前言

hook 带壳的app，都要先先想法找到目标hook点的ClassLoader。

发现

然后发现一篇文章
不是文章内容，而是文章下面第一条评论。
肉丝姐称之为 万能代码
关键代码：

if (loadPackageParam.packageName.equals("com.cz.babySister")) {
            XposedBridge.log(" has Hooked!");
            XposedBridge.log("inner  => " + loadPackageParam.processName);
            Class ActivityThread = XposedHelpers.findClass("android.app.ActivityThread",loadPackageParam.classLoader);
            XposedBridge.hookAllMethods(ActivityThread, "performLaunchActivity", new XC_MethodHook() {
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    super.afterHookedMethod(param);
                    Object mInitialApplication = (Application) XposedHelpers.getObjectField(param.thisObject,"mInitialApplication");
                    ClassLoader finalCL = (ClassLoader) XposedHelpers.callMethod(mInitialApplication,"getClassLoader");
                    XposedBridge.log("found classload is => "+finalCL.toString());
                    Class BabyMain = (Class)XposedHelpers.callMethod(finalCL,"findClass","com.cz.babySister.activity.MainActivity");
                    XposedBridge.log("found final class is => "+BabyMain.getName().toString());
                    fart(finalCL);
                }
            });
        }

测试

阻碍

示例代码的包名百度一下就能看到是什么软件，这个软件我打算测试一下的时候，总是注册不上。。。。
后来打算自己开发一个简单的app。但是通过360加固再签名之后。软件闪退。暂不清楚原因。

换app。

这里使用的是最新版的封面新闻。

脱壳

使用葫芦娃大佬的frida脱壳工具。
github地址
使用过程中脱到一半，app就被卡死掉了。没脱全。但是没啥事。关键代码找到了。

xposed hook

package com.example.baohuo;

import android.app.Application;
import android.content.Context;
import android.util.Log;

//import com.example.gantb.hook_method.Hook_android_app_Application;

import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;


public class HookEntry implements IXposedHookLoadPackage {
    private static final String TAG = "gantb";
    public static XC_LoadPackage.LoadPackageParam lpparam = null;
    public static ClassLoader classLoader1 = null;

    @Override
    public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {

        HookEntry.lpparam = lpparam;

        if (lpparam.packageName.equals("cn.thecover.www.covermedia")) {
            XposedBridge.log(" has Hooked!");
            XposedBridge.log("inner  => " + lpparam.processName);
            Class ActivityThread = XposedHelpers.findClass("android.app.ActivityThread",lpparam.classLoader);
            XposedBridge.hookAllMethods(ActivityThread, "performLaunchActivity", new XC_MethodHook() {
                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    super.afterHookedMethod(param);
                    Object mInitialApplication = (Application) XposedHelpers.getObjectField(param.thisObject,"mInitialApplication");
                    ClassLoader finalCL = (ClassLoader) XposedHelpers.callMethod(mInitialApplication,"getClassLoader");
                    XposedBridge.log("found classload is => "+finalCL.toString());
                    Class BabyMain = (Class)XposedHelpers.callMethod(finalCL,"findClass","cn.thecover.lib.common.manager.SignManager");
                    XposedBridge.log("found final class is => "+BabyMain.getName().toString());
                    fart(finalCL);
                }
            });
        }


    }
    private void fart(ClassLoader classLoader) {


        XposedHelpers.findAndHookMethod("cn.thecover.lib.common.manager.SignManager", classLoader, "getSign", String.class, String.class,String.class,new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                XposedBridge.log(" 》》》》》》》》》》》》》》》》。《《《《《《《《《《《《《《《《《");
                Log.e(TAG, "hook anti_token");
                super.afterHookedMethod(param);
                String ss = (String) param.getResult();
                XposedBridge.log(" has getResult!"+ss);
            }
        });

    }

}

结果

能打印出来。说明成功了。

结尾

至于说，是不是万能的。我还不太理解。但是360的壳是没问题的。