大佬们帮我看一下这段 xposed 代码有没有问题

[eyeshuaji]

   public class HookInit implements IXposedHookLoadPackage {

          @Override
          public void handleLoadPackage ( final XC_LoadPackage.LoadPackageParam lpparam ) throws Throwable {

                    XposedHelpers.findAndHookMethod ( "android.app.ContextImpl", lpparam.classLoader, "checkCallingOrSelfPermission", String.class, new XC_MethodReplacement ( ){

                                   @Override
                                   protected Object replaceHookedMethod ( XC_MethodHook.MethodHookParam p1 ) throws Throwable {
                                             int i=0;
                                             return i;
                                        }                                     
                              }                  
                    );

                    XposedHelpers.findAndHookMethod ( "android.app.Application", lpparam.classLoader, "attach", Context.class, new XC_MethodHook ( ){
                                   @Override
                                   protected void afterHookedMethod ( MethodHookParam param ) throws Throwable {
                                             Class <?>wmg=XposedHelpers.findClass ( "android.view.WindowManagerGlobal", lpparam.classLoader );
                                             final Object wm=XposedHelpers.callStaticMethod ( wmg, "getWindowManagerService" );
                                             Method setForcedDisplayDensityForUser=XposedHelpers.findMethodBestMatch ( wm.getClass ( ), "setForcedDisplayDensityForUser", int.class, int.class, int.class );
                                             setForcedDisplayDensityForUser.invoke ( wm, 160, Display.DEFAULT_DISPLAY, AndroidAppHelper.currentApplicationInfo ( ).uid );
                                        }
                              }
                    );
               }
     }

目的是想通过 WindowManagerGlobal 获取 WindowManagerService ，然后调用 setForcedDisplayDensityForUser 方法，因为这个方法会用 checkCallingOrSelfPermission 方法检查是否有权限，所以我修改了他的返回值为 0 。 setForcedDisplayDensityForUser 的源码：

 @Override
    public void setForcedDisplayDensityForUser(int displayId, int density, int userId) {
        if (mContext.checkCallingOrSelfPermission(
                android.Manifest.permission.WRITE_SECURE_SETTINGS) !=
                PackageManager.PERMISSION_GRANTED) {
            throw new SecurityException("Must hold permission " +
                    android.Manifest.permission.WRITE_SECURE_SETTINGS);

但这样修改后还是抛出异常"Must hold permission…" 大佬们有没有什么建议

[ssgooglg]

试试 gp_t

[ColoThor]

试试我的方法，在 initZygote 方法内添加代码
```language
AndroidActivityManagerHook.getInstance().start();
```

AndroidActivityManagerHook 类，把其中的 xxx.xxx.xxx.xxx,替换为实际的引用包名
```language
public class AndroidActivityManagerHook {
public static String TAG = AndroidActivityManagerHook.class.getSimpleName();

public static AndroidActivityManagerHook getInstance() {
return InstanceUtils.instance;
}

private AndroidActivityManagerHook() {

}

private static class InstanceUtils {
private static final AndroidActivityManagerHook instance = new AndroidActivityManagerHook();
}

public void start() {
hookActivityManager(null);
}

private void hookActivityManager(ClassLoader classLoader) {
try {
String activityManagerClassName = "android.app.ActivityManager";
Class activityManagerClass = XposedHelpers.findClassIfExists(activityManagerClassName, classLoader);
if (activityManagerClass != null) {
XposedBridge.hookAllMethods(activityManagerClass, "checkComponentPermission", new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
try {
String permission = (String) param.args[0];
if (TextUtils.isEmpty(permission)) {
return;
}

if (!Manifest.permission.WRITE_SECURE_SETTINGS.equals(permission)) {
return;
}

int uid = (int) param.args[1];
if (uid == 0) {
return;
}

Context context = AndroidAppHelper.currentApplication().getApplicationContext();
if (context == null) {
return;
}

String packageName = context.getPackageManager().getNameForUid(uid);
if ("xxx.xxx.xxx.xxx".equals(packageName)) {
param.setResult(PackageManager.PERMISSION_GRANTED);
Log.w(TAG, "access " + permission + " to " + packageName);
}
} catch (Exception e) {
e.printStackTrace();
Log.e(TAG, param.method.getName() + " error\n" + Log.getStackTraceString(e));
}
}
});
} else {
Log.e(TAG, "class not find: " + activityManagerClassName);
}
} catch (Exception e) {
Log.e(TAG, "hookActivityManager error:\n" + Log.getStackTraceString(e));
}
}
}
```

最后别忘了添加作用域 系统框架

[eyeshuaji]

@ColoThor 没有用啊老哥

[eyeshuaji]

@ssgooglg gpt 不懂怎么问才准确

[eyeshuaji]

来个大佬提点建议啊

[Nitsuya]

不知道你的需求是怎样的, 代码看上去是改默认屏幕的 dpi, 按理说应该注入 System Server. 孵化应用的时候, 判断包名, 修改全局 Dpi.

[eyeshuaji]

@Nitsuya 就是想修改 dpi ，咋注入 system server 啊大佬

[Nitsuya]

@eyeshuaji
1.如果你只想全局修改 开发者模式里面直接改.
2.如果你想 打开某应用触发影响全局 dpi, 注入域 [android] 系统框架, 然后去看 aosp 应用启动流程,卡在 call 应用前调用.
3.如果只想改某个 app 的 dpi, github 去找项目.
不知道你的需求是怎样的.

[Nitsuya]

针对你提出的问题, 我猜测你注入的是应用, 应用调用这类的 Api, 是 RPC 调用 system server 即 android(系统框架). 权限验证在 server 侧. 我想你可能大概不知道 域 跟 代码跑在哪个进程下的.

[eyeshuaji]

@Nitsuya #9 大佬能讲一下域和代码分别分别跑在哪个进程吗

[eyeshuaji]

@Nitsuya 大佬怎么不回我

[Nitsuya]

@eyeshuaji 因为双休. 代码作用域自己体会, 感觉不怎么好讲... 自己多学习多想一下...

[eyeshuaji]

@Nitsuya #12 意思就是说，权限验证在 android 框架里，只注入 app 是没用的，还要注入 android 系统框架里

[Nitsuya]

@eyeshuaji 是的, 因为应用调用系统 api 是 RPC 调用 android server api. 权限验证就在框架侧. 多理解下调用 api 的原理..