砸壳的工具千千万，可是FDex2 是最有能耐的，我尝试过各类壳，都是秒砸的。特别说明一下，360的壳，oncreated 方法仍是空的，可是其余大部份内容仍是有的，反正是能够参考一下的。java
安装环境：android
1，安卓手机root ，必须root，记住是必须，只支持6.0 或者更低的版本，过高版本也不行。app
Root 手机很好找，淘宝买个nexus 手机，而后家里用工具就能够root，为何不 推荐其余手机，是由于其余手机如今root 特别麻烦，买个旧手机就几百块钱。工具
2，安装virtual xposedcode
Xposed 的安装，使用，以前已经讲过了，这里不在赘述。blog
3，安装Fdex2.get
下载地址：连接:https://pan.baidu.com/s/1smxtinr 密码:dk4vit
4, 激活FDex2 模块io
开始砸壳：class
安装app 到xposed， 启动FDex2 ，而后配置须要砸壳的app，
再提示的目录，就能够找到脱壳后的dex 文件。
Fdex2 的程序代码：
packagecom.ppma.xposed;
importimportimportimportimportjava.io.File;java.io.FileOutputStream;java.io.IOException;java.io.OutputStream;java.lang.reflect.Method;
importimportimportimportimportimportde.robv.android.xposed.IXposedHookLoadPackage;de.robv.android.xposed.XC_MethodHook;de.robv.android.xposed.XSharedPreferences;de.robv.android.xposed.XposedBridge;de.robv.android.xposed.XposedHelpers;de.robv.android.xposed.callbacks.XC_LoadPackage;
publicclass MainHook implements IXposedHookLoadPackage {
XSharedPreferences xsp;
Class Dex;
Method Dex_getBytes;
Method getDex;
String packagename;
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
new"com.ppma.appinfo""User" xsp =XSharedPreferences(,);
xsp.makeWorldReadable();
xsp.reload();
initRefect();
"packagename"null packagename = xsp.getString(,);
"设定包名：" XposedBridge.log(+packagename);
ifnull ((!lpparam.packageName.equals(packagename))||packagename==) {
"当前程序包名与设定不一致或者包名为空" XposedBridge.log();
return ;
}
"目标包名：" XposedBridge.log(+lpparam.packageName);
"java.lang.ClassLoader" String str =;
"loadClass" String str2 =;
new XposedHelpers.findAndHookMethod(str, lpparam.classLoader, str2, String.class, Boolean.TYPE,XC_MethodHook() {
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super .afterHookedMethod(param);
Class cls = (Class) param.getResult();
ifnull (cls ==) {
//XposedBridge.log("cls == null");
return ;
}
String name = cls.getName();
"当前类名：" XposedBridge.log(+ name);
bytebytenew0new0 [] bArr = ([]) Dex_getBytes.invoke(getDex.invoke(cls,Object[]),Object[]);
ifnull (bArr ==) {
"数据为空：返回" XposedBridge.log();
return ;
}
"开始写数据" XposedBridge.log();
"/data/data/""/""_"".dex" String dex_path =+ packagename ++ packagename ++ bArr.length +;
XposedBridge.log(dex_path);
new File file =File(dex_path);
ifreturn (file.exists());
writeByte(bArr, file.getAbsolutePath());
}
} );
}
public void initRefect() {
try {
"com.android.dex.Dex" Dex = Class.forName();
"getBytes"new0 Dex_getBytes = Dex.getDeclaredMethod(,Class[]);
"java.lang.Class""getDex"new0 getDex = Class.forName().getDeclaredMethod(,Class[]);
catch }(ClassNotFoundException e) {
e.printStackTrace();
catch }(NoSuchMethodException e) {
e.printStackTrace();
}
}
public void writeByte(byte[] bArr, String str) {
try {
new OutputStream outputStream =FileOutputStream(str);
outputStream.write(bArr);
outputStream.close();
catch }(IOException e) {
e.printStackTrace();
"文件写出失败" XposedBridge.log();
}
}
}