1
Java.perform(function() {
2
    var TargetClass = Java.use('目标className');
3
    TargetClass.目标methodName.implementation = function() {
4
        console.log('targetMethod is hooked');
5
    };
6
});

1
package com.example.seccon2015.rock_paper_scissors;
2
import android.app.Activity;
3
import android.os.Bundle;
4
import android.os.Handler;
5
import android.view.View;
6
import android.widget.Button;
7
import android.widget.TextView;
8
import java.util.Random;
9

10
public class MainActivity extends Activity implements View.OnClickListener {
11
    Button P;
12
    Button S;
13
    int flag;
14
    int m;
15
    int n;
16
    Button r;
17
    int cnt = 0;
18
    private final Handler handler = new Handler();
19
    private final Runnable showMessageTask = new Runnable() {
20
        public void run() {
21
            TextView tv3 = (TextView) MainActivity.this.findViewById(R.id.textView3);
22
            if (MainActivity.this.n - MainActivity.this.m == 1) {
23
                MainActivity.this.cnt++;
24
                tv3.setText("WIN! +" + String.valueOf(MainActivity.this.cnt));
25
            } else if (MainActivity.this.m - MainActivity.this.n == 1) {
26
                MainActivity.this.cnt = 0;
27
                tv3.setText("LOSE +0");
28
            } else if (MainActivity.this.m == MainActivity.this.n) {
29
                tv3.setText("DRAW +" + String.valueOf(MainActivity.this.cnt));
30
            } else if (MainActivity.this.m < MainActivity.this.n) {
31
                MainActivity.this.cnt = 0;
32
                tv3.setText("LOSE +0");
33
            } else {
34
                MainActivity.this.cnt++;
35
                tv3.setText("WIN! +" + String.valueOf(MainActivity.this.cnt));
36
            }
37
            if (1000 == MainActivity.this.cnt) {
38
                tv3.setText("SECCON{" + String.valueOf((MainActivity.this.cnt + MainActivity.this.calc()) * 107) + "}");
39
            }
40
            MainActivity.this.flag = 0;
41
        }
42
    };
43
    public native int calc();
44
    static {
45
        System.loadLibrary("calc");
46
    }
47
    @Override // android.app.Activity
48
    protected void onCreate(Bundle savedInstanceState) {
49
        super.onCreate(savedInstanceState);
50
        setContentView(R.layout.activity_main);
51
        this.P = (Button) findViewById(R.id.button);
52
        this.S = (Button) findViewById(R.id.button3);
53
        this.r = (Button) findViewById(R.id.buttonR);
54
        this.P.setOnClickListener(this);
55
        this.r.setOnClickListener(this);
56
        this.S.setOnClickListener(this);
57
        this.flag = 0;
58
    }
59
    @Override // android.view.View.OnClickListener
60
    public void onClick(View v) {
61
        if (this.flag != 1) {
62
            this.flag = 1;
63
            TextView tv3 = (TextView) findViewById(R.id.textView3);
64
            tv3.setText("");
65
            TextView tv = (TextView) findViewById(R.id.textView);
66
            TextView tv2 = (TextView) findViewById(R.id.textView2);
67
            this.m = 0;
68
            Random rm = new Random();
69
            this.n = rm.nextInt(3);
70
            String[] ss = {"CPU: Paper", "CPU: Rock", "CPU: Scissors"};
71
            tv2.setText(ss[this.n]);
72
            if (v == this.P) {
73
                tv.setText("YOU: Paper");
74
                this.m = 0;
75
            }
76
            if (v == this.r) {
77
                tv.setText("YOU: Rock");
78
                this.m = 1;
79
            }
80
            if (v == this.S) {
81
                tv.setText("YOU: Scissors");
82
                this.m = 2;
83
            }
84
            this.handler.postDelayed(this.showMessageTask, 1000L);
85
        }
86
    }
87
}

1
adb shell am monitor

1
Java.perform(function() {
2
  var packageName = "com.example.seccon2015.rock_paper_scissors";
3
  Java.enumerateLoadedClasses({
4
    onMatch: function(className) {
5
      if (className.startsWith(packageName)) {
6
        var targetClass = Java.use(className);
7
        var methods = targetClass.class.getDeclaredMethods();
8
        console.log("Class: " + className);
9
        for (var i = 0; i < methods.length; i++) {
10
          console.log(methods[i].toString());
11
        }
12
        console.log("-------------------------------------");
13
      }
14
    },
15
    onComplete: function() {}
16
  });
17
});

1
Java.perform(function () {
2
  var MainActivity = Java.use('com.example.seccon2015.rock_paper_scissors.MainActivity');
3
  var onClick = MainActivity.onClick;
4
  onClick.implementation = function (v) {
5
    send('onClick');
6
    // Call the original onClick handler
7
    this.m.value = 0;
8
    this.n.value = 1;
9
    this.cnt.value = 999;
10
    console.log('Done:' + JSON.stringify(this.cnt));
11
  };
12
});