用到的工具：
1、ddms（monitor）在androidsdk-tool目录下，monitor.bat
2、jadx（我的版本是1.4.7）
3、android studio （我用的火烈鸟）
4、雷电模拟器（lsp+magisk） 接下来进入正题
1、准备工作
1.1、打开某书与小助手的对话页面，并且输入文字。（注意，这里不要发送，因为我们要监听发送之后的堆栈信息）
1.2、打开ddms，且找到相关进程。
微信图片_20230530192131.png (180.61 KB, 下载次数: 0)
下载附件
2023-5-30 19:57 上传
Ddms
ddms1.png (366.06 KB, 下载次数: 0)
下载附件
2023-5-30 19:57 上传
2、开始跟踪堆栈
2.1在ddms中选择相应的进程，并点击开始。
图片2.png (149.41 KB, 下载次数: 0)
下载附件
2023-5-30 19:57 上传
1是进程，2 是开始。然后会出现提示
图片3.png (122.31 KB, 下载次数: 0)
下载附件
2023-5-30 19:57 上传
点击ok即可。 然后点击发送。
图片4.png (100.35 KB, 下载次数: 0)
下载附件
2023-5-30 19:57 上传
然后点击停止（
[color=]其实还是之前的开始
）
图片5.png (87.38 KB, 下载次数: 0)
下载附件
2023-5-30 19:57 上传
然后你的ddms会出现一个新的堆栈页面
图片6.png (439.25 KB, 下载次数: 0)
下载附件
2023-5-30 19:57 上传
既然我们的入手点是数据库方面，有了堆栈信息，插入数据库的关键词为：insert或者add，不排除会有混淆或者别的，这里根据开发习惯先尝试搜索使用这两个。 Insert经过排查，只有系统的api和一个已经插入完毕的方法。先排除
图片7.png (282.59 KB, 下载次数: 0)
下载附件
2023-5-30 19:57 上传
接下来找add关键词
图片8.png (287.61 KB, 下载次数: 0)
下载附件
2023-5-30 19:57 上传
根据类名翻译为：BasePageStore翻译为：基本页存储 存储就比较敏感了，尝试代码hook，
XposedBridge.hookAllMethods(findClz("com.ss.android.lark.chatbase.BasePageStore$1"), "add", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
log("addMsg--->"+new Gson().toJson(param.args));
}
});
我得到的日志是：
[Asm] 纯文本查看 复制代码2023-05-30 19:38:54.436 8548-9940 com.xingyi...ayBookHook com.ss.android.lark E addMsg--->[{"isForceUpdate":false,"lastReplyInThreadTime":0,"mMessage":{"atBotIds":[],"badgeCount":0,"burnLife":-1,"burnTime":0,"cId":"2720269e-5fab-44fd-9974-e4924cf8934a","channel":{"id":"7231144029272997892","type":"CHAT"},"characterLength":0,"chatDisplayModeSetting":"DEFAULT","chatId":"7231144029272997892","contentVersion":0,"createTime":1685446734,"createTimeInMills":0,"editInfo":{"baseEditVersion":0,"currentEditVersion":0,"editDraftId":"","editStatus":"None","lastEditTime":0,"msgType":"UNKNOWN","richText":{"anchorIds":[],"atIds":[],"elementIds":[],"elements":{"dictionary":{}},"hasParsed":false,"imageIds":[],"innerText":"","mediaIds":[],"richTextVersion":0},"title":""},"fileDeletedStatus":"NORMAL","foldId":"","fromId":"7231143971932635138","fromType":"USER","id":"2720269e-5fab-44fd-9974-e4924cf8934a","isAtAll":false,"isAtMe":false,"isAutoTranslatedForReceiver":false,"isBadged":false,"isBurned":false,"isCleaned":false,"isCryptoIntermediate":false,"isDeCryptFailed":false,"isDing":false,"isEphemeral":false,"isFlag":false,"isForwardFromFriend":false,"isFromMe":true,"isIncludeDocUrl":false,"isNoTraceDelete":false,"isNotified":false,"isOnTimeDel":false,"isOtherAtMe":false,"isReEditable":false,"isRemoved":false,"isRestricted":false,"isSecretChatDecryptedFailed":false,"isShared":false,"isSourceFileDelete":false,"isStaticResourceMessageRecalled":false,"isSyncMsgDep":false,"isTranslatedManually":false,"isUntranslatable":false,"isVisible":true,"mMeReadType":0,"messageContent":{"previewHangPoints":{},"richText":{"anchorIds":[],"atIds":[],"elementIds":["2"],"elements":{"dictionary":{"0":{"childIds":[],"property":{"content":"你会做什么呢？","numberOfLines":0},"style":{},"tag":"TEXT"},"2":{"childIds":["0"],"property":{"isNeedEnter":true},"style":{},"tag":"PARAGRAPH"}}},"hasParsed":true,"imageIds":[],"innerText":"你会做什么呢？","mediaIds":[],"richTextVersion":1},"textInMemory":"你会做什么呢？"},"originBadgeCount":0,"originalSenderId":"","parentId":"","position":26,"readAtChatterIds":[],"readCount":0,"replyCount":0,"rootId":"","sendStatus":"SENDING","setGrey":false,"threadBadgeCount":0,"threadPosition":0,"translateDisplayRule":0,"type":"TEXT","unReadCount":0,"updateTime":1685446734},"mMessageSender":{"chatId":"7231144029272997892","chatter":{"acceptSmsPhoneUrgent":true,"accessInfo":{"phoneCallAccessProfile":{"inaccessibleCode":"DEFAULT","isAccessible":true},"urgentAccessProfile":{"inaccessibleCode":"DEFAULT","isAccessible":true},"videoCallAccessProfile":{"inaccessibleCode":"DEFAULT","isAccessible":true},"voiceCallAccessProfile":{"inaccessibleCode":"DEFAULT","isAccessible":true}},"alias":"","anotherName":"","another_name":"","avatarKey":"v2_1470d43c-9932-44db-98ea-84e051a5afeg","avatarMedal":{"key":"","name":"","showSwitch":false},"avatarUrls":[],"canJoinGroup":false,"creatorId":"","customStatus":[],"description":{"description":"","type":"DEFAULT"},"enName":"yang","fullDepartmentName":"","id":"7231143971932635138","inContacts":false,"isAnonymous":false,"isCollaboration":false,"isCrossTenant":false,"isDefaultAvatar":true,"isFrozen":false,"isRegistered":true,"isSpecialFocus":false,"localizedName":"yang","name":"yang","namePinyin":"yang","namePy":"yang","nameWithAnotherName":"yang","openAppId":"","profileEnable":true,"status":0,"tagData":{"tagDataItems":[]},"tenantId":"7231143769122717724","thumbnails":[],"timeZone":{"timeZoneId":"Asia/Shanghai"},"type":"USER","updateTime":1683631922,"weight":0,"withBotTag":"bot","zenModeEndTime":0},"isOutChatUser":false,"nickName":"","onCallRole":3,"tagInfos":[],"acceptSmsPhoneUrgent":false,"canJoinGroup":false,"description":{"description":"","type":"DEFAULT"},"inContacts":false,"isAnonymous":false,"isCollaboration":false,"isCrossTenant":false,"isDefaultAvatar":false,"isFrozen":false,"isRegistered":false,"isSpecialFocus":false,"profileEnable":false,"status":0,"tagData":{"tagDataItems":[]},"updateTime":0,"weight":0,"zenModeEndTime":0},"mNeedToAutoTranslate":true,"replyInThreadCount":0}]
2023-05-30 19:38:54.445 8548-9940 com.xingyi...ayBookHook com.ss.android.lark E addMsg--->[{"isForceUpdate":false,"lastReplyInThreadTime":0,"mMessage":{"atBotIds":[],"badgeCount":0,"burnLife":-1,"burnTime":0,"cId":"2720269e-5fab-44fd-9974-e4924cf8934a","channel":{"id":"7231144029272997892","type":"CHAT"},"characterLength":0,"chatDisplayModeSetting":"DEFAULT","chatId":"7231144029272997892","contentVersion":0,"createTime":1685446734,"createTimeInMills":0,"editInfo":{"baseEditVersion":0,"currentEditVersion":0,"editDraftId":"","editStatus":"None","lastEditTime":0,"msgType":"UNKNOWN","richText":{"anchorIds":[],"atIds":[],"elementIds":[],"elements":{"dictionary":{}},"hasParsed":false,"imageIds":[],"innerText":"","mediaIds":[],"richTextVersion":0},"title":""},"fileDeletedStatus":"NORMAL","foldId":"","fromId":"7231143971932635138","fromType":"USER","id":"2720269e-5fab-44fd-9974-e4924cf8934a","isAtAll":false,"isAtMe":false,"isAutoTranslatedForReceiver":false,"isBadged":false,"isBurned":false,"isCleaned":false,"isCryptoIntermediate":false,"isDeCryptFailed":false,"isDing":false,"isEphemeral":false,"isFlag":false,"isForwardFromFriend":false,"isFromMe":true,"isIncludeDocUrl":false,"isNoTraceDelete":false,"isNotified":false,"isOnTimeDel":false,"isOtherAtMe":false,"isReEditable":false,"isRemoved":false,"isRestricted":false,"isSecretChatDecryptedFailed":false,"isShared":false,"isSourceFileDelete":false,"isStaticResourceMessageRecalled":false,"isSyncMsgDep":false,"isTranslatedManually":false,"isUntranslatable":false,"isVisible":true,"mMeReadType":0,"messageContent":{"previewHangPoints":{},"richText":{"anchorIds":[],"atIds":[],"elementIds":["2"],"elements":{"dictionary":{"0":{"childIds":[],"property":{"content":"你会做什么呢？","numberOfLines":0},"style":{},"tag":"TEXT"},"2":{"childIds":["0"],"property":{"isNeedEnter":true},"style":{},"tag":"PARAGRAPH"}}},"hasParsed":true,"imageIds":[],"innerText":"你会做什么呢？","mediaIds":[],"richTextVersion":1},"textInMemory":"你会做什么呢？"},"originBadgeCount":0,"originalSenderId":"","parentId":"","position":26,"readAtChatterIds":[],"readCount":0,"replyCount":0,"rootId":"","sendStatus":"SENDING","setGrey":false,"threadBadgeCount":0,"threadPosition":0,"translateDisplayRule":0,"type":"TEXT","unReadCount":0,"updateTime":1685446734},"mMessageSender":{"chatId":"7231144029272997892","chatter":{"acceptSmsPhoneUrgent":true,"accessInfo":{"phoneCallAccessProfile":{"inaccessibleCode":"DEFAULT","isAccessible":true},"urgentAccessProfile":{"inaccessibleCode":"DEFAULT","isAccessible":true},"videoCallAccessProfile":{"inaccessibleCode":"DEFAULT","isAccessible":true},"voiceCallAccessProfile":{"inaccessibleCode":"DEFAULT","isAccessible":true}},"alias":"","anotherName":"","another_name":"","avatarKey":"v2_1470d43c-9932-44db-98ea-84e051a5afeg","avatarMedal":{"key":"","name":"","showSwitch":false},"avatarUrls":[],"canJoinGroup":false,"creatorId":"","customStatus":[],"description":{"description":"","type":"DEFAULT"},"enName":"yang","fullDepartmentName":"","id":"7231143971932635138","inContacts":false,"isAnonymous":false,"isCollaboration":false,"isCrossTenant":false,"isDefaultAvatar":true,"isFrozen":false,"isRegistered":true,"isSpecialFocus":false,"localizedName":"yang","name":"yang","namePinyin":"yang","namePy":"yang","nameWithAnotherName":"yang","openAppId":"","profileEnable":true,"status":0,"tagData":{"tagDataItems":[]},"tenantId":"7231143769122717724","thumbnails":[],"timeZone":{"timeZoneId":"Asia/Shanghai"},"type":"USER","updateTime":1683631922,"weight":0,"withBotTag":"bot","zenModeEndTime":0},"isOutChatUser":false,"nickName":"","onCallRole":3,"tagInfos":[],"acceptSmsPhoneUrgent":false,"canJoinGroup":false,"description":{"description":"","type":"DEFAULT"},"inContacts":false,"isAnonymous":false,"isCollaboration":false,"isCrossTenant":false,"isDefaultAvatar":false,"isFrozen":false,"isRegistered":false,"isSpecialFocus":false,"profileEnable":false,"status":0,"tagData":{"tagDataItems":[]},"updateTime":0,"weight":0,"zenModeEndTime":0},"mNeedToAutoTranslate":true,"replyInThreadCount":0}]
2023-05-30 19:38:56.716 8548-9940 com.xingyi...ayBookHook com.ss.android.lark E addMsg--->[{"isForceUpdate":false,"lastReplyInThreadTime":0,"mMessage":{"atBotIds":[],"badgeCount":29,"burnLife":0,"burnTime":0,"cId":"00f6cd1f-82b4-41d4-a233-26e0decfeb6c","channel":{"id":"7231144029272997892","type":"CHAT"},"characterLength":0,"chatDisplayModeSetting":"UNKNOWN","chatId":"7231144029272997892","contentVersion":0,"createTime":1685446736,"createTimeInMills":1685446736667,"cryptoToken":"","disabledAction":{},"dlpState":"INACTIVE","editInfo":{"baseEditVersion":0,"currentEditVersion":0,"editDraftId":"","editStatus":"None","lastEditTime":0,"msgType":"UNKNOWN","richText":{"anchorIds":[],"atIds":[],"elementIds":[],"elements":{"dictionary":{}},"hasParsed":false,"imageIds":[],"innerText":"","mediaIds":[],"richTextVersion":0},"title":""},"fileDeletedStatus":"NORMAL","foldId":"","fromChatterTenantId":"1","fromId":"6626260912531570952","id":"7238938612736245764","imageTranslationAbility":{},"isAtAll":false,"isAtMe":false,"isAutoTranslatedForReceiver":false,"isBadged":true,"isBurned":false,"isCleaned":false,"isCryptoIntermediate":false,"isDeCryptFailed":false,"isDing":false,"isEphemeral":false,"isFlag":false,"isForwardFromFriend":false,"isFromMe":false,"isIncludeDocUrl":false,"isNoTraceDelete":false,"isNotified":true,"isOnTimeDel":false,"isOtherAtMe":false,"isReEditable":false,"isRemoved":false,"isRestricted":false,"isSecretChatDecryptedFailed":false,"isShared":false,"isSourceFileDelete":false,"isStaticResourceMessageRecalled":false,"isSyncMsgDep":false,"isTranslatedManually":false,"isUntranslatable":false,"isVisible":true,"mMeReadType":0,"messageContent":{"actionSelectValue":{},"actions":{},"cardVersion":2,"contentVersion":0,"enableForward":false,"extraInfo":{"analyticsData":"","enableTranslate":false,"gadgetAppIds":[],"isGadgetPreload":false,"isMeegoPreload":false,"parseDuration":1,"parseTraceId":"1-s14fgski-7cerm0vj-7pepje7i","parseUUID":"a71da020-394d-4c6f-8470-a6aadf793244"},"extraType":"UNKNOWN","isForward":false,"richText":{"anchorIds":[],"atIds":[],"docsIds":[],"elementIds":["4"],"elements":{"dictionary":{"1":{"childIds":[],"property":{"content":"我没有找到相关答案，此服务台不提供人工服务，试试重新输入问题吧","i18nKey":"","numberOfLines":10},"style":{"fontSize":"14","textAlign":"left","fontWeight":"bold"},"styleKeys":["txt_bold","block_div_txt","text_align_left"],"tag":"TEXT"},"2":{"childIds":["1"],"property":{"isNeedEnter":true},"style":{"textAlign":"left","justifyContent":"flexStart"},"styleKeys":["block_div_txt_p","block_text_align_left"],"tag":"PARAGRAPH"},"3":{"childIds":["2"],"property":{"isNeedEnter":true},"style":{"width":"100%","flexGrow":"1","flexShrink":"1"},"styleKeys":["block_div_left_p"],"tag":"PARAGRAPH"},"4":{"childIds":["3"],"property":{"isNeedEnter":true},"style":{"alignItems":"flexStart","flexWrap":"noWrap","flexDirection":"row","width":"100%","paddingTop":"0","marginTop":"0"},"styleKeys":["block_div_h_p","block_first_p"],"tag":"PARAGRAPH"}}},"hasParsed":false,"imageIds":[],"innerText":"","mediaIds":[],"richTextVersion":0,"urls":[]},"type":"TEXT"},"messageLanguage":"zh","originBadgeCount":29,"originalSenderId":"","parentId":"","parentSourceId":"","position":28,"postDraftId":"","readAtChatterIds":[],"readCount":0,"recallerId":"","recallerIdentity":"UNKNOWN_IDENTITY","replyCount":0,"replyInThreadDraftId":"","rootId":"","scheduleDraftId":"","sendStatus":"SUCCESS","setGrey":false,"sourceId":"","sourceType":"TYPE_FROM_UNKONWN","status":"NORMAL","textDraftId":"","threadBadgeCount":0,"threadId":"","threadMessageType":"UNKNOWN_THREAD_MESSAGE","threadPosition":0,"translateDisplayRule":1,"translateLanguage":"","type":"CARD","unReadCount":0,"updateTime":1685446736},"mMessageSender":{"chatId":"7231144029272997892","chatter":{"acceptSmsPhoneUrgent":false,"accessInfo":{},"alias":"","anotherName":"","another_name":"","avatarKey":"b2c152c1-40ff-44e6-a16e-ce0bc911021g","avatarMedal":{"key":"","name":"","showSwitch":false},"avatarUrls":["http://p0.pstatp.com/origin/b2c152c1-40ff-44e6-a16e-ce0bc911021g"],"can
2023-05-30 19:38:56.723 8548-9940 com.xingyi...ayBookHook com.ss.android.lark E addMsg--->[{"isForceUpdate":false,"lastReplyInThreadTime":0,"mMessage":{"atBotIds":[],"badgeCount":29,"burnLife":0,"burnTime":0,"cId":"00f6cd1f-82b4-41d4-a233-26e0decfeb6c","channel":{"id":"7231144029272997892","type":"CHAT"},"characterLength":0,"chatDisplayModeSetting":"UNKNOWN","chatId":"7231144029272997892","contentVersion":0,"createTime":1685446736,"createTimeInMills":1685446736667,"cryptoToken":"","disabledAction":{},"dlpState":"INACTIVE","editInfo":{"baseEditVersion":0,"currentEditVersion":0,"editDraftId":"","editStatus":"None","lastEditTime":0,"msgType":"UNKNOWN","richText":{"anchorIds":[],"atIds":[],"elementIds":[],"elements":{"dictionary":{}},"hasParsed":false,"imageIds":[],"innerText":"","mediaIds":[],"richTextVersion":0},"title":""},"fileDeletedStatus":"NORMAL","foldId":"","fromChatterTenantId":"1","fromId":"6626260912531570952","id":"7238938612736245764","imageTranslationAbility":{},"isAtAll":false,"isAtMe":false,"isAutoTranslatedForReceiver":false,"isBadged":true,"isBurned":false,"isCleaned":false,"isCryptoIntermediate":false,"isDeCryptFailed":false,"isDing":false,"isEphemeral":false,"isFlag":false,"isForwardFromFriend":false,"isFromMe":false,"isIncludeDocUrl":false,"isNoTraceDelete":false,"isNotified":true,"isOnTimeDel":false,"isOtherAtMe":false,"isReEditable":false,"isRemoved":false,"isRestricted":false,"isSecretChatDecryptedFailed":false,"isShared":false,"isSourceFileDelete":false,"isStaticResourceMessageRecalled":false,"isSyncMsgDep":false,"isTranslatedManually":false,"isUntranslatable":false,"isVisible":true,"mMeReadType":0,"messageContent":{"actionSelectValue":{},"actions":{},"cardVersion":2,"contentVersion":0,"enableForward":false,"extraInfo":{"analyticsData":"","enableTranslate":false,"gadgetAppIds":[],"isGadgetPreload":false,"isMeegoPreload":false,"parseDuration":1,"parseTraceId":"1-s14fgski-7cerm0vj-7pepje7i","parseUUID":"a71da020-394d-4c6f-8470-a6aadf793244"},"extraType":"UNKNOWN","isForward":false,"richText":{"anchorIds":[],"atIds":[],"docsIds":[],"elementIds":["4"],"elements":{"dictionary":{"1":{"childIds":[],"property":{"content":"我没有找到相关答案，此服务台不提供人工服务，试试重新输入问题吧","i18nKey":"","numberOfLines":10},"style":{"fontSize":"14","textAlign":"left","fontWeight":"bold"},"styleKeys":["txt_bold","block_div_txt","text_align_left"],"tag":"TEXT"},"2":{"childIds":["1"],"property":{"isNeedEnter":true},"style":{"textAlign":"left","justifyContent":"flexStart"},"styleKeys":["block_div_txt_p","block_text_align_left"],"tag":"PARAGRAPH"},"3":{"childIds":["2"],"property":{"isNeedEnter":true},"style":{"width":"100%","flexGrow":"1","flexShrink":"1"},"styleKeys":["block_div_left_p"],"tag":"PARAGRAPH"},"4":{"childIds":["3"],"property":{"isNeedEnter":true},"style":{"alignItems":"flexStart","flexWrap":"noWrap","flexDirection":"row","width":"100%","paddingTop":"0","marginTop":"0"},"styleKeys":["block_div_h_p","block_first_p"],"tag":"PARAGRAPH"}}},"hasParsed":false,"imageIds":[],"innerText":"","mediaIds":[],"richTextVersion":0,"urls":[]},"type":"TEXT"},"messageLanguage":"zh","originBadgeCount":29,"originalSenderId":"","parentId":"","parentSourceId":"","position":28,"postDraftId":"","readAtChatterIds":[],"readCount":0,"recallerId":"","recallerIdentity":"UNKNOWN_IDENTITY","replyCount":0,"replyInThreadDraftId":"","rootId":"","scheduleDraftId":"","sendStatus":"SUCCESS","setGrey":false,"sourceId":"","sourceType":"TYPE_FROM_UNKONWN","status":"NORMAL","textDraftId":"","threadBadgeCount":0,"threadId":"","threadMessageType":"UNKNOWN_THREAD_MESSAGE","threadPosition":0,"translateDisplayRule":1,"translateLanguage":"","type":"CARD","unReadCount":0,"updateTime":1685446736},"mMessageSender":{"chatId":"7231144029272997892","chatter":{"acceptSmsPhoneUrgent":false,"accessInfo":{},"alias":"","anotherName":"","another_name":"","avatarKey":"b2c152c1-40ff-44e6-a16e-ce0bc911021g","avatarMedal":{"key":"","name":"","showSwitch":false},"avatarUrls":["http://p0.pstatp.com/origin/b2c152c1-40ff-44e6-a16e-ce0bc911021g"],"can
还是很顺利的- -打印了两次，分析堆栈信息是因为方法重载。这样以来便找到了关键函数位置。
3、遇到的问题
中间想通过阅读代码看看实现，并没有找到【com.ss.android.lark.chatbase.BasePageStore】且代码中有大量的代{过}{滤}理使用。类似：
public final ListT> j() {
PatchProxyResult proxy = PatchProxy.proxy(new Object[0], this, c, false, 144515);
if (proxy.isSupported) {
return (List) proxy.result;
}
this.d.acquireReadAccess();
ArrayList arrayList = new ArrayList(this.d);
this.d.releaseReadAccess();
return arrayList;
}
public boolean k() {
PatchProxyResult proxy = PatchProxy.proxy(new Object[0], this, c, false, 144501);
if (proxy.isSupported) {
return ((Boolean) proxy.result).booleanValue();
}
p();
return this.d.size() == 0;
}
public com.ss.android.lark.chatbase.dcom.ss.android.lark.chat.entity.message.a> n() {
PatchProxyResult proxy = PatchProxy.proxy(new Object[0], this, c, false, 144504);
if (proxy.isSupported) {
return (com.ss.android.lark.chatbase.d) proxy.result;
}
return new com.ss.android.lark.chatbase.c(this, this.k);
}
通过关键词定位确定其为热修复，但是我尝试blackdex脱壳并没有拿到最终代码。
我想应该要通过读内存了。 有兴趣的话自行尝试一下。
