基礎書籍推薦:1.瘋狂JAVA講義；2.瘋狂安卓講義；

逆向分析必須知道他的原理，不然只會用工具，那就直接GG。

谷歌的映象網站：https://developers.google.com/android/images

選擇

n2g47o

然後要準備的東西有

1.上面的系統包
2.twrp
3.supersu

下載解壓完成後，進入bootloader，然後./flash-all.sh

adb push SR5-SuperSU-v2.82-SR5-20171001224502.zip /sdcard

adb push de.robv.android.xposed.installer_3.1.5-43_minAPI15\(nodpi\)_apkmirror.com.apk /sdcard/Download/

adb reboot bootloader

fastboot flash recovery twrp-3.3.0-0-bullhead.img

然後如果失敗的話就在本地進行fastboot替換就可以了。

然後再常規刷入即可。

【親測有效】開機後wifi有感嘆號, 時間無法同步解決辦法 
在手機的shell裡以root使用者執行：
# settings put global captive_portal_http_url https://www.google.cn/generate_204
# settings put global captive_portal_https_url https://www.google.cn/generate_204
# settings put global ntp_server 1.hk.pool.ntp.org
# reboot
 

手調smail開始了

Xposed開發環境和Hello

<?xml version="1.0" encoding="utf-8"?>
<androidx.constraintlayout.widget.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto"
    xmlns:tools="http://schemas.android.com/tools"
    android:layout_width="match_parent"
    android:layout_height="match_parent"
    tools:context=".MainActivity">


    <TextView
        android:id="@+id/textView"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="請輸入純數字噢"
        app:layout_constraintBottom_toBottomOf="parent"
        app:layout_constraintLeft_toLeftOf="parent"
        app:layout_constraintRight_toRightOf="parent"
        app:layout_constraintTop_toTopOf="parent" />


    <EditText
        android:id="@+id/editText"
        android:hint="username"
        android:layout_width="fill_parent"
        android:layout_height="40dp"
        android:maxLength="20"
        app:layout_constraintBottom_toBottomOf="parent"
        app:layout_constraintEnd_toEndOf="parent"
        app:layout_constraintHorizontal_bias="1.0"
        app:layout_constraintStart_toStartOf="parent"
        app:layout_constraintTop_toTopOf="parent"
        app:layout_constraintVertical_bias="0.095" />

    <EditText
        android:id="@+id/editText2"
        android:hint="password"
        android:layout_width="fill_parent"
        android:layout_height="40dp"
        android:maxLength="20"
        app:layout_constraintBottom_toBottomOf="parent"
        app:layout_constraintTop_toTopOf="parent"
        app:layout_constraintVertical_bias="0.239" />

    <Button
        android:id="@+id/button"
        android:layout_width="100dp"
        android:layout_height="35dp"
        android:layout_gravity="right|center_horizontal"
        android:text="LOGIN"
        android:visibility="visible"
        app:layout_constraintBottom_toBottomOf="parent"
        app:layout_constraintEnd_toEndOf="parent"
        app:layout_constraintStart_toStartOf="parent"
        app:layout_constraintTop_toTopOf="parent"
        app:layout_constraintVertical_bias="0.745" />

</androidx.constraintlayout.widget.ConstraintLayout>
 

package com.example.demo10;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Base64;
import android.util.Log;
import android.view.View;
import android.widget.EditText;
import android.widget.TextView;

public class MainActivity extends AppCompatActivity {

    EditText username_et;
    EditText password_et;
    TextView message_tv;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        Log.i("demo10roysue","Hello from demo10!");

        password_et = (EditText) this.findViewById(R.id.editText2);
        username_et = (EditText) this.findViewById(R.id.editText);
        message_tv = ((TextView) findViewById(R.id.textView));

        this.findViewById(R.id.button).setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {

                if (username_et.getText().toString().compareTo("admin") == 0) {
                    message_tv.setText("You cannot login as admin");
                    return;
                }
                //hook target
                message_tv.setText("Sending to the server :" + Base64.encodeToString((username_et.getText().toString() + ":" + password_et.getText().toString()).getBytes(), Base64.DEFAULT));

            }
        });

    }
}