Android流氓代码块(亲测可行)

时间:2022-09-12 17:27:44

开机自启动(小米需要在安全中心设置自启动)

//在广播中声明
String action = intent.getAction();
if (action.equals("android.intent.action.BOOT_COMPLETED")) {
Intent activity = new Intent(context, SecondActivity.class);
activity.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
context.startActivity(activity);
}
<receiver android:name=".xxx.xxx">
<intent-filter>
<action android:name="android.intent.action.BOOT_COMPLETED"/>
</intent-filter>
</receiver>
//权限
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>

静默安装(需要root)


public static boolean installUseRoot(String filePath) {
if (TextUtils.isEmpty(filePath))
throw new IllegalArgumentException("Please check apk file path!");
boolean result = false;
Process process = null;
OutputStream outputStream = null;
BufferedReader errorStream = null;
try {
process = Runtime.getRuntime().exec("su");
outputStream = process.getOutputStream();
String command = "pm install -r " + filePath + "\n";
outputStream.write(command.getBytes());
outputStream.flush();
outputStream.write("exit\n".getBytes());
outputStream.flush();
process.waitFor();
errorStream = new BufferedReader(new InputStreamReader(process.getErrorStream()));
StringBuilder msg = new StringBuilder();
String line;
while ((line = errorStream.readLine()) != null) {
msg.append(line);
}
Log.d(TAG, "install msg is " + msg);
if (!msg.toString().contains("Failure")) {
result = true;
}
} catch (Exception e) {
Log.e(TAG, e.getMessage(), e);
} finally {
try {
if (outputStream != null) {
outputStream.close();
}
if (errorStream != null) {
errorStream.close();
}
} catch (IOException e) {
outputStream = null;
errorStream = null;
process.destroy();
}
}
return result;
}

关机代码块(root)

    public static void closeOs(Context context) {
try {
Process proc = Runtime.getRuntime().exec(new String[]{"su", "-c", "reboot -p"}); //关机
} catch (IOException e) {
e.printStackTrace();
}
}

双守护线程保活

public class DaemonService extends Service {
String TAG = "DaemonService";

private DaemonBinder mDaemonBinder;

private DaemonServiceConnection mDaemonServiceConn;

public DaemonService() {
}

@Override
public void onCreate() {
super.onCreate();
mDaemonBinder = new DaemonBinder();

if (mDaemonServiceConn == null) {
mDaemonServiceConn = new DaemonServiceConnection();
}

Log.i(TAG, TAG + " onCreate");
}

@Override
public int onStartCommand(Intent intent, int flags, int startId) {
super.onStartCommand(intent, flags, startId);
Log.i(TAG, TAG + " onStartCommand");
bindService(new Intent(this, RemoteService.class), mDaemonServiceConn, Context.BIND_IMPORTANT);

return START_STICKY;
}

@Nullable
@Override
public IBinder onBind(Intent intent) {
return mDaemonBinder;
}

/**
* 通过AIDL实现进程间通信
*/

class DaemonBinder extends IProcessService.Stub {
@Override
public String getServiceName() throws RemoteException {
return TAG;
}
}

/**
* 连接远程服务
*/

class DaemonServiceConnection implements ServiceConnection {

@Override
public void onServiceConnected(ComponentName name, IBinder service) {
try {
// 与远程服务通信
IProcessService process = IProcessService.Stub.asInterface(service);
Log.i(TAG, "连接" + process.getServiceName() + "服务成功");
} catch (RemoteException e) {
e.printStackTrace();
}
}

@Override
public void onServiceDisconnected(ComponentName name) {
// RemoteException连接过程出现的异常,才会回调,unbind不会回调
startService(new Intent(DaemonService.this, RemoteService.class));
bindService(new Intent(DaemonService.this, RemoteService.class), mDaemonServiceConn, Context.BIND_IMPORTANT);
}
}
}



public class RemoteService extends Service {
String TAG = "RemoteService";
private ServiceBinder mServiceBinder;

private RemoteServiceConnection mRemoteServiceConn;

@Override
public void onCreate() {
super.onCreate();

mServiceBinder = new ServiceBinder();

if (mRemoteServiceConn == null) {
mRemoteServiceConn = new RemoteServiceConnection();
}

Log.i(TAG, TAG + " onCreate");
}

@Override
public int onStartCommand(Intent intent, int flags, int startId) {
super.onStartCommand(intent, flags, startId);
Log.i(TAG, TAG + " onStartCommand");

bindService(new Intent(this, DaemonService.class), mRemoteServiceConn, Context.BIND_IMPORTANT);

return START_STICKY;
}

@Nullable
@Override
public IBinder onBind(Intent intent) {
return mServiceBinder;
}

/**
* 通过AIDL实现进程间通信
*/

class ServiceBinder extends IProcessService.Stub {
@Override
public String getServiceName() throws RemoteException {
return "RemoteService";
}
}


/**
* 连接远程服务
*/

class RemoteServiceConnection implements ServiceConnection {

@Override
public void onServiceConnected(ComponentName name, IBinder service) {
try {

IProcessService process = IProcessService.Stub.asInterface(service);
Log.i(TAG, "连接" + process.getServiceName() + "服务成功");
} catch (RemoteException e) {
e.printStackTrace();
}
}

@Override
public void onServiceDisconnected(ComponentName name) {
// RemoteException连接过程出现的异常,才会回调,unbind不会回调

startService(new Intent(RemoteService.this, DaemonService.class));

bindService(new Intent(RemoteService.this, DaemonService.class), mRemoteServiceConn, Context.BIND_IMPORTANT);
}
}
}

//aidl 文件

package com.android.process.aidl;
interface IProcessService {
/**
* Demonstrates some basic types that you can use as parameters
* and return values in AIDL.
*/

String getServiceName();
}

非Root的智能安装(可以)

原文链接:http://blog.csdn.net/fuchaosz/article/details/51852442

原理是用到了android提供的AccessibilityService服务,这个服务可以获取屏幕上的节点,一个节点也就是一个view,我们写的xml文件中每个标签就是一个节点,然后可以模拟用户的操作,对这些节点进行点击、滑动等操作。我们就是利用这个原理,来自动点击安装按钮的,当然使用这个服务必须用户手动开启无障碍服务。

创建AccessibilityService配置文件 在res目录下创建xml目录,然后在xml目录下创建一个accessibility_service_config.xml文件,内容如下 res/xml/accessibility_service_config.xml:

<accessibility-service xmlns:android="http://schemas.android.com/apk/res/android"
android:accessibilityEventTypes="typeAllMask"
android:accessibilityFeedbackType="feedbackGeneric"
android:accessibilityFlags="flagDefault"
android:canRetrieveWindowContent="true"
android:description="@string/desc"
android:packageNames="com.android.packageinstaller"
/>
  • accessibilityEventTypes:指定我们在监听窗口中可以模拟哪些事件,typeAllMask表示所有的事件都能模拟.
  • accessibilityFeedbackType:指定无障碍服务的反馈方式.
  • canRetrieveWindowContent:指定是否允许我们的程序读取窗口中的节点和内容,当然是true.
  • description: 当用户手动配置服务时,会显示给用户看.
  • packageNames: 指定我们要监听哪个应用程序下的窗口活动,这里写com.android.packageinstaller表示监听Android系统的安装界面。 其余参数照写即可。 res/strings.xml:

创建AccessibilityService服务

public class MyAccessibilityService extends AccessibilityService {

private static final String TAG = "[TAG]";
private Map<Integer, Boolean> handleMap = new HashMap<>();

@Override
public void onAccessibilityEvent(AccessibilityEvent event) {
AccessibilityNodeInfo nodeInfo = event.getSource();
if (nodeInfo != null) {
int eventType = event.getEventType();
if (eventType == AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED || eventType == AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED) {
if (handleMap.get(event.getWindowId()) == null) {
boolean handled = iterateNodesAndHandle(nodeInfo);
if (handled) {
handleMap.put(event.getWindowId(), true);
}
}
}

}
}

@Override
public void onInterrupt() {

}

//遍历节点,模拟点击安装按钮
private boolean iterateNodesAndHandle(AccessibilityNodeInfo nodeInfo) {
if (nodeInfo != null) {
int childCount = nodeInfo.getChildCount();
if ("android.widget.Button".equals(nodeInfo.getClassName())) {
String nodeCotent = nodeInfo.getText().toString();
Log.d(TAG, "content is: " + nodeCotent);
if ("安装".equals(nodeCotent) || "完成".equals(nodeCotent) || "确定".equals(nodeCotent)) {
nodeInfo.performAction(AccessibilityNodeInfo.ACTION_CLICK);
return true;
}
}
//遇到ScrollView的时候模拟滑动一下
else if ("android.widget.ScrollView".equals(nodeInfo.getClassName())) {
nodeInfo.performAction(AccessibilityNodeInfo.ACTION_SCROLL_FORWARD);
}
for (int i = 0; i < childCount; i++) {
AccessibilityNodeInfo childNodeInfo = nodeInfo.getChild(i);
if (iterateNodesAndHandle(childNodeInfo)) {
return true;
}
}
}
return false;
}
}

AndroidManifest中配置服务

 <service
android:name=".MyAccessibilityService"
android:label="智能安装App"
android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE"
>

<intent-filter>
<action android:name="android.accessibilityservice.AccessibilityService"/>
</intent-filter>
<meta-data
android:name="android.accessibilityservice"
android:resource="@xml/accessibility_service_config"
/>

</service>

重点是后面的service标签:

  • android:label:这个就是用户看到的无障碍服务的名称
  • android:permission: 需要用到BIND_ACCESSIBILITY_SERVICE这个权限.
  • action: android.accessibilityservice.AccessibilityService 有了这个action,用户才能在设置里面看到我们的服务,否则用户无法开启我们写的服务,也就不能进到我们写的MyAccessibilityService里面了.所以,注意不要写错了,如果你发现无障碍服务里面没有我们写的服务,请检查这里.

调用智能安装代码

   private void smartInstall() {
Uri uri = Uri.fromFile(new File("/mnt/sdcard/test.apk"));
Intent localIntent = new Intent(Intent.ACTION_VIEW);
localIntent.setDataAndType(uri, "application/vnd.android.package-archive");
startActivity(localIntent);
}

手动配置智能安装服务

//跳转到开启智能安装服务的界面
Intent intent = new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS);
startActivity(intent);

查看文章 :http://blog.csdn.net/fuchaosz/article/details/51852442