根據這篇文章https://bbs.pediy.com/thread-246767.htm的思路

以廣州圈app為案例，分析其的程式碼發現，採用的是外掛化載入方式，下載的apk包只是一個載體，真正的apk隱藏在assets裡面，不過這樣感覺還是挺好的，可以減小apk包的大小，至於這種方式有沒有不好的我就不知道了，因為我沒有試過外掛化的。

現在知道了真實包在那裡，下面就開始進行hook其的加密函式（nativeGenToken）了

如果以這種方式hook的話，會報提示找不到類的錯誤的

                   Class aClass = XposedHelpers.findClass("cn.mama.framework.jnibridge.JCC", lpparam.classLoader);
                    if (aClass != null) {
                        XposedBridge.log("找到了指定路徑>>>>>>>>>>>>>>>");
                    } else {
                        XposedBridge.log("找不到指定路徑>>>>>>>>>>>>>>>");
                    }
                    XposedHelpers.findAndHookMethod(aClass, "nativeGenToken", Map.class, String.class, int.class, new XC_MethodHook() {
                        @Override
                        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

                            XposedBridge.log("nativeGenToken已經進入>>>>>>>>>>>>>>>");
                            for (Object o : param.args) {
                                XposedBridge.log(o.toString());
                            }
                            super.beforeHookedMethod(param);
                        }

                        @Override
                        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                            XposedBridge.log("nativeGenToken result:" + param.getResult());
                            super.afterHookedMethod(param);
                        }
                    });
 

導致原因是拿到的classloader是還沒有載入過真實包的classloader

程式碼裡從attachBaseContext方法裡面才開始載入真實包，

看程式碼知道，attachBaseContext是在attach裡面才執行，所以我們在attach執行之後的Context裡面拿到的classloader就有載入過子包發

具體程式碼實現：

public class XposedPingan implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {

        if (lpparam.packageName.equals("cn.mama.cityquan")) {
            XposedBridge.log("已經進入指定包>>>>>>>>>>>>>>>");
            final Class clazz1 = XposedHelpers.findClass("android.app.Application", lpparam.classLoader);
            XposedHelpers.findAndHookMethod(clazz1, "attach", Context.class, new XC_MethodHook() {

                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    super.afterHookedMethod(param);
                    Context context = (Context) param.args[0];
                    ClassLoader classLoader = context.getClassLoader();

                    Class aClass = XposedHelpers.findClass("cn.mama.framework.jnibridge.JCC", classLoader);
                    if (aClass != null) {
                        XposedBridge.log("找到了指定路徑>>>>>>>>>>>>>>>");
                    } else {
                        XposedBridge.log("找不到指定路徑>>>>>>>>>>>>>>>");
                    }
                    XposedHelpers.findAndHookMethod(aClass, "genToken", Map.class, String.class, int.class, new XC_MethodHook() {
                        @Override
                        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

                            XposedBridge.log("genToken已經進入>>>>>>>>>>>>>>>");
                            for (Object o : param.args) {
                                XposedBridge.log(o.toString());
                            }
                            super.beforeHookedMethod(param);
                        }

                        @Override
                        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                            XposedBridge.log("genToken result:" + param.getResult());
                            super.afterHookedMethod(param);
                        }
                    });

                    XposedHelpers.findAndHookMethod(aClass, "nativeGenToken", Map.class, String.class, int.class, new XC_MethodHook() {
                        @Override
                        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

                            XposedBridge.log("nativeGenToken已經進入>>>>>>>>>>>>>>>");
                            for (Object o : param.args) {
                                XposedBridge.log(o.toString());
                            }
                            super.beforeHookedMethod(param);
                        }

                        @Override
                        protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                            XposedBridge.log("nativeGenToken result:" + param.getResult());
                            super.afterHookedMethod(param);
                        }
                    });
                }
            });
        }
    }
}
 

注意：int型別的一點要用int.class，不能用 Integer.class