本帖最后由 愈来记挂 于 2020-1-9 15:07 编辑
本文仅供学习使用,因为涉及到支付宝,不会写的非常详细.
有人说用PhotoShop也可以,当然这只是Xposed最简单的应用,其他的用途我也不好说了{:1_1:}
通过抓包得知账单接口为'com.alipay.consumeweb.annualBill2019.getAnnualBillData'
获取的json数据格式为
所以直接hook获取返回的数据修改一下就好了,主要就是一个json的解析
[Java] 纯文本查看 复制代码 object BillHook {
val amount get() = "${Random.nextInt(1, 999)},${Random.nextInt(100, 999)},${Random.nextInt(100, 999)},${Random.nextInt(10, 99)}"
fun hook() {
val h5PageClass = loader.loadClass("com.alipay.mobile.h5container.api.H5Page")
val jsonObjClass = loader.loadClass("com.alibaba.fastjson.JSONObject")
XposedHelpers.findAndHookMethod("com.alipay.mobile.nebulaappproxy.api.rpc.H5RpcUtil", loader, "rpcCall",
String::class.java, String::class.java, String::class.java,
Boolean::class.javaPrimitiveType, jsonObjClass, String::class.java, Boolean::class.javaPrimitiveType, h5PageClass,
Int::class.javaPrimitiveType, String::class.java, Boolean::class.javaPrimitiveType, Int::class.javaPrimitiveType, String::class.java,
object : XC_MethodHook() {
override fun afterHookedMethod(param: MethodHookParam) {
if (param.args[0] == "com.alipay.consumeweb.annualBill2019.getAnnualBillData") {
val response = param.result
val json = XposedHelpers.callMethod(response, "getResponse") as String
val obj = JSONObject(json)
obj.getJSONObject("data")
.getJSONObject("annualConsume")
.also {
it.getJSONObject("transferAccount").put("amount", amount)
it.getJSONObject("totalConsume")
.also { totalConsume ->
totalConsume.put("totalOut", "9999999999.99")
val categoryList = totalConsume.getJSONArray("categoryList")
val size = categoryList.length()
repeat(size) { index ->
val category = categoryList.getJSONObject(index)
category.put("amount", amount)
}
}
val otherAccount = it.getJSONArray("otherAccount")
repeat(otherAccount.length()) { index ->
val account = otherAccount.getJSONObject(index)
when (account.getString("type")) {
"loveDonation" -> {
account.put("count", "${Random.nextInt(99999, 99999999)}次")
}
"antForest" -> {
account.put("count", "${amount}t")
}
}
}
}
XposedHelpers.setObjectField(response, "b", obj.toString())
}
}
})
}
}
效果:
代码都放这里啦,有能力的自己去实现吧 |