利用Xposed Hook打印Java函数调用堆栈信息的几种方法

本文博客链接：http://blog.csdn.net/QQ1084283172/article/details/79378374

在进行Android逆向分析的时候，经常需要进行动态调试栈回溯，查看Java函数的调用流程，Android的smali动态调试又不是很方便，因此使用Android的Java Hook的方法，打印Java函数调用堆栈信息辅助静态分析。

package com.xposeddemo;

import java.util.Map;

import android.util.Log;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

public class Module implements IXposedHookLoadPackage {

	@Override
	public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
		// 判断是否是要Hook的包名
		if (lpparam.packageName.equals("com.lenovo.anyshare.gps")){
			XposedBridge.log("Loaded App:" + lpparam.packageName);

			// 查找要Hook的函数(需要打印堆栈调用的目标函数)
			XposedHelpers.findAndHookMethod(
					"com.lenovo.anyshare.frv", // 被Hook函数所在的类com.lenovo.anyshare.frv
					lpparam.classLoader,
					"a",     // 被Hook函数的名称a
					new XC_MethodHook(){
						@Override
						protected void beforeHookedMethod(MethodHookParam param)
								throws Throwable {
							// Hook函数之前执行的代码

							//传入参数1
							//XposedBridge.log("beforeHookedMethod userName:" + param.args[0]);
						}

						@Override
						protected void afterHookedMethod(MethodHookParam param)
								throws Throwable {
							// Hook函数之后执行的代码

							//函数返回值
							//XposedBridge.log("afterHookedMethod result:" + param.getResult());

							// 函数调用完成之后打印堆栈调用的信息
							// 方法一:
							Log.i("Dump Stack: ", "---------------start----------------");
							Throwable ex = new Throwable();
							StackTraceElement[] stackElements = ex.getStackTrace();
							if (stackElements != null) {
								for (int i = 0; i < stackElements.length; i++) {

									Log.i("Dump Stack"+i+": ", stackElements[i].getClassName()
											+"----"+stackElements[i].getFileName()
											+"----" + stackElements[i].getLineNumber()
											+"----" +stackElements[i].getMethodName());
								}
							}
							Log.i("Dump Stack: ", "---------------over----------------");

							// 方法二:
							new Exception().printStackTrace(); // 直接干脆

							// 方法三:
							Thread.dumpStack(); // 直接暴力

							// 方法四:
							 // 打印调用堆栈: http://blog.csdn.net/jk38687587/article/details/51752436
			                RuntimeException e = new RuntimeException("<Start dump Stack !>");
			                e.fillInStackTrace();
			                Log.i("<Dump Stack>:", "++++++++++++", e);

							// 方法五:
							// Thread类的getAllStackTraces（）方法获取虚拟机中所有线程的StackTraceElement对象，可以查看堆栈
							for (Map.Entry<Thread, StackTraceElement[]> stackTrace:Thread.getAllStackTraces().entrySet())
							{
								Thread thread = (Thread) stackTrace.getKey();
								StackTraceElement[] stack = (StackTraceElement[]) stackTrace.getValue();

								// 进行过滤
								if (thread.equals(Thread.currentThread())) {
									continue;
								}

								Log.i("[Dump Stack]","**********Thread name：" + thread.getName()+"**********");
								int index = 0;
								for (StackTraceElement stackTraceElement : stack) {

									Log.i("[Dump Stack]"+index+": ", stackTraceElement.getClassName()
											+"----"+stackTraceElement.getFileName()
											+"----" + stackTraceElement.getLineNumber()
											+"----" +stackTraceElement.getMethodName());
									}
									// 增加序列号
									index++;
								}
								Log.i("[Dump Stack]","********************* over **********************");
						}
					});

			//查找要Hook的函数
//			XposedHelpers.findAndHookMethod(
//					"com.lenovo.anyshare.frw", // 被Hook函数所在的类com.lenovo.anyshare.frv
//					lpparam.classLoader,
//					"b",     // 被Hook函数的名称b
//					int.class,
//					new XC_MethodHook(){
//						@Override
//						protected void beforeHookedMethod(MethodHookParam param)
//								throws Throwable {
//							// Hook函数之前执行的代码
//
//							//传入参数1
//							XposedBridge.log("beforeHookedMethod com.lenovo.anyshare.frw--b--StpSocket: " + param.args[0]);
//						}
//
//						@Override
//						protected void afterHookedMethod(MethodHookParam param)
//								throws Throwable {
//							// Hook函数之后执行的代码
//
//							//函数返回值
//							//XposedBridge.log("afterHookedMethod result:" + param.getResult());
//
//							XposedBridge.log("com.lenovo.anyshare.frw--b---StpSocket---Dump Stack: "+"---------------start----------------");
//							Throwable ex = new Throwable();
//							StackTraceElement[] stackElements = ex.getStackTrace();
//							if (stackElements != null) {
//								for (int i = 0; i < stackElements.length; i++) {
//
//									XposedBridge.log("Dump Stack---StpSocket"+i+": "+stackElements[i].getClassName()
//											+"----"+stackElements[i].getFileName()
//											+"----" + stackElements[i].getLineNumber()
//											+"----" +stackElements[i].getMethodName());
//								}
//
//								XposedBridge.log("com.lenovo.anyshare.frw--b---StpSocket---Dump Stack: "+"---------------over----------------");
//							}
//						}
//					});

//			XposedHelpers.findAndHookMethod(
//					"com.lenovo.anyshare.frw", // 被Hook函数所在的类com.lenovo.anyshare.frv
//					lpparam.classLoader,
//					"a",     // 被Hook函数的名称a
//					int.class,
//					new XC_MethodHook(){
//						@Override
//						protected void beforeHookedMethod(MethodHookParam param)
//								throws Throwable {
//							// Hook函数之前执行的代码
//
//							//传入参数1
//							XposedBridge.log("beforeHookedMethod com.lenovo.anyshare.frw--a--ServerSocket:" + param.args[0]);
//						}
//
//						@Override
//						protected void afterHookedMethod(MethodHookParam param)
//								throws Throwable {
//							// Hook函数之后执行的代码
//
//							//函数返回值
//							//XposedBridge.log("afterHookedMethod result:" + param.getResult());
//
//							XposedBridge.log("com.lenovo.anyshare.frw--a--ServerSocket--Dump Stack: "+"---------------start----------------");
//							Throwable ex = new Throwable();
//							StackTraceElement[] stackElements = ex.getStackTrace();
//							if (stackElements != null) {
//								for (int i = 0; i < stackElements.length; i++) {
//
//									XposedBridge.log("Dump Stack--ServerSocket"+i+": "+stackElements[i].getClassName()
//											+"----"+stackElements[i].getFileName()
//											+"----" + stackElements[i].getLineNumber()
//											+"----" +stackElements[i].getMethodName());
//								}
//
//								XposedBridge.log("com.lenovo.anyshare.frw--a--ServerSocket--Dump Stack: "+"---------------over----------------");
//							}
//						}
//					});
		}

	}
}

/**
 * Look up a method and place a hook on it. The last argument must be the callback for the hook.
 * @see #findMethodExact(Class, String, Object...)
 */
/*针对非静态方法的Hook
public static XC_MethodHook.Unhook findAndHookMethod(Class<?> clazz, String methodName, Object... parameterTypesAndCallback) {
	if (parameterTypesAndCallback.length == 0 || !(parameterTypesAndCallback[parameterTypesAndCallback.length-1] instanceof XC_MethodHook))
		throw new IllegalArgumentException("no callback defined");

	XC_MethodHook callback = (XC_MethodHook) parameterTypesAndCallback[parameterTypesAndCallback.length-1];
	Method m = findMethodExact(clazz, methodName, getParameterClasses(clazz.getClassLoader(), parameterTypesAndCallback));

	return XposedBridge.hookMethod(m, callback);
}*/

/** @see #findAndHookMethod(Class, String, Object...) */
/*针对静态方法的Hook
 public static XC_MethodHook.Unhook findAndHookMethod(String className, ClassLoader classLoader, String methodName, Object... parameterTypesAndCallback) {
	return findAndHookMethod(findClass(className, classLoader), methodName, parameterTypesAndCallback);
}*/