用Xposed框架拦截Android操作系统的短信接收

短信接收原理

关于Android操作系统短信的接收和发送流程的文章网上有一大堆，但是真正说得很清楚的不多，这篇blog写得不错。其实要想真正弄懂Android操作系统短信的流程，还是Linus的那句话： Read the fucking source code.呵呵
在Android操作系统中，大部分敏感信息的传递过程都是基于binder机制的，当然SMS也不例外。对于SMS的接收流程的描述从Framework层和Application层这两个层面进行介绍。

• Framework层
  当短信到达Framework层后，会首先启动RIL中的RILReceiver去接收短信，在RILReceiver中使用LocalSocket去读短信，然后把读到的短信放在一个Parcel对象中，然后调用processResponse(Parcel p)去处理，processResponse()中调用processUnsolicited(Parcel p)处理。
  Android操作系统对应的源码如下：

 class RILReceiver implements Runnable {
        byte[] buffer;
        RILReceiver() {
            buffer = new byte[RIL_MAX_COMMAND_BYTES];
        }

        @Override
        public void
        run() {
            int retryCount = 0;

            try {for (;;) {
                LocalSocket s = null;
                LocalSocketAddress l;

                try {
                    s = new LocalSocket();
                    l = new LocalSocketAddress(SOCKET_NAME_RIL,
                            LocalSocketAddress.Namespace.RESERVED);
                    s.connect(l);
                } catch (IOException ex){
                    try {
                        if (s != null) {
                            s.close();
                        }
                    } catch (IOException ex2) {
                        //ignore failure to close after failure to connect
                    }

                    // don‘t print an error message after the the first time
                    // or after the 8th time

                    if (retryCount == 8) {
                        Rlog.e (RILJ_LOG_TAG,
                            "Couldn‘t find ‘" + SOCKET_NAME_RIL
                            + "‘ socket after " + retryCount
                            + " times, continuing to retry silently");
                    } else if (retryCount > 0 && retryCount < 8) {
                        Rlog.i (RILJ_LOG_TAG,
                            "Couldn‘t find ‘" + SOCKET_NAME_RIL
                            + "‘ socket; retrying after timeout");
                    }

                    try {
                        Thread.sleep(SOCKET_OPEN_RETRY_MILLIS);
                    } catch (InterruptedException er) {
                    }

                    retryCount++;
                    continue;
                }

                retryCount = 0;

                mSocket = s;
                Rlog.i(RILJ_LOG_TAG, "Connected to ‘" + SOCKET_NAME_RIL + "‘ socket");

                int length = 0;
                try {
                    InputStream is = mSocket.getInputStream();

                    for (;;) {
                        Parcel p;

                        length = readRilMessage(is, buffer);

                        if (length < 0) {
                            // End-of-stream reached
                            break;
                        }

                        p = Parcel.obtain();
                        p.unmarshall(buffer, 0, length);
                        p.setDataPosition(0);

                        //Rlog.v(RILJ_LOG_TAG, "Read packet: " + length + " bytes");

                        processResponse(p);
                        p.recycle();
                    }
                } catch (java.io.IOException ex) {
                    Rlog.i(RILJ_LOG_TAG, "‘" + SOCKET_NAME_RIL + "‘ socket closed",
                          ex);
                } catch (Throwable tr) {
                    Rlog.e(RILJ_LOG_TAG, "Uncaught exception read length=" + length +
                        "Exception:" + tr.toString());
                }

                Rlog.i(RILJ_LOG_TAG, "Disconnected from ‘" + SOCKET_NAME_RIL
                      + "‘ socket");

                setRadioState (RadioState.RADIO_UNAVAILABLE);

                try {
                    mSocket.close();
                } catch (IOException ex) {
                }

                mSocket = null;
                RILRequest.resetSerial();

                // Clear request list on close
                clearRequestList(RADIO_NOT_AVAILABLE, false);
            }} catch (Throwable tr) {
                Rlog.e(RILJ_LOG_TAG,"Uncaught exception", tr);
            }
            /* We‘re disconnected so we don‘t know the ril version */
            notifyRegistrantsRilConnectionChanged(-1);
        }
    }

• Application层
  在App层，PrivilegedSmsReceiver在接收到短信来了的广播之后，由SmsReceiver启动SmsReceiverService来做具体的处理。接收短信的action为SMS_RECEIVED_ACTION，所以调用handleSmsReceived()处理，使用insertMessage()将短信插入数据库，这里首先会判断短信是否为CLASS_0短信，如果是则直接显示，不插入数据库。如果不是则会进行消息的替换或者插入数据库，替换使用了SmsMessaged的isReplace()方法判断，原则是短信协议标识mProtocolIdentifier的判断。如果既不是CLASS_0短信也不需要替换，则将短信插入数据库，然后使用MessagingNotification在StatusBar做一个notification，通知用户短信来了。这里就不附上Android操作系统的相关代码了，感兴趣的，可以自己在Grepcode或者AndroidXRef上自己查看。

编码实现

上面已经弄清楚原理了，研究Android操作系统对应部分的源码，不难找出相应的解决方案。这里选择一种比较简单的hook，用xposed框架进行拦截。当然也是经过多次失败尝试后找到的一种比较有效的方法。思路很简单，就是针对短信接收流程中调用的函数，拦截该函数，获取接收端的信息流，对信息流进行按位异或处理。下面给出核心部分的源码：

package com.example.receiver;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

/**
 * @author Li Jiansong
 * @date:2015-7-27  上午11:15:48
 * @version :
 *
 *Server端短信接收端的拦截，经过多次尝试，最终有效的是下面的方案
 *拦截SmsMessage的内部类PduParser的getUserDataUCS2方法，该方法返回类型为String
 *String getUserDataUCS2(int byteCount)
 *
 */
public class RecvHooker implements IXposedHookLoadPackage{

    private static final String TARGET_PACKAGE = "com.android.mms";

    @Override
    public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable {
        // TODO Auto-generated method stub
        //XposedBridge.log("--------loaded app:"+lpparam.packageName);
//      if(!lpparam.packageName.equals("com.android.mms"))
//          return;

        if (!TARGET_PACKAGE.equals(lpparam.packageName)) {
            // XposedBridge.log("SendRawSMSMod: ignoring package: " +
            // lpparam.packageName);
            return;
        }

//      /**
//       * 拦截SmsMessage的内部类PduParser的getUserData方法，
//       * byte[] getUserData(){}
//       * 该方法不带参数
//       */
//      final Class<?> recvClazz=XposedHelpers.findClass("com.android.internal.telephony.gsm"
//      +".SmsMessage$PduParser",lpparam.classLoader);
//      
//      XposedBridge.log("==========开始进入拦截----");
//      
//      XposedHelpers.findAndHookMethod(recvClazz, "getUserData",
//              new XC_MethodHook(){
//      
//          @Override
//          protected void afterHookedMethod(MethodHookParam param)
//                  throws Throwable {
//              // TODO Auto-generated method stub
//              //super.beforeHookedMethod(param);
//      
//              XposedBridge.log("=========getUserData被调用");
//              byte[] recvByteSms=(byte[]) param.getResult();
//              String strRecvSms="";
//              strRecvSms+=new String(recvByteSms);
//          
//              //byte[] srtbyte = strRecvSms.getBytes();
//              //String lsx="6666666666666666666666666666666666";
//              param.setResult(strRecvSms.getBytes());
//              //SmsMessage msg=new SmsMessage();
//              
//              XposedBridge.log("========接收的短信内容为："+strRecvSms);
//              return;
//          }
//          
//          
//      });





        //XposedBridge.log("-------开始拦截");
//      findAndHookMethod("com.android.internal.telephony.gsm.SmsMessage",lpparam.classLoader,
//              "getSubmitPdu",String.class,
//              String.class, String.class, boolean.class, byte[].class,
//              int.class, int.class, int.class, new XC_MethodHook(){
//          
//          /**
//           * 拦截SmsMessage的getSubmitPdu方法，其有5个参数
//           * String scAddress,
//           * String destinationAddress, 
//           * String message,
//           * boolean statusReportRequested, 
//           * byte[] header
//           * 
//           */
//          
//          /**
//           * Get an SMS-SUBMIT PDU for a destination address and a message
//           *
//           * @param scAddress Service Centre address.  Null means use default.
//           * @return a <code>SubmitPdu</code> containing the encoded SC
//           *         address, if applicable, and the encoded message.
//           *         Returns null on encode error.
//           */
//          @Override
//          protected void beforeHookedMethod(MethodHookParam param)
//                  throws Throwable {
//              // TODO Auto-generated method stub
//          //  super.beforeHookedMethod(param);
//              XposedBridge.log("getSubmitPdu被调用");
//              if(param.args[2]==null){
//                  return;
//              }
//              String message=(String) param.args[2];
//              XposedBridge.log("======before：SMS message："+message);
//              SimpleDateFormat df=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
//              message+=df.format(new Date());
//              XposedBridge.log("========after   SMS message："+message);
//              SubmitPdu rawPdu=new SubmitPdu();
//              //StringTokenizer stringTokenizer=new StringTokenizer(string, delimiters, returnDelimiters)
//              param.setResult(rawPdu);
//              XposedBridge.log("=============hook替换成功");
//              
//              return;
//              
//          }
//      });


//      final Class<?> recvClazz=XposedHelpers.findClass("com.android.internal.telephony.gsm"
//              +".SmsMessage$PduParser",lpparam.classLoader);

        XposedBridge.log("=========开始进入拦截");
        XposedHelpers.findAndHookMethod("com.android.internal.telephony.gsm"+".SmsMessage$PduParser", 
                lpparam.classLoader,"getUserDataUCS2",int.class, 
                new XC_MethodHook(){
            /**
             * Interprets the user data payload as UCS2 characters, and
             * decodes them into a String.
             *
             * @param byteCount the number of bytes in the user data payload
             * @return a String with the decoded characters
             */
            /**
             * 拦截SmsMessage的内部类PduParser的getUserDataUCS2方法，该方法返回类型为String
             * String getUserDataUCS2(int byteCount)
             * 
             */
            @Override
            protected void afterHookedMethod(MethodHookParam param)
                    throws Throwable {
                // TODO Auto-generated method stub
            //  super.afterHookedMethod(param);
                try {
                    String strMms=(String) param.getResult();
                    XposedBridge.log("=========before:"+strMms);
                    //String after="666666666666666";
                    char[] recvArray=strMms.toCharArray();
                    for(int i=0;i<recvArray.length;i++){
                        recvArray[i]=(char) (recvArray[i]^20000);
                    }
                    String enCodeSms=new String(recvArray);
                    param.setResult(enCodeSms);

                    XposedBridge.log("=========after:"+param.getResult());

                    //return;
                } catch (Exception e) {
                    // TODO Auto-generated catch block
                    //e.printStackTrace();
                    XposedBridge.log(e);
                }

            }
        });
    }
}

测试

下面给出一个测试例子，向10086发送一条短信，10086自动给出回应信息。由于回应的信息被拦截处理了，所以显示的是乱码。从后台的日志可以看出完整的原来正常的短信信息。