├── app ├── .gitignore ├── src │ ├── main │ │ ├── res │ │ │ ├── values │ │ │ │ ├── strings.xml │ │ │ │ ├── colors.xml │ │ │ │ └── styles.xml │ │ │ ├── mipmap-hdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-mdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-xhdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-xxhdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-xxxhdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_round.png │ │ │ ├── mipmap-anydpi-v26 │ │ │ │ ├── ic_launcher.xml │ │ │ │ └── ic_launcher_round.xml │ │ │ ├── layout │ │ │ │ └── activity_main.xml │ │ │ ├── drawable-v24 │ │ │ │ └── ic_launcher_foreground.xml │ │ │ └── drawable │ │ │ │ └── ic_launcher_background.xml │ │ ├── java │ │ │ ├── org │ │ │ │ └── chickenhook │ │ │ │ │ └── chickenbinder │ │ │ │ │ ├── AppListener.java │ │ │ │ │ ├── MainActivity.java │ │ │ │ │ └── MainActivityKotlin.kt │ │ │ └── com │ │ │ │ └── android │ │ │ │ └── server │ │ │ │ └── wm │ │ │ │ └── ActivityRecord.java │ │ └── AndroidManifest.xml │ ├── test │ │ └── java │ │ │ └── org │ │ │ └── chickenhook │ │ │ └── chickenbinder │ │ │ └── ExampleUnitTest.kt │ └── androidTest │ │ └── java │ │ └── org │ │ └── chickenhook │ │ └── chickenbinder │ │ └── MainActivityTest.kt ├── proguard-rules.pro └── build.gradle ├── binderhooks ├── .gitignore ├── consumer-rules.pro ├── src │ ├── main │ │ ├── AndroidManifest.xml │ │ ├── java │ │ │ └── org │ │ │ │ └── chickenhook │ │ │ │ └── binderhooks │ │ │ │ ├── Logger.java │ │ │ │ ├── proxyListeners │ │ │ │ └── ProxyListener.java │ │ │ │ ├── ProxyHook.java │ │ │ │ ├── ParcelEditor.java │ │ │ │ ├── BinderListener.java │ │ │ │ ├── BinderHook.java │ │ │ │ └── ServiceHooks.java │ │ └── cpp │ │ │ └── chickenbinder.cc │ ├── test │ │ └── java │ │ │ └── org │ │ │ └── chickenhook │ │ │ └── binderhooks │ │ │ └── ExampleUnitTest.java │ └── androidTest │ │ └── java │ │ └── org │ │ └── chickenhook │ │ └── binderhooks │ │ └── ServiceHooksTest.java ├── proguard-rules.pro ├── build.gradle └── CMakeLists.txt ├── settings.gradle ├── gradle └── wrapper │ ├── gradle-wrapper.jar │ └── gradle-wrapper.properties ├── .gitignore ├── .github └── FUNDING.yml ├── gradle.properties ├── gradlew.bat ├── gradlew ├── README.md └── LICENSE /app/.gitignore: -------------------------------------------------------------------------------- 1 | /build 2 | -------------------------------------------------------------------------------- /binderhooks/.gitignore: -------------------------------------------------------------------------------- 1 | /build 2 | -------------------------------------------------------------------------------- /binderhooks/consumer-rules.pro: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /settings.gradle: -------------------------------------------------------------------------------- 1 | rootProject.name='ChickenBinder' 2 | include ':app' 3 | include ':binderhooks' 4 | -------------------------------------------------------------------------------- /app/src/main/res/values/strings.xml: -------------------------------------------------------------------------------- 1 | 2 | ChickenBinder 3 | 4 | -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /app/src/main/res/mipmap-hdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-hdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-mdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-mdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xhdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-xhdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xxhdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-xxhdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xxxhdpi/ic_launcher.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-hdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-hdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-mdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-mdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xhdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /binderhooks/src/main/AndroidManifest.xml: -------------------------------------------------------------------------------- 1 | 3 | -------------------------------------------------------------------------------- /app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ChickenHook/BinderHook/HEAD/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png -------------------------------------------------------------------------------- /app/src/main/res/values/colors.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | #6200EE 4 | #3700B3 5 | #03DAC5 6 | 7 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.iml 2 | .gradle 3 | /local.properties 4 | /.idea/caches 5 | /.idea/libraries 6 | /.idea/modules.xml 7 | /.idea/workspace.xml 8 | /.idea/navEditor.xml 9 | /.idea/assetWizardSettings.xml 10 | .DS_Store 11 | /build 12 | /captures 13 | .externalNativeBuild 14 | .cxx 15 | -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | #Sat May 02 13:08:16 CEST 2020 2 | distributionBase=GRADLE_USER_HOME 3 | distributionPath=wrapper/dists 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | distributionUrl=https\://services.gradle.org/distributions/gradle-5.6.4-all.zip 7 | -------------------------------------------------------------------------------- /app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /app/src/main/res/values/styles.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /app/src/main/java/org/chickenhook/chickenbinder/AppListener.java: -------------------------------------------------------------------------------- 1 | package org.chickenhook.chickenbinder; 2 | 3 | import android.content.BroadcastReceiver; 4 | import android.content.Context; 5 | import android.content.Intent; 6 | import android.util.Log; 7 | 8 | public class AppListener extends BroadcastReceiver { 9 | @Override 10 | public void onReceive(Context context, Intent intent) { 11 | Log.d("AppListener", "App is going to be removed!"); 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /app/src/test/java/org/chickenhook/chickenbinder/ExampleUnitTest.kt: -------------------------------------------------------------------------------- 1 | package org.chickenhook.chickenbinder 2 | 3 | import org.junit.Test 4 | 5 | import org.junit.Assert.* 6 | 7 | /** 8 | * Example local unit test, which will execute on the development machine (host). 9 | * 10 | * See [testing documentation](http://d.android.com/tools/testing). 11 | */ 12 | class ExampleUnitTest { 13 | @Test 14 | fun addition_isCorrect() { 15 | assertEquals(4, 2 + 2) 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /binderhooks/src/main/java/org/chickenhook/binderhooks/Logger.java: -------------------------------------------------------------------------------- 1 | package org.chickenhook.binderhooks; 2 | 3 | import android.util.Log; 4 | 5 | import androidx.annotation.NonNull; 6 | 7 | public class Logger { 8 | 9 | public static void log(@NonNull String message) { 10 | Log.i("BinderHook", message); 11 | } 12 | 13 | public static void log(@NonNull String message, @NonNull Exception exception) { 14 | Log.i("BinderHook", message, exception); 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /binderhooks/src/test/java/org/chickenhook/binderhooks/ExampleUnitTest.java: -------------------------------------------------------------------------------- 1 | package org.chickenhook.binderhooks; 2 | 3 | import org.junit.Test; 4 | 5 | import static org.junit.Assert.*; 6 | 7 | /** 8 | * Example local unit test, which will execute on the development machine (host). 9 | * 10 | * @see Testing documentation 11 | */ 12 | public class ExampleUnitTest { 13 | @Test 14 | public void addition_isCorrect() { 15 | assertEquals(4, 2 + 2); 16 | } 17 | } -------------------------------------------------------------------------------- /binderhooks/src/main/java/org/chickenhook/binderhooks/proxyListeners/ProxyListener.java: -------------------------------------------------------------------------------- 1 | package org.chickenhook.binderhooks.proxyListeners; 2 | 3 | import java.lang.reflect.InvocationHandler; 4 | import java.lang.reflect.Method; 5 | 6 | /** 7 | * Listener for interface hooking 8 | */ 9 | public abstract class ProxyListener implements InvocationHandler { 10 | 11 | private Object obj; 12 | 13 | public void setObject(Object obj) { 14 | this.obj = obj; 15 | } 16 | 17 | @Override 18 | public Object invoke(Object proxy, Method method, Object[] args) throws Throwable { 19 | return invoke(obj, proxy, method, args); 20 | } 21 | 22 | public abstract Object invoke(Object original, Object proxy, Method method, Object[] args) throws Throwable; 23 | } 24 | -------------------------------------------------------------------------------- /app/proguard-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # You can control the set of applied configuration files using the 3 | # proguardFiles setting in build.gradle. 4 | # 5 | # For more details, see 6 | # http://developer.android.com/guide/developing/tools/proguard.html 7 | 8 | # If your project uses WebView with JS, uncomment the following 9 | # and specify the fully qualified class name to the JavaScript interface 10 | # class: 11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 12 | # public *; 13 | #} 14 | 15 | # Uncomment this to preserve the line number information for 16 | # debugging stack traces. 17 | #-keepattributes SourceFile,LineNumberTable 18 | 19 | # If you keep the line number information, uncomment this to 20 | # hide the original source file name. 21 | #-renamesourcefileattribute SourceFile 22 | -------------------------------------------------------------------------------- /binderhooks/proguard-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # You can control the set of applied configuration files using the 3 | # proguardFiles setting in build.gradle. 4 | # 5 | # For more details, see 6 | # http://developer.android.com/guide/developing/tools/proguard.html 7 | 8 | # If your project uses WebView with JS, uncomment the following 9 | # and specify the fully qualified class name to the JavaScript interface 10 | # class: 11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 12 | # public *; 13 | #} 14 | 15 | # Uncomment this to preserve the line number information for 16 | # debugging stack traces. 17 | #-keepattributes SourceFile,LineNumberTable 18 | 19 | # If you keep the line number information, uncomment this to 20 | # hide the original source file name. 21 | #-renamesourcefileattribute SourceFile 22 | -------------------------------------------------------------------------------- /.github/FUNDING.yml: -------------------------------------------------------------------------------- 1 | # These are supported funding model platforms 2 | 3 | github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2] 4 | patreon: # Replace with a single Patreon username 5 | open_collective: # Replace with a single Open Collective username 6 | ko_fi: # Replace with a single Ko-fi username 7 | tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel 8 | community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry 9 | liberapay: # Replace with a single Liberapay username 10 | issuehunt: # Replace with a single IssueHunt username 11 | otechie: # Replace with a single Otechie username 12 | custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'] 13 | custom: ['https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=8UH5MBVYM3J36', 'bc1qvll2mp5ndwd4sgycu4ad2ken4clhjac7mdlcaj'] 14 | -------------------------------------------------------------------------------- /app/src/androidTest/java/org/chickenhook/chickenbinder/MainActivityTest.kt: -------------------------------------------------------------------------------- 1 | package org.chickenhook.chickenbinder 2 | 3 | import androidx.test.espresso.Espresso.onView 4 | import androidx.test.espresso.action.ViewActions.click 5 | import androidx.test.espresso.matcher.ViewMatchers.withId 6 | import androidx.test.rule.ActivityTestRule 7 | import org.junit.Rule 8 | import org.junit.Test 9 | 10 | class MainActivityTest { 11 | 12 | @Rule 13 | @JvmField 14 | val activityTestRule = ActivityTestRule(MainActivityKotlin::class.java) 15 | 16 | @Test 17 | fun crashAndroidAPI29() { 18 | onView(withId(R.id.permissionTest)).perform(click()) 19 | } 20 | 21 | 22 | @Test 23 | fun harmFulAppWarning() { 24 | onView(withId(R.id.packageManagerTest)).perform(click()) 25 | } 26 | 27 | @Test 28 | fun windowManagerTest() { 29 | onView(withId(R.id.windowManagerTest)).perform(click()) 30 | } 31 | } -------------------------------------------------------------------------------- /app/src/main/AndroidManifest.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | 5 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | -------------------------------------------------------------------------------- /binderhooks/src/main/java/org/chickenhook/binderhooks/ProxyHook.java: -------------------------------------------------------------------------------- 1 | package org.chickenhook.binderhooks; 2 | 3 | import android.content.Context; 4 | 5 | import androidx.annotation.NonNull; 6 | import androidx.annotation.Nullable; 7 | 8 | import org.chickenhook.binderhooks.proxyListeners.ProxyListener; 9 | 10 | import java.lang.reflect.Field; 11 | import java.lang.reflect.Proxy; 12 | 13 | import static org.chickenhook.binderhooks.Logger.log; 14 | 15 | public class ProxyHook { 16 | 17 | public static boolean addHook(@Nullable Object host, @NonNull Field field, @NonNull Class type, @NonNull ProxyListener proxyListener) throws IllegalAccessException { 18 | proxyListener.setObject(field.get(host)); 19 | Object proxy = Proxy.newProxyInstance(Context.class.getClassLoader(), new Class[]{type}, proxyListener); 20 | try { 21 | field.set(host, proxy); 22 | log("ProxyHook [-] successfully added hook for <" + type + ">"); 23 | return true; 24 | } catch (IllegalAccessException e) { 25 | log("ProxyHook [-] error while place proxy hook", e); 26 | return false; 27 | } 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /gradle.properties: -------------------------------------------------------------------------------- 1 | # Project-wide Gradle settings. 2 | # IDE (e.g. Android Studio) users: 3 | # Gradle settings configured through the IDE *will override* 4 | # any settings specified in this file. 5 | # For more details on how to configure your build environment visit 6 | # http://www.gradle.org/docs/current/userguide/build_environment.html 7 | # Specifies the JVM arguments used for the daemon process. 8 | # The setting is particularly useful for tweaking memory settings. 9 | org.gradle.jvmargs=-Xmx1536m 10 | # When configured, Gradle will run in incubating parallel mode. 11 | # This option should only be used with decoupled projects. More details, visit 12 | # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects 13 | # org.gradle.parallel=true 14 | # AndroidX package structure to make it clearer which packages are bundled with the 15 | # Android operating system, and which are packaged with your app's APK 16 | # https://developer.android.com/topic/libraries/support-library/androidx-rn 17 | android.useAndroidX=true 18 | # Automatically convert third-party libraries to use AndroidX 19 | android.enableJetifier=true 20 | # Kotlin code style for this project: "official" or "obsolete": 21 | kotlin.code.style=official 22 | -------------------------------------------------------------------------------- /app/src/main/res/layout/activity_main.xml: -------------------------------------------------------------------------------- 1 | 2 | 8 | 9 | 10 |