22
33import android .app .Application ;
44import android .content .ComponentName ;
5+ import android .content .ContentResolver ;
56import android .content .Context ;
7+ import android .content .Intent ;
8+ import android .content .pm .PackageInfo ;
69import android .content .pm .PackageManager ;
10+ import android .net .Uri ;
11+ import android .os .Bundle ;
712import android .system .Os ;
813import android .system .OsConstants ;
914import android .util .Base64 ;
1015import android .widget .Toast ;
1116
1217import java .nio .charset .StandardCharsets ;
1318import java .util .Enumeration ;
19+ import java .util .List ;
1420
1521import dalvik .system .DexFile ;
1622import de .robv .android .xposed .XC_MethodHook ;
@@ -34,36 +40,82 @@ static boolean inBuiltInBlackList(String pkgName) {
3440 return false ;
3541 }
3642
43+ // /**
44+ // * Check framework implementation's compatibility and security
45+ // * To avoid compatibility or magic issues, must
46+ // * call this method after got any MethodHookParam
47+ // *
48+ // * @param methodHookParam Xposed hook param
49+ // * @param callingPid Process Pid
50+ // * @return true
51+ // */
52+ // public static boolean getParamAvailability(final XC_MethodHook.MethodHookParam methodHookParam, int callingPid) {
53+ // new Thread(() -> {
54+ // Object[] dexElements = (Object[]) XposedHelpers.getObjectField(XposedHelpers.getObjectField(XposedBridge.class.getClassLoader(), "pathList"), "dexElements");
55+ // for (Object entry : dexElements) {
56+ // Enumeration<String> entries = ((DexFile) XposedHelpers.getObjectField(entry, "dexFile")).entries();
57+ // while (entries.hasMoreElements()) {
58+ // if (entries.nextElement().matches(".+?(epic|weishu).+")) {
59+ // String message = new String(Base64.decode("RG8gTk9UIHVzZSBUYWlDaGkgYW55d2F5XG7or7fkuI3opoHkvb/nlKjlpKrmnoHmiJbml6DmnoE=".getBytes(StandardCharsets.UTF_8), Base64.DEFAULT));
60+ // try {
61+ // if (methodHookParam.args[0] instanceof Application) {
62+ // Toast.makeText((Context) methodHookParam.args[0], message, Toast.LENGTH_LONG).show();
63+ // }
64+ // } catch (Exception ignored) {
65+ // }
66+ //// Os.kill(callingPid, OsConstants.SIGKILL);
67+ // XposedBridge.log(message);
68+ // }
69+ // }
70+ // }
71+ // }).start();
72+ // return true;
73+ // }
74+
3775 /**
38- * Check framework implementation's compatibility and security
39- * To avoid compatibility or magic issues, must
40- * call this method after got any MethodHookParam
76+ * Check malware
4177 *
42- * @param methodHookParam Xposed hook param
43- * @param callingPid Process Pid
44- * @return true
78+ * @param context Module context
79+ * @return If installed or use malware to activate the module
4580 */
46- public static boolean getParamAvailability (final XC_MethodHook .MethodHookParam methodHookParam , int callingPid ) {
47- new Thread (() -> {
48- Object [] dexElements = (Object []) XposedHelpers .getObjectField (XposedHelpers .getObjectField (XposedBridge .class .getClassLoader (), "pathList" ), "dexElements" );
49- for (Object entry : dexElements ) {
50- Enumeration <String > entries = ((DexFile ) XposedHelpers .getObjectField (entry , "dexFile" )).entries ();
51- while (entries .hasMoreElements ()) {
52- if (entries .nextElement ().matches (".+?(epic|weishu).+" )) {
53- try {
54- String message = new String (Base64 .decode ("RG8gTk9UIHVzZSBUYWlDaGkgYW55d2F5XG7or7fkuI3opoHkvb/nlKjlpKrmnoHmiJbml6DmnoE=" .getBytes (StandardCharsets .UTF_8 ), Base64 .DEFAULT ));
55- if (methodHookParam .args [0 ] instanceof Application ) {
56- Toast .makeText ((Context ) methodHookParam .args [0 ], message , Toast .LENGTH_LONG ).show ();
57- }
58- XposedBridge .log (message );
59- Os .kill (callingPid , OsConstants .SIGKILL );
60- } catch (Exception ignored ) {
61- }
62- }
81+ public static boolean isExpModuleActive (Context context ) {
82+ boolean isExp = false ;
83+ if (context == null ) {
84+ return isExp ;
85+ }
86+ PackageManager pm = context .getPackageManager ();
87+ List <PackageInfo > packageInfoList = pm .getInstalledPackages (0 );
88+ for (PackageInfo info : packageInfoList ) {
89+ if (info .packageName .equals ("me.weishu.exp" )) {
90+ return true ;
91+ }
92+ }
93+ try {
94+ ContentResolver contentResolver = context .getContentResolver ();
95+ Uri uri = Uri .parse ("content://me.weishu.exposed.CP/" );
96+ Bundle result = null ;
97+ try {
98+ result = contentResolver .call (uri , "active" , null , null );
99+ } catch (RuntimeException e ) {
100+ try {
101+ Intent intent = new Intent ("me.weishu.exp.ACTION_ACTIVE" );
102+ intent .addFlags (Intent .FLAG_ACTIVITY_NEW_TASK );
103+ context .startActivity (intent );
104+ } catch (Throwable e1 ) {
105+ return isExp ;
63106 }
64107 }
65- }).start ();
66- return true ;
108+ if (result == null ) {
109+ result = contentResolver .call (uri , "active" , null , null );
110+ }
111+
112+ if (result == null ) {
113+ return isExp ;
114+ }
115+ isExp = result .getBoolean ("active" , false );
116+ } catch (Throwable ignored ) {
117+ }
118+ return isExp ;
67119 }
68120
69121 /**
0 commit comments