基于xposed实现android注册系统服务，解决跨进程共享数据问题

昨花了点时间，参考github issues 总算实现了基于xposed的系统服务注入，本文目的是为了“解决应用之间hook后数据共享，任意app ServiceManager.getService就可以直接调用aidl实现了进程通信”（比如aidl service实现socket,http server等，或者从某app获取数据传递给另外个app等场景，能做什么大家自己想吧，当然也可以实现非xposed版本的，需要通过直接smali方式。因为需快速实现，我就基于xposed的方案凑活用着用吧）

Xposed我就不介绍了，Xposed有2个重要接口，一个是针对应用级别hook：IXposedHookLoadPackage，另一个就是针对系统级别的：IXposedHookZygoteInit

这里将使用IXposedHookZygoteInit实现aidl添加到系统服务中，当然，通过IXposedHookLoadPackage也是可以实现的，但是因为我们注入的服务是希望像系统服务一样，开机启动，关机停止，另外IXposedHookZygoteInit本身就是定位在针对系统hook，所以还是建议使用IXposedHookZygoteInit。

直接进入正题：

1.创建 android.os.ICustomService.aidl

package android.os;

// Declare any non-default types here with import statements

interface ICustomService {
    String sayHello();
}

2.创建CustomService实现类

public class CustomService extends ICustomService.Stub {
    private Context mContext;
    public CustomService(Context context) {
        mContext = context;
    }

    @Override
    public String sayHello() throws RemoteException {
        return "Just Hello World";
    }

    //ActivityManagerService的systemReady在所有服务初始化完成后触发，这定义这个是为了实现自定义服务的初始化代码实现
    public void systemReady() {
        // Make your initialization here
    }
}

3.创建ApplicationSocket，实现IXposedHookZygoteInit接口，这实现系统启动时候触发hook

public class ApplicationSocket implements IXposedHookZygoteInit{
    public static String TAG = "ApplicationSocket";
    @Override
    public void initZygote(StartupParam startupParam) throws Throwable {
        XposedBridge.hookAllMethods(ActivityThread.class, "systemMain", new SystemServiceHook());
    }
}

4.创建SystemServiceHook 重写XC_MethodHook,实现注册服务，这也是最核心的类

import android.content.Context;
import android.os.Build;
import android.os.CustomService;
import android.os.ICustomService;
import android.os.ServiceManager;

import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;

/**
 * Created by bluce on 17/12/5.
 */

public class SystemServiceHook extends XC_MethodHook {
    private static CustomService oInstance;
    private static boolean systemHooked;

    @Override
    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
        if (systemHooked) {
            return;
        }
        final ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
        Class activityManagerServiceClazz = null;
        try {
            activityManagerServiceClazz = XposedHelpers.findClass("com.android.server.am.ActivityManagerService", classLoader);
        } catch (RuntimeException e) {
            // do nothing
        }
        if (!systemHooked && activityManagerServiceClazz!=null) {
            systemHooked = true;
            //系统服务启动完毕，通知自定义服务
            XposedBridge.hookAllMethods(
                    activityManagerServiceClazz,
                    "systemReady",
                    new XC_MethodHook() {
                        @Override
                        protected final void afterHookedMethod(final MethodHookParam param) {
                            oInstance.systemReady();
                            XposedBridge.log(">>>systemReady!!!!");
                        }
                    }
            );
            //注册自定义服务到系统服务中
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
                XposedBridge.hookAllConstructors(activityManagerServiceClazz, new XC_MethodHook() {
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        Context context = (Context) XposedHelpers.getObjectField(param.thisObject, "mContext");
                        registerService(classLoader,context);
                    }
                });
            }else{
                XposedBridge.hookAllMethods(
                        activityManagerServiceClazz,
                        "main",
                        new XC_MethodHook() {
                            @Override
                            protected final void afterHookedMethod(final MethodHookParam param) {
                                Context context = (Context) param.getResult();
                                registerService(classLoader,context);
                            }
                        }
                );
            }
        }
    }
    
    private static void registerService(final ClassLoader classLoader, Context context) {
        XposedBridge.log(">>>register service, Build.VERSION.SDK_INT"+Build.VERSION.SDK_INT);
        oInstance = new CustomService(context);
        Class<?> ServiceManager = XposedHelpers.findClass("android.os.ServiceManager",classLoader);
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
            //避免java.lang.SecurityException错误,从5.0开始，selinux服务名称需要加前缀"user."
            XposedHelpers.callStaticMethod(
                    ServiceManager,
                    "addService",
                    "user.custom.service",
                    oInstance,
                    true
            );
        } else {
            XposedHelpers.callStaticMethod(
                    ServiceManager,
                    "addService",
                    "custom.service",
                    oInstance
            );
        }
    }


    //use service demo
    public static ICustomService mService;
    public static String someMethod(Context context) {
        try {
            if (mService == null) {
                mService=ICustomService.Stub.asInterface(ServiceManager.getService("user.wx_custom.service"));
                //mService =(ICustomService)context.getSystemService("wx_custom.service");
            }
            return mService.sayHello();
        } catch (Exception e) {
            System.out.println(e.getMessage());
            e.printStackTrace();
        }
        return  ">>> someMethod failed!!! ";
    }
}

5.在当前应用activity中调用系统服务,service实现可以创建成单独的module,这样就实现不同项目直接使用，最重要的是在当前项目xposed hook代码中可以直接使用了，这也是本文的最初衷。

 button = (Button) findViewById(R.id.testButton);
        button.setOnClickListener(new View.OnClickListener(){
            @Override
            public  void  onClick(View v){
                if(true){
                    //testPattern();return;
                    //HookTest.registerReceiver(context);
                    String str = SystemServiceHook.someMethod(MainActivity.context);
                    if(str!=null){
                        System.out.println(">>>>:::"+str);
                    }
                    return;
                }
            }
    } ;

基于以上，CustomService整体的代码就实现了，重启系统就变成了系统服务，可以直接使用。但是以下2点需要特别注意：

1.com.android.server.am.ActivityManagerService是framework不公开的方法和类，所以项目需要导入AndroidHiddenAPI.jar这个包

2.android5.0之前SystemContext通过call ActivityManagerService的main方法就可以直接获取，但是5.0开始是通过createSystemContext方法生产，所以只能判断下版本，然后一个通过构造取获取，一个通过main返回结果获取