Hook and modify method with suorrogate? - Xposed Framework Development

So there is this new module:
http://repo.xposed.info/module/net.csu333.surrogate
and it works great when modifying methods which are returning some values or results.
But if there is method like this:
private getWrite(json address)
{
JSON jvar=download_json(address);
write_to_xml(filename.xml, jvar);
}
and this does not return anything.
But i want to modify this json and what it writes to filename.xml.
How to do it?

Related

[Q] Converting Java code to Smali for 1X Icon Fix

So I think I've found a solution to the 1x icon not displaying issue.
Inside services.jar is classes.dex. I used baksalmi to decompile the file and that way enables me to edit StatusBarPolicy.smali. In that file is
.field private static final sDataNetType_1x:[I = null
and
.field private static final sDataNetType_1xrtt:[I = null
I've searched and found if this was in its original Java format the code to force the 1x symbols would be
private static final int[] sDataNetType_1x = new int[] {
com.android.internal.R.drawable.stat_sys_data_connected_1x,
com.android.internal.R.drawable.stat_sys_data_in_1x,
com.android.internal.R.drawable.stat_sys_data_out_1x,
com.android.internal.R.drawable.stat_sys_data_inandout_1x,
};
My problem is, not being even a novice coder I can't figure out how to convert the code from Java to salmi which I believe would solve the issue and finally let me lay this to rest.
If anyone can help, please let me know.
EDIT: The code is not formatting properly, there is no space between 1 and x or any of the other file locations. It simply links to the drawable-hdpi folder pngs.
We need the same exact file from the samsung moment our should get you close but good luck trying to get java to smali with dex2jar you can achieve the opposite
Sent from my SPH-D700 using Tapatalk

MFC support for native WP7 Dll (and Exe too)

Hello friends.
I am a lazy person with a lack of time. So, when I wanted to Phone Commander to add support for exporting registry keys to a file, I found an older, freely usable code (first I tried RegSaveKey coredll function, but I coud not elevate calling Process privilegies). PCMD will be the first "ondevice" WP7 application that allows you to export this (thanks Ultrashot we can also do it from a PC by Remote Tools). Unfortunately, the obtained code was using an MFC classes (CFile etc). Probably would not be a problem to rewrite it for another entry in the file, but I do not want change 3rd code. And MFC can be useful in the future too.
There were basically two options:
1. Use dynamic linking, because statically linking MFC to ATL is not allowed (conflicts of application instances). But then I had to get the correct library and try if they will run on WP7. In the future, I'll try.
2. Take all the MFC source code (included in WM DTK) and rewrite them to work statically in WP7, with prepared out CWinApp etc. It was a nasty job, but for some classes (especially CFile) is complete and functional to use. Next week there will publish libraries, source code and tutorial to use MFC classes in ATL native WP7 projects. EDIT: See 2nd post, this is probably better way then first one.
Meanwhile small code sample to export registers (ExportRegKey is 3rd function using CFile parameter):
Code:
BOOL ExportRegKey(HKEY hroot, const CString &root, const CString &key, CFile &out);
STDMETHODIMP CRegistryX::RegExportKeySimple(DWORD dwKey, LPCWSTR szSubKey, LPCWSTR szFileName)
{
TRACE(L"RegExportKeySimple(DWORD dwKey = %X, LPCWSTR szSubKey = %s, LPCWSTR szFileName = %s)", dwKey, szSubKey, szFileName);
try
{
HKEY hKey = (HKEY) dwKey;
LONG lRes = ERROR_SUCCESS;
CString root = L"";
switch (dwKey)
{
case HKEY_LOCAL_MACHINE:
{
root = _T("HKEY_LOCAL_MACHINE");
} break;
case HKEY_CURRENT_USER:
{
root = _T("HKEY_CURRENT_USER");
} break;
case HKEY_CLASSES_ROOT:
{
root = _T("HKEY_CLASSES_ROOT");
} break;
case HKEY_USERS:
{
root = _T("HKEY_USERS");
} break;
/*
case HKEY_CURRENT_CONFIG:
{
root = _T("HKEY_CURRENT_CONFIG");
} break;
*/
default:
{
root = _T("HKEY_UNKNOWN");
} break;
root = _T("");
}
CString key = szSubKey;
CFile out;
out.Open(szFileName, CFile::modeWrite | CFile::modeCreate );
lRes = ExportRegKey(hKey, root, key, out);
out.Close();
TRACE(L"RegExportKeySimple ExportRegKey lRes = %d)", lRes);
if (lRes == ERROR_SUCCESS)
{
return S_OK;
}
else
{
return ReturnError(L"RegSetDwordSimple RegSetValueEx", 0x80070000 | lRes);
}
}
catch (...)
{
return ReturnError(L"RegGetDwordSimple", GetLastError());
}
}
This is also Native TRACE example to see native messages in VP2010 managed Output window.
Full MFC using
I tried FULL MFC from VS2008 CE SDK using and this is possible.
1. Exe files - success with statical or dynamical MFC linking. Drawable components may have problems only.
2. Static linking to dll: If we can want use native dll with statically linked MFC to managed VS2010 dll or application, there are two ways:
- To change our usual COM interface to MFC standard. It may be possible, but I did not try it.
- To make ATL interstitial ATL dll with COM interface, which can call exported functions from MFC dll.
3. Dynamical MFC linking to ATL (COM) dll. I mean thi is the best way now.
For dynamical linking MFC dlls must be copied to device - to appplication directory or ideally to \Windows directory. Mostly:
\\Program Files (x86)\Microsoft Visual Studio 9.0\VC\ce\dll\ARMV4I\msvcr90.dll
\\Program Files (x86)\Microsoft Visual Studio 9.0\VC\ce\dll\ARMV4I\atl90.dll
\\Program Files (x86)\Microsoft Visual Studio 9.0\VC\ce\dll\ARMV4I\msvcr90d.dll
\\Program Files (x86)\Microsoft Visual Studio 9.0\VC\ce\dll\ARMV4I\MFC90UD.dll

how to get the result of a method

Hi All,
I am new to Xposed and am trying to understand how Xposed works and how are modules for Xposed written. I am stuck with something that's apparently very basic. Please bare with me and help me out with it.
Quoting example from XposedBridge/wiki/Development-tutorial
I understand that if the method updateClock() is called as myClock.updateClock(), then I can get access to the object myClock as param.thisObject.
So similarly, if my case is url.openConnection(), instead of myClock.updateClock(), then using param.thisObject I would have access to the 'url' object above. This works absolutely fine.
In my case above, I am trying to hook url.openConnection() as below :
Code:
findAndHookMethod("java.net.URL", lpparam.classLoader, "openConnection", new XC_MethodHook(){
@Override
protected void afterHookedMethod(MethodHookParam param)
after openConnection() has completed executing, it returns an HttpUrlConnection or an HttpsUrlConnection object. I want to have a reference to this returned object itself, (like I had access to the 'url' object on which openConnection() was called using param.thisObject).
How can I access the returned object from a method ?
Will param.getResult() or param.getResultOrThrowable() be useful ?
If not what are they used for / is there any resource that has a documentation of these APIs ?
param.getResult() is what you're looking for.

[GENERAL KNOWLEDGE]View files/resources a 3rd party app read/writes to

Hello all,
Just curious about some general knowledge (salute; reference: HIMYM) on whether or not it's possible to see what an app is doing (during installation, in the background, app initialization, and foreground usage)
It's not my own app in question so I understand physically seeing the code is out of the question; however I'm more concerned about what the app is doing and the files/directories it accesses, and whether or not there's a way for me to view these activities.
If you must know, the app in question is the Adidas Confirmed app as RootCloak (and various other apps) DO NOT WORK. I'm attempting to isolate the issue, and I'm fairly certain it has to do with an external resource (within the device; i.e. different partition, files, folders, etc.) that permanently marks the device 'rooted' during initial installation. Maybe if I can see exactly what the app reaches out to, I can then come up with a fix action.
Any input would be greatly appreciated.
You could try to decompile this app, but it might not work very well if the app obfuscates the code http://decompileandroid.com/
Rijul.A said:
You could try to decompile this app, but it might not work very well if the app obfuscates the code http://decompileandroid.com/
Click to expand...
Click to collapse
This actually worked PERFECTLY. I was able to go inside the src and see exactly the commands the app calls for to check root.
If anyone is interested...I'm going to try a few things out, play with some variables and see if I can't allow the app access on my rooted device.
Code:
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: braces fieldsfirst space lnc
package com.gpshopper.adidas.objects;
import android.os.Build;
import java.io.File;
// Referenced classes of package com.gpshopper.adidas.objects:
// ExecShell
public class Root
{
private static String LOG_TAG = com/gpshopper/adidas/objects/Root.getName();
public Root()
{
}
public static boolean checkRootMethod1()
{
String s = Build.TAGS;
return s != null && s.contains("test-keys");
}
public static boolean checkRootMethod2()
{
label0:
{
label1:
{
boolean flag = false;
boolean flag1;
try
{
File file = new File("/system/app/Superuser.apk");
File file1 = new File("/system/app/SuperSU/SuperSU.apk");
if (file.exists())
{
break label1;
}
flag1 = file1.exists();
}
catch (Exception exception)
{
return false;
}
if (!flag1)
{
break label0;
}
}
flag = true;
}
return flag;
}
public static boolean checkRootMethod3()
{
return (new ExecShell()).executeCommand(ExecShell.SHELL_CMD.check_su_binary) != null;
}
public static boolean isDeviceRooted()
{
return checkRootMethod1() || checkRootMethod2() || checkRootMethod3();
}
}
There is a similar file also in the src using a different language I've not yet been able to comprehend. I'm really new at this in case you couldn't already figure lol...is it possible to view my device's database where apps store variables? It may be possible the app is permanently storing the variable even after its removal so best case would be to start from a fresh ROM install. Just a theory.
The other language is generally irrelevant
Delete /data/data/<packagename>/ or clear app data normally, that will work, no need for a fresh install.
If you need help hooking this method, please quote me in a reply.

Replacing Facebook Messenger resources

I am trying to change the emojies inside of Facebook Messenger by the ones from EmojiOne.
In the first place, I decompiled through dex2jar the messenger APK and did quite a bit of search but no luck, it is obfuscated and pretty hard to read.
So my second guess was to replace each emoji in the resources. To do that, I used aapt to get one and try it:
HTML:
> aapt dump resources msg.apk | grep 1f60f
resource 0x7f020eca com.facebook.orca:drawable/messenger_emoji_1f60f_32: t=0x03 d=0x000017b3 (s=0x0008 r=0x00)
resource 0x7f020ecb com.facebook.orca:drawable/messenger_emoji_1f60f_64: t=0x03 d=0x000017b2 (s=0x0008 r=0x00)
resource 0x7f0c2086 com.facebook.orca:string/emoji_1f60f: t=0x03 d=0x00003439 (s=0x0008 r=0x00)
I tried this :
HTML:
public void handleInitPackageResources(XC_InitPackageResources.InitPackageResourcesParam resparam) throws Throwable {
if (!resparam.packageName.equals("com.facebook.orca"))
return;
XModuleResources modRes = XModuleResources.createInstance(MODULE_PATH, resparam.res);
resparam.res.setReplacement("com.facebook.orca", "drawable", "messenger_emoji_1f60f_32", modRes.fwd(R.drawable.emojione_emoji_1f60f_32));
resparam.res.setReplacement("com.facebook.orca", "drawable", "messenger_emoji_1f60f_64", modRes.fwd(R.drawable.emojione_emoji_1f60f_64));
}
and quite a few other things, but nothing seems to work. My drawable is working since I tried it in an Activity.
Even though I can get this working, would this be a proper solution to my original problem ?
Will I need to replace EACH emoji one by one in the two sizes ?
Thanks in advance
Bump please, no one?
Up for this thanks
This doesn't solve your problem, but I recently decompiled a proguarded apk too, and couldn't find the right resources easily. I found a method too do so though.
First, install xinstaller, then under misc enable debugging apps (allows debugging any app).
Next, connect your phone, make sure adb is on and connected, open Facebook and go to a conversation. Send some emoji too.
In Android studio, go into Android device monitor (ddms), tools -> Android -> Android device monitor. MAKE SURE YOU SET DDMS UP first
Now, find the button in the toolbar that says something like ui automator dump . This will take a layout dump of your displayed screen and give you a screenshot that you can use to click on various layout objects. You will be able to select the emoji and see what resource id is associated with it.
Or at least, it will give you a method to start looking for the resource id's. Combined with a tool like grep for windows, checking out public.xml for the ID's (they're in hex, but if you want to search in code for the ID, convert it to decimal). And you can pretty much find where the code and resource ID's are now !

Categories

Resources