SwiftBackup快捷方式

SwiftBackup快捷方式

image-20230529141333572

hook_intent.js:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
Java.perform(function () {
   var act = Java.use("android.app.Activity");
   act.getIntent.overload().implementation = function () {
     var intent = this.getIntent()
     var cp = intent.getComponent()
     console.log("Starting " + cp.getPackageName() + "/" + cp.getClassName())
     var ext = intent.getExtras();

     console.log(intent)
     if (ext) {
       console.log(ext)
       var keys = ext.keySet()
       var iterator = keys.iterator()
       while (iterator.hasNext()) {
         var k = iterator.next().toString()
         var v = ext.get(k)
         console.log("\t" + v.getClass().getName())
         console.log("\t" + k + ' : ' + v.toString())
       }
     }
   return intent;
   };
})#

hook intent相关函数，发现从快捷方式打开时的数据为:

1
2
3
4
5
Starting org.swiftapps.swiftbackup/org.swiftapps.swiftbackup.detail.DetailActivity
Intent { flg=0x10000000 pkg=com.jingdong.app.mall cmp=org.swiftapps.swiftbackup/.detail.DetailActivity (has extras) }
Bundle[{detail_launched_from_shortcut=true}]
        java.lang.Boolean
        detail_launched_from_shortcut : true

创建快捷方式的相关代码：

image-20230529141506888

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
public final void invoke() {
    Intent intent0 = new Intent(this.b.H(), IntroActivity.class).setAction("android.intent.action.MAIN").putExtra("detail_launched_from_shortcut", true).setPackage(this.c.getPackageName());
    androidx.core.content.pm.b.a b$a0 = new androidx.core.content.pm.b.a(this.b.H(), this.c.getPackageName()).c(intent0);
    IconCompat iconCompat0 = IconCompat.g(this.d);
    ShortcutPinnedReceiver shortcutPinnedReceiver0 = new ShortcutPinnedReceiver();
    this.b.M = shortcutPinnedReceiver0;
    BroadcastReceiver broadcastReceiver0 = this.b.M;
    IntentFilter intentFilter0 = new IntentFilter();
    Const.a.f0(broadcastReceiver0, intentFilter0);
    Intent intent1 = new Intent(this.b.getApplicationContext(), ShortcutPinnedReceiver.class).putExtra("APP_PARCEL", this.c);
    PendingIntent pendingIntent0 = PendingIntent.getBroadcast(this.b.getApplicationContext(), 0, intent1, 0x4000000);
    n n0 = this.b.H();
    IntentSender intentSender0 = pendingIntent0.getIntentSender();
    androidx.core.content.pm.c.b(n0, b$a0.e("SB (" + this.c.getName() + ')').b(iconCompat0).a(), intentSender0);
}

如何使用am start模拟这个行为，快捷地进入任意app的SwiftBackup备份界面？

尝试执行am start -a android.intent.action.MAIN -n org.swiftapps.swiftbackup/.detail.DetailActivity --ez detail_launched_from_shortcut true

hook到的数据如下：

1
2
3
4
5
Starting org.swiftapps.swiftbackup/org.swiftapps.swiftbackup.detail.DetailActivity
Intent { act=android.intent.action.MAIN flg=0x10000000 cmp=org.swiftapps.swiftbackup/.detail.DetailActivity (has extras) }
Bundle[{detail_launched_from_shortcut=true}]
        java.lang.Boolean
        detail_launched_from_shortcut : true

与从桌面快捷方式的数据对比，缺少了pkg=com.jingdong.app.mall

查阅adb，am文档，发现pkg参数可以手动传入。

https://developer.android.com/tools/adb

image-20230529142742875

image-20230529142859514

You can directly specify a URI, package name, and component name when not qualified by one of the preceding options. When an argument is unqualified, the tool assumes the argument is a URI if it contains a “:” (colon). The tools assumes the argument is a component name if it contains a “/“ (forward-slash); otherwise it assumes the argument is a package name.

当未被上述选项之一限定时，您可以直接指定 URI、包名称和组件名称。 当参数不合格时，如果参数包含“:”（冒号），则该工具会假定该参数是一个 URI。 如果参数包含“/”（正斜杠），则工具假定参数是组件名称； 否则它假定参数是一个包名。

最终打开京东App的备份页面的命令为：

1
2
3
4
# 二选一，IntroActivity更早启动
am start -a android.intent.action.MAIN -n org.swiftapps.swiftbackup/.detail.DetailActivity --ez detail_launched_from_shortcut true com.jingdong.app.mall

am start -a android.intent.action.MAIN -n org.swiftapps.swiftbackup/.intro.IntroActivity --ez detail_launched_from_shortcut true com.jingdong.app.mall