android web hook,WebView-骚操作03-Hook
android5.0以上，webview所在进程如果是android.uid.system，运行则会直接崩溃。
解决方法：
2个apk，由主apk做需要system权限的业务，拉起webview apk
通过hook方式解决，参考android.webkit.WebViewFactory源码，详细代码如下
public class WebViewUtils {
private static final String TAG = "WebViewUtils";
public static void hookWebView() {
final int uid = android.os.Process.myUid();
if (uid != android.os.Process.SYSTEM_UID) {
Log.e(TAG, "uid=" + uid + ";not SYSTEM_UID;need not hook");
return;
}
int sdkInt = Build.VERSION.SDK_INT;
try {
Class> factoryClass = Class.forName("android.webkit.WebViewFactory");
Field field = factoryClass.getDeclaredField("sProviderInstance");
field.setAccessible(true);
Object sProviderInstance = field.get(null);
if (sProviderInstance != null) {
Log.i(TAG, "sProviderInstance!=null;need not hook");
return;
} else {
Log.i(TAG, "sProviderInstance==null;need hook");
}
Method getProviderClassMethod;
if (sdkInt > 22) {
getProviderClassMethod = factoryClass.getDeclaredMethod("getProviderClass");
} else if (sdkInt == 22) {
getProviderClassMethod = factoryClass.getDeclaredMethod("getFactoryClass");
} else {
Log.i(TAG, "sdkInt:" + sdkInt + ";need not Hook");
return;
}
getProviderClassMethod.setAccessible(true);
Class> factoryProviderClass = (Class>) getProviderClassMethod.invoke(factoryClass);
Class> delegateClass = Class.forName("android.webkit.WebViewDelegate");
Constructor> delegateConstructor = delegateClass.getDeclaredConstructor();
delegateConstructor.setAccessible(true);
if (sdkInt < 26) {
//低于Android O版本
Constructor> providerConstructor = factoryProviderClass.getConstructor(delegateClass);
if (providerConstructor != null) {
providerConstructor.setAccessible(true);
sProviderInstance = providerConstructor.newInstance(delegateConstructor.newInstance());
}
} else {
String chromiumMethodNameStr = null;
try {
Field chromiumMethodName = factoryClass.getDeclaredField("CHROMIUM_WEBVIEW_FACTORY_METHOD");
chromiumMethodName.setAccessible(true);
chromiumMethodNameStr = (String) chromiumMethodName.get(null);
} catch (Exception e) {
Log.e(TAG, "can not found CHROMIUM_WEBVIEW_FACTORY_METHOD;use create");
}
if (chromiumMethodNameStr == null) {
chromiumMethodNameStr = "create";
}
Method staticFactory = factoryProviderClass.getMethod(chromiumMethodNameStr, delegateClass);
if (staticFactory != null) {
sProviderInstance = staticFactory.invoke(null, delegateConstructor.newInstance());
}
}
if (sProviderInstance != null) {
field.set("sProviderInstance", sProviderInstance);
Log.i(TAG, "Hook success!");
} else {
Log.i(TAG, "Hook failed!");
}
} catch (Throwable e) {
Log.w(TAG, e);
}
}
}