In one sentence

Simple twenty lines of code, the use of Xposed Hook off step sensor, in order to achieve the purpose of brush step number.

The introduction

Now young people like to use a variety of step counting APP to record the number of steps every day, wechat wechat movement because of the large user base, a lot of people are using, and the nail is also the whole nail movement… Seeing other people take 2W steps every day is to occupy the cover, walking more is a good thing, but it has become a kind of behavior to keep up with the Joneses, walking this kind of thing is not the more the better, I…

This section will Hook a wave of wechat movement, to try the pleasure of occupying the cover.

1. Random analysis

Mobile phone APP step counting basically relies on the mobile phone’s own sensor, but different step counting software may have different algorithms. Take 4.4 as the watershed, before 4.4, step number acquisition is basically through acceleration sensor, and a background resident service is needed to realize the step counting function. If the background service is killed, the step counting function will be unavailable. And after 4.4, most of the cell phone began to new step gauge sensor, the official introduction to this: developer.android.com/about/versi…

The sensor is system-level, records the number of steps from the startup of the phone, and resets to 0 when the phone is shut down. The program can be called directly to obtain the number of steps, instead of running the service in the background in real time tracking, saving power and not to worry about the problem of service survival.

There are two kinds of new step sensors. Officially, TYPE_STEP_COUNTER is recommended. This sensor will do more processing to eliminate false positives, and the result will be more accurate.

Because the step counting algorithms of different apps may be different, and the step counting results may be checked, etc., unreasonable values may increase the probability of abnormal detection, so we intend to Hook the value returned by the sensor directly from the source.

PS: the picture is my Moto xt 1085,5.1 system, there is no step sensor, wechat directly said that the phone does not support, guess is directly abandoned the phone without step sensor, because Hook is wechat movement, so the acceleration sensor does not deal with the ~

Let’s start with the code, and look at the whole process of getting the sensor data:

There is only one value in the values returned, the number of steps we want.

To start tracking the code, click onSensorChange to see the source code

DispatchSensorEvent method, notice the comment above? This method is called by code in the native layer, so all we have to do is get here, values, the float array, that’s what we want, we get the number of steps in there before we call the method, and then we can do whatever we want, like add a value, or multiply by a multiple, One step equals hundreds or thousands of steps.

This method is in a static inner class:

As we saw in the last video, inner classes are linked by the $sign.

Now that you’ve figured out the whole process, let’s start writing the code.

2. Code writing

Write a simple setup page, a CheckBox, and a Seekbar slider.

Then I need to find something to store the user’s options, whether to turn on the step assistant or not, and to keep track of multiples. At first I just used Hawk’s as before. I instantiated Hawk, hawk.init (this). Before calling Hawk, we need to call hawk.build (). The reason is that the service Hook is SystemSensorManager, which was created before my program started. For the storage of this need persistent configuration of data, you can use Xposed with XSharedPreferences, ridicule, on the Internet about this thing is ambiguous, direct hatred code, no explanation, scalp numb.

SharedPreferences (SharedPreferences, SharedPreferences)

And in Xposed, provides the XSharedPreferences to read their own SharedPreferences, without passing in the context.

Two points to note:

  • 1. Generate SharedPreferences. The permission is context. MODE_WORLD_READABLE
  • 2. After XSharedPreferences are instantiated, you need to call makeWorldReadable(), which can only read, not write!!

Let’s go ahead and write a tool class for SharedPreferences.

Click Checkbox and Seekbar to write the result to SP when moving. The progress value defaults to +1 and starts at 0.

Finally is the core Xposed code to write:

Process:

  • 1. Check whether the package name is wechat or Nail
  • 2. Get the sensor Class by reflection (here \ is escaped, in Kotlin $is used for variable value)
  • 3.Hook off the dispatchSensorEvent), get the second argument here (subindex from 0), and modify the first argument in the float array by the multiple we set
  • 4. Super. BeforeHookedMethod (param) call under the original method

That’s about it. It’s very simple.

Step 3 Get your own way

Then run restart, set 1000 times, walk a step is equal to others walk 1000 steps, happy

Then go out to walk the following, or directly in situ shake the phone, open wechat movement to check the number of steps:

Poof yi

4. Summary

The code is the same as the last section, very simple, are directly Hook a system process, but very fun, later will start to slowly Hook some applications, such as wechat, the most want to do is garbage group chat group, remember before using the AccessibilityService AccessibilityService to write automatic add friends, pull groups, Automatically click “like” in the circle of friends to grab red envelopes? After will use Xposed to achieve, please look forward to ~

Attached: Final code (both available at: github.com/coder-pig/C… Find) :

class XposedInit : IXposedHookLoadPackage {
    companion object {
        var xsp by Delegates.notNull<XSharedPreferences>()
    }

    init {
        xsp = XSharedPreferences(BuildConfig.APPLICATION_ID, "config")
        xsp.makeWorldReadable()
    }

    @SuppressLint("PrivateApi")
    override fun handleLoadPackage(lpparam: XC_LoadPackage.LoadPackageParam) {
        when (lpparam.packageName) {
            "com.tencent.mm"."com.alibaba.android.rimet" -> {
                val c = Class.forName("android.hardware.SystemSensorManager\$SensorEventQueue")
                XposedBridge.hookAllMethods(c, "dispatchSensorEvent", object : XC_MethodHook() {
                    override fun beforeHookedMethod(param: MethodHookParam) {
                        xsp.reload()
                        if (xsp.getBoolean(Constants.IS_STEP_OPEN, false)) {
                            val muti = xsp.getString(Constants.CUR_STEP_MULT, "1").toInt() (param.args[1] as FloatArray)[0] = (param.args[1] as FloatArray)[0] * muti } super.beforeHookedMethod(param) } })}}}}Copy the code

Come on, Py deal

If you want to learn Py together, you can add “Pig”, and verify that the information contains: Python, Python, Py, Py, plus group, trade, butthar.

After verification passed reply add group can get add group link (don’t play the robot bad!! ~ ~ ~ welcome all kinds of Py beginners like me, Py big god to join us, and have fun learning and learning together, van came and turned Py.