d(TAG, "call MainActivity->onCreate:" + param.args[0]);
                    }
                });
                Log.d(TAG, "exit hookTestApp");
            } catch (Exception e) {
                Log.d(TAG, "hookTestApp failed:\n" + Log.getStackTraceString(e));
            }
        }
    }
}
Run the apmt command to load the plugin

Import the Hook plugin apk into your phone (here, import to SD card path)

Add plugins

The prompt "add Patch: appdemo success" means the plugin was successfully added.
You can also check whether the plugin was successfully added through the "apmt patch list":

Run the Hooked apk, open logcat, and verify the results:

You can see the logs printed in the hook plugin, indicating the hook was successful.

2.Hook SystemServer

Preparation

  • Hook plugin apk
  • Connect the device terminal to execute the apmt command to load the Hook plugin
Hook plugin content
public class Entry {
    private static final String TAG = "___HK_SysServer___";

    public static void systemMain(ClassLoader classLoader, String pkg, String processName) {
        doHook(classLoader);
    }

    private static void doHook(ClassLoader classLoader) {
        try {

            @SuppressLint("PrivateApi")
            Class<?> timingsTraceAndSlog = classLoader.loadClass("com.android.server.utils.TimingsTraceAndSlog");
            XSHelpers.findAndHookMethod("com.android.server.SystemServer", classLoader, "startBootstrapServices",
                    timingsTraceAndSlog, new XC_MethodHook() {
                        @Override
                        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                            super.beforeHookedMethod(param);
                            Log.d(TAG, "before call startBootstrapServices");
                        }

                        @Override
                        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                            super.afterHookedMethod(param);
                            Log.d(TAG, "after call startBootstrapServices");
                        }
                    });
            Log.d(TAG, "load system hook ok");
        } catch (Exception ex) {
            ex.printStackTrace();
            Log.d(TAG, "doHook failed:" + Log.getStackTraceString(ex));
        }
    }
}
Run the apmt command to load the plugin

Import the Hook plugin apk into your phone (here, import to SD card path)

Add plugin
Note: Hook SystemServer -p needs to be set to "android"

Restart the device, open logcat, and verify the results:

You can see the logs printed in the hook plugin, indicating the hook was successful.

Terminology Introduction

1. Plugin operation commands

This framework uses the "apmt command" plugin to operate.

2. Plugins

Write a Hook plugin using "Custom Plugins" and use plugin operation commands to load the plugin.

apmt command

Explanation

The apmt command only needs to be executed once. Once the plugin is successfully added, the application takes effect every time it starts.

Required parameters

apmt patch

Basic Operations

1. Add patch packs

apmt patch add -n test -p com.armcloud.testapp -f /sdcard/test.apk

2. Delete the patch package

apmt patch del -n test

3. Check the patch package

apmt patch list

4. Check the help information

apmt patch help

All parameters

ParametersDescription
-nPlugin name
-pThe name of the application package where the plugin is needed
-uIf you need to download the plugin via URL, send in the download link
-fWhen using local plugins, pass in the plugin file path

Custom plugins

1. Hook is a regular app

  • The entry class must be named :androidx.app.Entry
  • The entry method must be named as: public static void appMain( ClassLoader loader, // Class loader Context context, // Context String appClass, // Package name String process // processname )

2.Hook SystemServer

  • The entry class must be named :androidx.app.Entry
  • The entry method must be named as: public static void systemMain( ClassLoader classLoader, // Class loader String pkg, // Package name, default is android String processName // processname )

Demo Download

Click to download ArmCloudXposeDemo