Android逆向 今日头条的广告SDK分析

今日头条的广告SDK激励视频广告下载、安装分析

 try {
        Method method = null;
        Class a = getClassLoader().loadClass("com.ss.android.socialbase.appdownloader.a");
        for (Method m : a.getDeclaredMethods()) {
            Log.e("gamea", ":" + m.getName() + ":" + m.getReturnType().getName());
            if (m.getReturnType().getName().equals("android.content.Intent")) {
                method = m;
            }
        }
        if (method != null) {
            DexposedBridge.hookMethod(method, new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    super.beforeHookedMethod(param);
                    Log.e("gamea", "getPackageName param:" + param.args[1]);


                }

                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    super.afterHookedMethod(param);
                    Log.e("gamea", "getPackageName param:" + param.getResult().toString());

                }
            });
        }

        Class f = FileProvider.class;
        Method getUriForFile = f.getDeclaredMethod("getUriForFile", Context.class, String.class, File.class);
        DexposedBridge.hookMethod(getUriForFile, new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                File o2 = (File) param.args[2];
                Object o1 = param.args[1];
                String oo2 = o2.getAbsolutePath();
//                    /storage/emulated/0/Android/data/com.iplay.assistant/files/Download/boxnewest.apk
                String a = oo2.substring(oo2.lastIndexOf("/", oo2.length()));
                fileNew = new File("/storage/emulated/0/Android/data/com.tool.mm.cool.o9/sandbox/0/com.iplay.assistant/files/Download/", a);

            }

            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);

            }
        });

        DexposedBridge.hookMethod(ContextWrapper.class.getDeclaredMethod("startActivity", Intent.class), new XC_MethodHook() {
            @SuppressLint("WrongConstant")
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);
                Object object = param.args[0];
                if (object instanceof Intent) {
                    String v4_2 = "application/vnd.android.package-archive";
                    Intent intent1 = new Intent("android.intent.action.VIEW");
                    if (Build.VERSION.SDK_INT >= 24) {
                        intent1.addFlags(1);
                    }
                    intent1.setDataAndType(Uri.fromFile(fileNew), v4_2);
                    param.args[0] = intent1;
                }
            }

            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);
            }
        });

        Class b = getClassLoader().loadClass("com.ss.android.socialbase.downloader.g.b");
        Method h = b.getDeclaredMethod("h");
        DexposedBridge.hookMethod(h, new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                super.beforeHookedMethod(param);

            }

            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                super.afterHookedMethod(param);                              
                param.setResult("/storage/emulated/0/Android/data/com.tool.mm.cool.o9/sandbox/0/com.iplay.assistant/files/Download");
    //                        Log.e("gamea", "h ret:" + param.getResult());
            }
        });
      } catch (Exception e) {
        e.printStackTrace();
      }