基於Xposed hook 實時監測微信消息

本文以微信版本6.7.3爲例進行分析有hook， 大部分作微信機器人的話，首先要實時抓取微信的消息，在這裏展現三種方式對微信的消息進行hook：
1.基於UI層拉取加載進行監聽
2.基於微信dao層調用的保存進行監聽
3.基於數據庫的插入保存進行監聽 這三層各有各的特色請自行選用

package cn.robot;

import android.content.ContentValues;
import android.database.Cursor;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
import org.xmlpull.v1.XmlPullParserException;

import java.io.IOException;

import static de.robv.android.xposed.XposedBridge.log;

/**
 * author: zhao .
 * date:  2019/4/19
 */
public class WechatTest {
    /**
     * 註冊接收消息的監聽，處理UI觸發流程
     */
    public static void uiMsgListener(XC_LoadPackage.LoadPackageParam lpparam) {
        log("uiMsgListener 開始");
        Object[] arrayOfObject = new Object[2];
        arrayOfObject[0] = Cursor.class;
        arrayOfObject[1] = new XC_MethodHook() {
            protected void afterHookedMethod(MethodHookParam methodHookParam) throws XmlPullParserException, IOException {
                //0表明別人發的消息，1表明是本身發的消息
                int field_isSend = ((Integer) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_isSend")).intValue();
                //消息類型：1是文本...參考wechat_manager裏的消息類型定義
                int field_type = ((Integer) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_type")).intValue();
                //微信服務器端的消息id
                Object field_msgSvrId =  XposedHelpers.getObjectField(methodHookParam.thisObject, "field_msgSvrId");
                //消息內容
                String field_content = (String) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_content");
                String field_talker = (String) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_talker");
                //消息建立時間
                long field_createTime = ((Long) XposedHelpers.getObjectField(methodHookParam.thisObject, "field_createTime")).longValue();
                log("uiMsgListener field_isSend:" + field_isSend + "--field_type:" + field_type + "--field_msgSvrId--" + field_msgSvrId + "--field_talker--" + field_talker + "--field_content--" + field_content);

            }
        };
        XposedHelpers.findAndHookMethod("com.tencent.mm.storage.bi", lpparam.classLoader, "d", arrayOfObject);
        log("uiMsgListener 結束");
    }

    /**
     * 插入消息監聽 處理微信 dao層
     */
    public static void insertMsgDAOListener(XC_LoadPackage.LoadPackageParam lpparam) {
        log("insertMsgDAOListener 開始");
        Class<?> au = XposedHelpers.findClass("com.tencent.mm.storage.bi", lpparam.classLoader);
        Object[] arrayOfObject = new Object[3];
        arrayOfObject[0] = au;
        arrayOfObject[1] = boolean.class;
        arrayOfObject[2] = new XC_MethodHook() {
            protected void afterHookedMethod(MethodHookParam paramAnonymousMethodHookParam) throws XmlPullParserException, IOException {
                Object au = paramAnonymousMethodHookParam.args[0];
                if (au == null) {
                    return;
                }
                int field_isSend = ((Integer) XposedHelpers.getObjectField(au, "field_isSend")).intValue();
                int field_type = ((Integer) XposedHelpers.getObjectField(au, "field_type")).intValue();
                Object field_msgSvrId = XposedHelpers.getObjectField(au, "field_msgSvrId");
                String field_content = (String) XposedHelpers.getObjectField(au, "field_content");
                String field_talker = (String) XposedHelpers.getObjectField(au, "field_talker");
                log("insertMsgDAOListener field_isSend:" + field_isSend + "--field_type:" + field_type + "--field_msgSvrId--" + field_msgSvrId + "--field_talker--" + field_talker + "--field_content--" + field_content);

            }
        };
        XposedHelpers.findAndHookMethod(XposedHelpers.findClass("com.tencent.mm.storage.bj", lpparam.classLoader), "b", arrayOfObject);
        log("insertMsgDAOListener 結束");
    }

    /**
     * 插入消息監聽
     */
    public static void insertMsgDBListener(XC_LoadPackage.LoadPackageParam lpparam) {
        log("insertMsgDBListener 開始");
        Object[] arrayOfObject = new Object[4];
        arrayOfObject[0] = String.class;
        arrayOfObject[1] = String.class;
        arrayOfObject[2] = ContentValues.class;
        arrayOfObject[3] = new XC_MethodHook() {
            protected void afterHookedMethod(MethodHookParam paramAnonymousMethodHookParam) throws XmlPullParserException, IOException {
                log("insertMsgDBListener 0"+paramAnonymousMethodHookParam.args[0]);
                log("insertMsgDBListener 1"+paramAnonymousMethodHookParam.args[1]);
                log("insertMsgDBListener 2"+paramAnonymousMethodHookParam.args[2]);

            }
        };
        XposedHelpers.findAndHookMethod(XposedHelpers.findClass("com.tencent.wcdb.database.SQLiteDatabase", lpparam.classLoader), "insert", arrayOfObject);
        log("insertMsgDBListener 結束");
    }
}