tiann / freereflection Goto Github PK

A library that lets you use reflection without any restriction above Android P

License: MIT License

Java 45.62% CMake 6.50% C++ 47.89%

freereflection's Introduction

FreeReflection

FreeReflection is a library that lets you use reflection without any restriction above Android P (includes Q and R).

Usage

Add it in your root build.gradle at the end of repositories(jitpack):

allprojects {
		repositories {
			...
			maven { url 'https://jitpack.io' }
		}
	}

Add dependency to your project(jcenter):

implementation 'com.github.tiann:FreeReflection:3.1.0'

Add one line to your Application.attachBaseContext :

@Override
protected void attachBaseContext(Context base) {
    super.attachBaseContext(base);
    Reflection.unseal(base);
}

Then you can use the reflection API normally, all the restrictions are gone. Enjoy yourself :)

Under the hood

Donations

If you like this project, buy me a cup of coffee! :)

BitCoin: 39Wst8oL74pRP2vKPkPihH6RFQF4hWoBqU

License

MIT License

freereflection's People

Contributors

Stargazers

Watchers

Forkers

crackercat goodong nexthacker hymking jimmyjones97 rockystevejobs shanyezhihe dstmath lly201 kxl2005 shuixi2013 trendingtechnology hello-xbugs gyyfifafans simpleton litangyu felixzhang00 zzqhost chykidd nbwzlyd tsdl2018 erainzhong xumufei captswing liminhu yanbinbin daryl3260 woaidousha leoonzhang sheepyang1993 guolei1130 edisonchang33 andsource fhooker wangzhanxian zhang-pc rgocal xdcs100 c3ph3us fecloud ckrgithub huqiuser raslin777 cuihaoliang sudami glen9527 waytoinc chago aidotank cby0310 kindyrain printfgoto lycold joegana cavin2012 kw13630 lwannn jiguoling syshare linqingwei piowind tao2java markjian askqi nghiadhd popfisher wubainian xiabodan hcygithub nyc1002 makulu1987 supercrawler json988 bunnyblueair jockyuan kcherish rexchun zeroplucky ishidai zyhworker sevenmine 1004 jiangtao89 mzpbvsig sanshao27 chanjlee wsy1983wsy yorklb lwugang easytome hfutxqd tjy1985001 ithaibo kiddingboys nansongcheng xuangong andelee123 yk007 chenjianping99 jackyglony

freereflection's Issues

反射vivo系统方法异常

vivo x23，funtouchOS10，android 9

Class<?> shortcutList = Class.forName("com.bbk.launcher2.installshortcut.PurviewActivity");
异常报类找不到，
我用adb查看activity，是有这个类的
adb shell "dumpsys window | grep mCurrentFocus"
mCurrentFocus=Window{b3629ee u0 com.bbk.launcher2/com.bbk.launcher2.installshortcut.PurviewActivity}

Wallet

3ByHK9XrWHwPhcigA8gkRMuH2AXQYoKJ3c

大佬，能获取 EthernetManager ？

还能说啥？大佬牛逼

弱弱问一句，用了这个库，会影响play上架吗？

黑名单或深灰名单方法不生效

设备：Pixel DP3

源码：https://android.googlesource.com/platform/frameworks/base/+/android-p-preview-3/core/java/android/content/res/AssetManager.java#305

代码片段：

try {
    Method ensureStringBlocks = AssetManager.class.getDeclaredMethod("ensureStringBlocks");
    ensureStringBlocks.setAccessible(true);
    ensureStringBlocks.invoke(getAssets());
} catch (NoSuchMethodException e) {
    e.printStackTrace();
} catch (IllegalAccessException e) {
    e.printStackTrace();
} catch (InvocationTargetException e) {
    e.printStackTrace();
}

异常：

java.lang.NoSuchMethodException: ensureStringBlocks []

请问能否调用com.android.server 下面的class？

找不到class
有没有方法可以调用呢？
大佬救命

targetSdkVersion 30 无法通过反射获取到绕过系统库

编译报错可以在gradle下面添加这个

splits {
    abi {
        reset()
        include "armeabi-v7a"
    }
}

查了下AOSP最新的代码，漏洞应该还没有修复，理论上依然支持Android 12

通过将classloader设置为null来提高dex中api执行的domain级别，真是机智，佩服！
依然支持Android S，建议作者改下README!

对于 free_reflection:2.0.0 来说，Native 方法 unsealNative() 是否是多余的？

http://weishu.me/2019/03/16/another-free-reflection-above-android-p/
在你的博客里提到了，新的方法是不需要进行内存搜索的。但目前源码里却保留着相应的 JNI代码。

unsealNative调用问题

private static native int unsealNative(int targetSdkVersion);
这个native方法我没看到Reflection类中有哪里调用，请教一下是怎么触发走到main.cpp的该native方法的？

Not work on MIUI Android 11 with target 30

Hi, recently, after upgrading my app’s targetSdkVersion to 30, this library becomes invalid for MIUI on Android 11. At least two people verified this problem.
If the library can be updated to solve this problem will be very appreciated. Thanks!

Android 11 will prevent meta reflection

Apps targeting Android 11 can no longer use an extra layer of reflection to access non-SDK interfaces that are restricted.

See https://developer.android.com/preview/test-changes#prevent_meta_reflection_blacklist_access.

测试在反射调用 dalvik.system.DexPathList失败

Class dexPathListClass = Class.forName("dalvik.system.DexPathList"); Constructor con = dexPathListClass.getConstructor(ClassLoader.class, String.class, String.class, File.class); Log.i("looog", "name:" + con.getName()); Object dexPaths = con.newInstance(context.getClassLoader(), path, path, dir_path);
在newInstace时抛异常

日志如下
01-22 23:49:59.241 10339 10339 D OpenGLRenderer: Skia GL Pipeline 01-22 23:49:59.264 10339 10339 I FreeReflect: runtime ptr: 0xf072d400, vmExtPtr: 0xf071d3e0 01-22 23:49:59.264 10339 10339 I FreeReflect: found offset: 360 01-22 23:49:59.264 10339 10339 I FreeReflect: offsetOfVmExt: 360 01-22 23:49:59.264 10339 10339 I FreeReflect: found offset: 796 01-22 23:49:59.264 10339 10339 I FreeReflect: target: 796 01-22 23:49:59.264 10339 10339 I FreeReflect: is_java_debuggable: 1, is_native_debuggable: 0, safe_mode: 0 01-22 23:49:59.264 10339 10339 I FreeReflect: hidden api policy before : 2 01-22 23:49:59.264 10339 10339 I FreeReflect: fingerprint: google/sailfish/sailfish:9/PPR1.180610.009/4898911:user/release-keys 01-22 23:49:59.264 10339 10339 I FreeReflect: hidden api policy after: 0 01-22 23:49:59.266 10339 10339 I looog : dexPath:/data/user/0/com.example.sdktesthost/app_dex/plug_dex.jar 01-22 23:49:59.267 10339 10361 I looog : name:dalvik.system.DexPathList 01-22 23:49:59.268 10339 10361 W System.err: java.lang.IllegalAccessException: java.lang.Class<dalvik.system.DexPathList> is not accessible from java.lang.Class<com.example.sdktesthost.Reflect> 01-22 23:49:59.268 10339 10361 W System.err: at java.lang.reflect.Constructor.newInstance0(Native Method) 01-22 23:49:59.269 10339 10361 W System.err: at java.lang.reflect.Constructor.newInstance(Constructor.java:343) 01-22 23:49:59.269 10339 10361 W System.err: at com.example.sdktesthost.Reflect.run(Reflect.java:31)

这玩意到底咋用？logcat提示：不能访问方法，是我调用方法不对吗？

logcat的信息：

SurfaceFlinger: Permission Denial: can't access SurfaceFlinger pid=3505, uid=10283

    public void startPower(View view) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException, ClassNotFoundException {
        // Do something in response to button

        //-------
        Log.d(TAG, "start-------------");

        // get hide function
        Class<?> surfaceClass = (Class<?>) CLASS.forName("android.view.SurfaceControl");
        getBuiltInDisplayMethod = surfaceClass.getMethod("getBuiltInDisplay", int.class);
        // run function
        IBinder displayToken = (IBinder) getBuiltInDisplayMethod.invoke(null, 0);

        // get hide function
        setDisplayPowerModeMethod = surfaceClass.getMethod("setDisplayPowerMode", IBinder.class, int.class);
        setDisplayPowerModeMethod.invoke(null, displayToken, 0);

        //结束
        toast("ok");
        Log.d(TAG, "end-------------");
    }

    @Override
    protected void attachBaseContext(Context base) {
        super.attachBaseContext(base);
        Reflection.unseal(base);
        Log.d(TAG, "attachBaseContext-----------------------------------------------------------------------------------------------------------------------------------------------");

    }

上面的代码我是直接放在MainActivity.java文件里。在手机上执行的时候不生效。

我会一点Java代码，但是不懂Android。
大佬是我调用的方法不对吗？还是我这个函数本来就不能调用。
可以肯定的是，我这个函数可以用app_process方式运行成功。

move dex code to a dedicated .dex file

To directly put an encoded dex code string in code may violate Play's malicious behavior policy.

I would suggest that you don't encode the dex code, move the decoded dex bytes to a .dex file, and put it under the asset directory.

Here attached image shows you how Facebook audience network SDK does.
It's a more safe approach for embedding the dex code in an aar file without violating Play's policy.

不支持64位

ndk {
       abiFilters 'arm64-v8a'
}

In Android 13 it is not working

reflect bootstrap failed:
java.lang.NullPointerException: Attempt to invoke virtual method 'void android.app.Application.onCreate()' on a null object reference

老哥你的域名挂了，通知该续费了。

http://weishu.me/2018/06/07/free-reflection-above-android-p/

Reflection.unseal(base);

Reflection.unseal(base); Can it be run on a sub thread？ths

看了帖子之后，又看了源码，发现源码里面没有了

https://android.googlesource.com/platform/art/+/master/runtime/hidden_api.cc

Can't reflection SSLParametersImpl.class on Android P

        SSLSocketFactory defaultSSLSocketFactory  HttpsURLConnection.getDefaultSSLSocketFactory();
        try {
            parameters = (SSLParametersImpl) ReflectionUtil.getFieldFromObject(
                    ReflectionUtil.getFieldFromClass(defaultSSLSocketFactory.getClass(),
                            SSLParametersImpl.class), defaultSSLSocketFactory);
        } catch (Exception e) {
            e.printStackTrace();
        }

That code will throw

java.lang.IllegalAccessError: Illegal class access

请问DEX是使用自己本地的BootstrapClass进行Base64吗？LIB集成到项目中测试出现CLASSLOADER为NULL

9.0还能使用反射吗

没有9.0的真机感受不到，听说9.0手机反射不可以了

How to disable the meta-reflection for a few functions ?

Is there a way to exempt a few methods, etc from being meta reflected after we use "Unseal"? if so, where do we add the exemptions ?

在安卓12 报 W/BootstrapClass: reflect bootstrap failed，对使用有影响吗

java.lang.reflect.InvocationTargetException
at java.lang.reflect.Method.invoke(Native Method)
at me.weishu.reflection.BootstrapClass.(BootstrapClass.java:29)
at me.weishu.reflection.BootstrapClass.exemptAll(BootstrapClass.java:72)
at me.weishu.reflection.Reflection.unseal(Reflection.java:35)
at com.jhkj.neabot.app.MainApplication.initApp(MainApplication.java:72)
at com.jhkj.neabot.app.MainApplication.onCreate(MainApplication.java:65)
at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1211)
at android.app.ActivityThread.handleBindApplication(ActivityThread.java:6728)
at android.app.ActivityThread.access$1500(ActivityThread.java:247)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2057)
at android.os.Handler.dispatchMessage(Handler.java:106)
at android.os.Looper.loopOnce(Looper.java:201)
at android.os.Looper.loop(Looper.java:288)
at android.app.ActivityThread.main(ActivityThread.java:7842)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1003)
Caused by: java.lang.NoSuchMethodException: dalvik.system.VMRuntime.setHiddenApiExemptions [class [Ljava.lang.String;]
at java.lang.Class.getMethod(Class.java:2103)
at java.lang.Class.getDeclaredMethod(Class.java:2081)

java.lang.nosuchmethodexception: sethiddenapiexemptions

java.lang.reflect.InvocationTargetException

E/Reflection: reflect bootstrap failed:
java.lang.reflect.InvocationTargetException
at java.lang.reflect.Method.invoke(Native Method)
at java.lang.reflect.Method.invoke(Method.java:372)
at me.weishu.reflection.Reflection.(Reflection.java:32)
at com.tm.camera.App.attachBaseContext(App.java:43)
at android.app.Application.attach(Application.java:181)
at android.app.Instrumentation.newApplication(Instrumentation.java:996)
at android.app.Instrumentation.newApplication(Instrumentation.java:980)
at android.app.LoadedApk.makeApplication(LoadedApk.java:558)
at android.app.ActivityThread.handleBindApplication(ActivityThread.java:4526)
at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative(Native Method)
at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:360)
at android.app.ActivityThread.handleBindApplication()
at android.app.ActivityThread.access$1500(ActivityThread.java:151)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1364)
at android.os.Handler.dispatchMessage(Handler.java:102)
at android.os.Looper.loop(Looper.java:135)
at android.app.ActivityThread.main(ActivityThread.java:5254)
at java.lang.reflect.Method.invoke(Native Method)
at java.lang.reflect.Method.invoke(Method.java:372)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)
at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:107)
Caused by: java.lang.NoSuchMethodException: setHiddenApiExemptions [class [Ljava.lang.String;]
at java.lang.Class.getMethod(Class.java:664)
at java.lang.Class.getDeclaredMethod(Class.java:626)
at java.lang.reflect.Method.invoke(Native Method)
at java.lang.reflect.Method.invoke(Method.java:372)
at me.weishu.reflection.Reflection.(Reflection.java:32)
at com.tm.camera.App.attachBaseContext(App.java:43)

Cash app

ImmersionBar.with(this).init() 会导致内存泄漏

Please considering update package to the Maven Central

JCenter have already became a read-only repository on March 31st, 2021. Please considering update package to the Maven Central. For more info please visit: https://developer.android.com/studio/build/jcenter-migration
When using mavenCentral() I got this error:

Failed to resolve: me.weishu:free_reflection:3.0.1

Consider publishing the lib to jitpack

...so that builds could be verified (useful for apps on F-Droid).

Jitpack is pretty straight forward.

Docs: https://jitpack.io/docs/BUILDING

Ex (custom builds): https://github.com/celzero/firestack/blob/e62f1dd5/jitpack.yml

targetSdkVersion 30 无法通过反射获取到绕过系统库

使用了之后还是不行

基于P的模拟器来测试的，使用了框架之后Log依然会输出警告
Accessing hidden field Landroid/content/pm/PackageParser$Package;->services:Ljava/util/ArrayList; (light greylist, reflection)

Not working android S (13)

This isn't working for android 13.

android11 support

http://aospxref.com/android-11.0.0_r21/xref/art/test/674-hiddenapi/hiddenapi.cc?r=&mo=3316&fi=88#88

extern "C" JNIEXPORT void JNICALL Java_Main_setWhitelistAll(JNIEnv*, jclass, jboolean value) {
    std::vector<std::string> exemptions;
    if (value != JNI_FALSE) {
      exemptions.push_back("L");
    }
    Runtime::Current()->SetHiddenApiExemptions(exemptions);
  }

Kevin m lyons jr

I got us both $30 from Varo.* https://varomoney.com/r/?r=Kevin1624 Just open a Varo Bank Account using my link below, spend $20 on your new debit card, and we'll both get paid. 🙌 💰

大佬能讲解一下用dexFile的方式绕过限制的原理吗?

看过大佬的两篇文章，理解了元反射和豁免api的方式。但为啥可以用释放一个dexFile的方式绕过限制？大佬有文章讲解一下吗？

Android Q cannot get the IMEI number.

I use the library provided by you. Why can't AndroidQ get the IMEI number?

看了帖子之后，又看了源码，发现源码里面没有了

https://android.googlesource.com/platform/art/+/master/runtime/hidden_api.cc

按照教程使用了，但是还是没生效。你在博客中提到可以拷类以provided方式引用，请问具体怎么操作?

如果我只编译armeabi-v7a的so版本是否可以对只打armeabi-v7a的app在手机cpu是arm64-v8a

如果我只编译armeabi-v7a的so版本，是否可以对只打armeabi-v7a的app在手机cpu是arm64-v8a的手机上面使用?

Android 12以上反射时native需要检查调用堆栈，native层有更新，可以看下

在Android Q preview 4上找不到android.view.DisplayListCanvas.drawGLFunctor2 方法

在Android Q preview 4上找不到android.view.DisplayListCanvas.drawGLFunctor2 方法。查看官方的源码地址 https://android.googlesource.com/platform/frameworks/base/+/refs/tags/android-q-preview-4/core/java/android/view/DisplayListCanvas.java 是可以看到这个类的，能否帮忙看看是什么原因？

where is the source code of Reflection.DEX

The Reflection.DEX is a base64 encoded dex byte string.
Would you show us the original Java source code of this dex code and how to compile it?

尝试了小米12失败了

报错打印
2022-07-15 17:31:39.016 8175-8175/? W/BootstrapClass: reflect bootstrap failed:
java.lang.reflect.InvocationTargetException
at java.lang.reflect.Method.invoke(Native Method)
at me.weishu.reflection.BootstrapClass.(BootstrapClass.java:29)
at me.weishu.reflection.BootstrapClass.exemptAll(Unknown Source:0)
at me.weishu.reflection.Reflection.unseal(Reflection.java:35)
at org.cocos2dx.lua.AppActivity.attachBaseContext(AppActivity.java:212)
at android.app.Activity.attach(Activity.java:8115)
at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3702)
at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3929)
at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:103)
at android.app.servertransaction.TransactionExecutor.executeCallbacks(TransactionExecutor.java:135)
at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:95)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2282)
at android.os.Handler.dispatchMessage(Handler.java:106)
at android.os.Looper.loopOnce(Looper.java:210)
at android.os.Looper.loop(Looper.java:299)
at android.app.ActivityThread.main(ActivityThread.java:8250)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:556)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1045)
Caused by: java.lang.NoSuchMethodException: dalvik.system.VMRuntime.setHiddenApiExemptions [class [Ljava.lang.String;]
at java.lang.Class.getMethod(Class.java:2103)
at java.lang.Class.getDeclaredMethod(Class.java:2081)
at java.lang.reflect.Method.invoke(Native Method)
at me.weishu.reflection.BootstrapClass.(BootstrapClass.java:29)
at me.weishu.reflection.BootstrapClass.exemptAll(Unknown Source:0)
at me.weishu.reflection.Reflection.unseal(Reflection.java:35)
at org.cocos2dx.lua.AppActivity.attachBaseContext(AppActivity.java:212)
at android.app.Activity.attach(Activity.java:8115)
at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3702)
at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3929)
at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:103)
at android.app.servertransaction.TransactionExecutor.executeCallbacks(TransactionExecutor.java:135)
at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:95)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2282)
at android.os.Handler.dispatchMessage(Handler.java:106)
at android.os.Looper.loopOnce(Looper.java:210)
at android.os.Looper.loop(Looper.java:299)
at android.app.ActivityThread.main(ActivityThread.java:8250)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:556)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1045)

SDK等级
# Android SDK version that will be used as the compile project
PROP_COMPILE_SDK_VERSION=31

  # Android SDK version that will be used as the earliest version of android this application can run on
  PROP_MIN_SDK_VERSION=21
  
  # Android SDK version that will be used as the latest version of android this application has been tested on
  PROP_TARGET_SDK_VERSION=30