Android擷取系統隱藏服務實現鎖屏

 

實現原理：當按鎖屏鍵時，會發出一個廣播，當介面接收到一個廣播就可以實現鎖頻。我們可以調用IDevicePolicyManager服務中的lockNow方法來發送一個廣播實現鎖屏。

 

IDevicePolicyManager是被系統隱藏掉的，需要通過反射還擷取此服務。

 

 步驟：

 

1.建立MyAdmin的廣播接收者繼承DeviceAdminReceiver

 

2.通過反射,擷取IDevicePolicyManager服務 ，IDevicePolicyManager通過AIDL來擷取出來。

 

3.註冊廣播接收者為admin裝置

 

4.擷取服務中的方法

 

：

 

   

 

    

 

 

註冊MyAdmin廣播接收者：

 

 

<receiver android:name=".MyAdmin"> 

    <meta-data android:name="android.app.device_admin" 

        android:resource="@xml/my_admin" /> 

    <intent-filter> 

        <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" /> 

    </intent-filter> 

</receiver> 

 

my_admin.xml：

 

 

<?xml version="1.0" encoding="utf-8"?> 

<device-admin xmlns:android="http://schemas.android.com/apk/res/android"> 

        <uses-policies> 

                <limit-password /> 

                <watch-login /> 

                <reset-password /> 

                <force-lock /> 

                <wipe-data /> 

        </uses-policies> 

</device-admin> 

反射擷取服務、註冊許可權、實現鎖屏：

 

 

public class LockActivity extends Activity { 

    IDevicePolicyManager mService; 

    @Override 

    public void onCreate(Bundle savedInstanceState) { 

        super.onCreate(savedInstanceState); 

        setContentView(R.layout.main); 

    } 

    //鎖屏  

    public void lock(View view){ 

        try { 

            //通過反射擷取到sdk隱藏的服務  

            Method method = Class.forName("android.os.ServiceManager") 

                    .getMethod("getService", String.class); 

            IBinder binder = (IBinder) method.invoke(null,//啟用服務 

                    new Object[] { Context.DEVICE_POLICY_SERVICE }); 

             mService = IDevicePolicyManager.Stub.asInterface(binder); 

              

             //定義組件的名字  

             ComponentName mAdminName = new ComponentName(this, MyAdmin.class); 

             

             //註冊許可權 

             if (mService != null) { 

                    //判斷自訂的廣播接受者 是不是被註冊成deviceadmin的許可權  

                    if (!mService.isAdminActive(mAdminName)) { 

                                Intent intent = new Intent( 

                                DevicePolicyManager.ACTION_ADD_DEVICE_ADMIN); 

                                intent.putExtra(DevicePolicyManager.EXTRA_DEVICE_ADMIN, 

                                        mAdminName); 

                                startActivity(intent); 

                            } 

                    //調用服務實現鎖屏  

                    mService.lockNow(); 

                    //設定解鎖密碼 

                    mService.resetPassword("123", 0); 

             } 

        } catch (Exception e) { 

            e.printStackTrace(); 

        }  

    } 

} 

 

AIDL:

 

 

/*

**

** Copyright 2010, The Android Open Source Project

**

** Licensed under the Apache License, Version 2.0 (the "License");

** you may not use this file except in compliance with the License.

** You may obtain a copy of the License at

**

**     http://www.apache.org/licenses/LICENSE-2.0

**

** Unless required by applicable law or agreed to in writing, software

** distributed under the License is distributed on an "AS IS" BASIS,

** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

** See the License for the specific language governing permissions and

** limitations under the License.

*/ 

 

package android.app.admin; 

 

import android.content.ComponentName; 

/**

 * Internal IPC interface to the device policy service.

 * {@hide}

 */ 

interface IDevicePolicyManager { 

    void setPasswordQuality(in ComponentName who, int quality); 

    int getPasswordQuality(in ComponentName who); 

     

    void setPasswordMinimumLength(in ComponentName who, int length); 

    int getPasswordMinimumLength(in ComponentName who); 

     

    boolean isActivePasswordSufficient(); 

    int getCurrentFailedPasswordAttempts(); 

     

    void setMaximumFailedPasswordsForWipe(in ComponentName admin, int num); 

    int getMaximumFailedPasswordsForWipe(in ComponentName admin); 

     

    boolean resetPassword(String password, int flags); 

     

    void setMaximumTimeToLock(in ComponentName who, long timeMs); 

    long getMaximumTimeToLock(in ComponentName who); 

     

    void lockNow(); 

     

    void wipeData(int flags); 

     

    void setActiveAdmin(in ComponentName policyReceiver); 

    boolean isAdminActive(in ComponentName policyReceiver); 

    List<ComponentName> getActiveAdmins(); 

    boolean packageHasActiveAdmins(String packageName); 

    void removeActiveAdmin(in ComponentName policyReceiver); 

     

    void setActivePasswordState(int quality, int length); 

    void reportFailedPasswordAttempt(); 

    void reportSuccessfulPasswordAttempt(); 

} 

摘自：傅榮康專欄