基于xposed实现android注册系统服务，解决跨进程共享数据问题

昨花了点时间，参考github issues 总算实现了基于xposed的系统服务注入，本文目的是为了“解决应用之间hook后数据共享，任意app ServiceManager.getService就可以直接调用aidl实现了进程通信”（比如aidl service实现socket,http server等，或者从某app获取数据传递给另外个app等场景，能做什么大家自己想吧，当然也可以实现非xposed版本的，需要通过直接smali方式。因为需快速实现，我就基于xposed的方案凑活用着用吧）

Xposed我就不介绍了，Xposed有2个重要接口，一个是针对应用级别hook：IXposedHookLoadPackage，另一个就是针对系统级别的：IXposedHookZygoteInit

这里将使用IXposedHookZygoteInit实现aidl添加到系统服务中，当然，通过IXposedHookLoadPackage也是可以实现的，但是因为我们注入的服务是希望像系统服务一样，开机启动，关机停止，另外IXposedHookZygoteInit本身就是定位在针对系统hook，所以还是建议使用IXposedHookZygoteInit。

直接进入正题：

1.创建 android.os.ICustomService.aidl

package android.os;

// Declare any non-default types here with import statements

interface ICustomService {
    String sayHello();
}

2.创建CustomService实现类

 public class CustomService extends ICustomService.Stub {
     private Context mContext;
     public CustomService(Context context) {
         mContext = context;
     }

     @Override
     public String sayHello() throws RemoteException {
         return "Just Hello World";
     }

     //ActivityManagerService的systemReady在所有服务初始化完成后触发，这定义这个是为了实现自定义服务的初始化代码实现
     public void systemReady() {
         // Make your initialization here
     }
 }

3.创建ApplicationSocket，实现IXposedHookZygoteInit接口，这实现系统启动时候触发hook

 public class ApplicationSocket implements IXposedHookZygoteInit{
     public static String TAG = "ApplicationSocket";
     @Override
     public void initZygote(StartupParam startupParam) throws Throwable {
         XposedBridge.hookAllMethods(ActivityThread.class, "systemMain", new SystemServiceHook());
     }
 }

4.创建SystemServiceHook 重写XC_MethodHook,实现注册服务，这也是最核心的类

 import android.content.Context;
 import android.os.Build;
 import android.os.CustomService;
 import android.os.ICustomService;
 import android.os.ServiceManager;

 import de.robv.android.xposed.XC_MethodHook;
 import de.robv.android.xposed.XposedBridge;
 import de.robv.android.xposed.XposedHelpers;

 /**
  * Created by bluce on 17/12/5.
  */

 public class SystemServiceHook extends XC_MethodHook {
     private static CustomService oInstance;
     private static boolean systemHooked;

     @Override
     protected void afterHookedMethod(MethodHookParam param) throws Throwable {
         if (systemHooked) {
             return;
         }
         final ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
         Class activityManagerServiceClazz = null;
         try {
             activityManagerServiceClazz = XposedHelpers.findClass("com.android.server.am.ActivityManagerService", classLoader);
         } catch (RuntimeException e) {
             // do nothing
         }
         if (!systemHooked && activityManagerServiceClazz!=null) {
             systemHooked = true;
             //系统服务启动完毕，通知自定义服务
             XposedBridge.hookAllMethods(
                     activityManagerServiceClazz,
                     "systemReady",
                     new XC_MethodHook() {
                         @Override
                         protected final void afterHookedMethod(final MethodHookParam param) {
                             oInstance.systemReady();
                             XposedBridge.log(">>>systemReady!!!!");
                         }
                     }
             );
             //注册自定义服务到系统服务中
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
                 XposedBridge.hookAllConstructors(activityManagerServiceClazz, new XC_MethodHook() {
                     @Override
                     protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                         Context context = (Context) XposedHelpers.getObjectField(param.thisObject, "mContext");
                         registerService(classLoader,context);
                     }
                 });
             }else{
                 XposedBridge.hookAllMethods(
                         activityManagerServiceClazz,
                         "main",
                         new XC_MethodHook() {
                             @Override
                             protected final void afterHookedMethod(final MethodHookParam param) {
                                 Context context = (Context) param.getResult();
                                 registerService(classLoader,context);
                             }
                         }
                 );
             }
         }
     }

     private static void registerService(final ClassLoader classLoader, Context context) {
         XposedBridge.log(">>>register service, Build.VERSION.SDK_INT"+Build.VERSION.SDK_INT);
         oInstance = new CustomService(context);
         Class<?> ServiceManager = XposedHelpers.findClass("android.os.ServiceManager",classLoader);
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
             //避免java.lang.SecurityException错误,从5.0开始，selinux服务名称需要加前缀"user."
             XposedHelpers.callStaticMethod(
                     ServiceManager,
                     "addService",
                     "user.custom.service",
                     oInstance,
                     true
             );
         } else {
             XposedHelpers.callStaticMethod(
                     ServiceManager,
                     "addService",
                     "custom.service",
                     oInstance
             );
         }
     }

     //use service demo
     public static ICustomService mService;
     public static String someMethod(Context context) {
         try {
             if (mService == null) {
                 mService=ICustomService.Stub.asInterface(ServiceManager.getService("user.wx_custom.service"));
                 //mService =(ICustomService)context.getSystemService("wx_custom.service");
             }
             return mService.sayHello();
         } catch (Exception e) {
             System.out.println(e.getMessage());
             e.printStackTrace();
         }
         return  ">>> someMethod failed!!! ";
     }
 }

5.在当前应用activity中调用系统服务,service实现可以创建成单独的module,这样就实现不同项目直接使用，最重要的是在当前项目xposed hook代码中可以直接使用了，这也是本文的最初衷。

 button = (Button) findViewById(R.id.testButton);
        button.setOnClickListener(new View.OnClickListener(){
            @Override
            public  void  onClick(View v){
                if(true){
                    //testPattern();return;
                    //HookTest.registerReceiver(context);
                    String str = SystemServiceHook.someMethod(MainActivity.context);
                    if(str!=null){
                        System.out.println(">>>>:::"+str);
                    }
                    return;
                }
            }
    } ;

基于以上，CustomService整体的代码就实现了，重启系统就变成了系统服务，可以直接使用。但是以下2点需要特别注意：

1.com.android.server.am.ActivityManagerService是framework不公开的方法和类，所以项目需要导入AndroidHiddenAPI.jar这个包

2.android5.0之前SystemContext通过call ActivityManagerService的main方法就可以直接获取，但是5.0开始是通过createSystemContext方法生产，所以只能判断下版本，然后一个通过构造取获取，一个通过main返回结果获取