大佬们帮我看一下这段 xposed 代码有没有问题

   public class HookInit implements IXposedHookLoadPackage {

          @Override
          public void handleLoadPackage ( final XC_LoadPackage.LoadPackageParam lpparam ) throws Throwable {

                    XposedHelpers.findAndHookMethod ( "android.app.ContextImpl", lpparam.classLoader, "checkCallingOrSelfPermission", String.class, new XC_MethodReplacement ( ){

                                   @Override
                                   protected Object replaceHookedMethod ( XC_MethodHook.MethodHookParam p1 ) throws Throwable {
                                             int i=0;
                                             return i;
                                        }                                     
                              }                  
                    );

                    XposedHelpers.findAndHookMethod ( "android.app.Application", lpparam.classLoader, "attach", Context.class, new XC_MethodHook ( ){
                                   @Override
                                   protected void afterHookedMethod ( MethodHookParam param ) throws Throwable {
                                             Class <?>wmg=XposedHelpers.findClass ( "android.view.WindowManagerGlobal", lpparam.classLoader );
                                             final Object wm=XposedHelpers.callStaticMethod ( wmg, "getWindowManagerService" );
                                             Method setForcedDisplayDensityForUser=XposedHelpers.findMethodBestMatch ( wm.getClass ( ), "setForcedDisplayDensityForUser", int.class, int.class, int.class );
                                             setForcedDisplayDensityForUser.invoke ( wm, 160, Display.DEFAULT_DISPLAY, AndroidAppHelper.currentApplicationInfo ( ).uid );
                                        }
                              }
                    );
               }
     }

目的是想通过 WindowManagerGlobal 获取 WindowManagerService ，然后调用 setForcedDisplayDensityForUser 方法，因为这个方法会用 checkCallingOrSelfPermission 方法检查是否有权限，所以我修改了他的返回值为 0 。 setForcedDisplayDensityForUser 的源码：

 @Override
    public void setForcedDisplayDensityForUser(int displayId, int density, int userId) {
        if (mContext.checkCallingOrSelfPermission(
                android.Manifest.permission.WRITE_SECURE_SETTINGS) !=
                PackageManager.PERMISSION_GRANTED) {
            throw new SecurityException("Must hold permission " +
                    android.Manifest.permission.WRITE_SECURE_SETTINGS);

但这样修改后还是抛出异常"Must hold permission…" 大佬们有没有什么建议

ColoThor

103 天前

试试我的方法，在 initZygote 方法内添加代码
```language
AndroidActivityManagerHook.getInstance().start();
```

AndroidActivityManagerHook 类，把其中的 xxx.xxx.xxx.xxx,替换为实际的引用包名
```language
public class AndroidActivityManagerHook {
public static String TAG = AndroidActivityManagerHook.class.getSimpleName();

public static AndroidActivityManagerHook getInstance() {
return InstanceUtils.instance;
}

private AndroidActivityManagerHook() {

}

private static class InstanceUtils {
private static final AndroidActivityManagerHook instance = new AndroidActivityManagerHook();
}

public void start() {
hookActivityManager(null);
}

private void hookActivityManager(ClassLoader classLoader) {
try {
String activityManagerClassName = "android.app.ActivityManager";
Class activityManagerClass = XposedHelpers.findClassIfExists(activityManagerClassName, classLoader);
if (activityManagerClass != null) {
XposedBridge.hookAllMethods(activityManagerClass, "checkComponentPermission", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
try {
String permission = (String) param.args[0];
if (TextUtils.isEmpty(permission)) {
return;
}

if (!Manifest.permission.WRITE_SECURE_SETTINGS.equals(permission)) {
return;
}

int uid = (int) param.args[1];
if (uid == 0) {
return;
}

Context context = AndroidAppHelper.currentApplication().getApplicationContext();
if (context == null) {
return;
}

String packageName = context.getPackageManager().getNameForUid(uid);
if ("xxx.xxx.xxx.xxx".equals(packageName)) {
param.setResult(PackageManager.PERMISSION_GRANTED);
Log.w(TAG, "access " + permission + " to " + packageName);
}
} catch (Exception e) {
e.printStackTrace();
Log.e(TAG, param.method.getName() + " error\n" + Log.getStackTraceString(e));
}
}
});
} else {
Log.e(TAG, "class not find: " + activityManagerClassName);
}
} catch (Exception e) {
Log.e(TAG, "hookActivityManager error:\n" + Log.getStackTraceString(e));
}
}
}
```

最后别忘了添加作用域系统框架