Reflection to modify other APP SharedPreferences data

Reflection to modify other APP SharedPreferences data

  • Prerequisites
  • Available codes

Prerequisite

The device is rooted, otherwise the data/data directory cannot be accessed

Problem symptoms:

HIE_Find(com.estrongs.android.pop) APP can directly open the usb storage device, but the usb device node name changes after each plug and unplug, and the last opened path will always be remembered when the app is opened again.

As a result, it is impossible to return to other directories normally. Through analysis, the last path is stored in SharedPreferences last_content_chooser_path

In fact, there is another way, but you can only use the adb command to jump

shell am start -n com.estrongs.android.pop/com.estrongs.android.pop.app.ESContentChooserActivity -d “file:///storage/emulated/0/DCIM/”

You can open the specified path and select the file. However, in higher versions, due to file permission mechanism issues, FileProvider must be used to construct the uri. However, HIE_Find is incompatible, so the jump cannot be successful.

So the feasible way is to directly modify last_content_chooser_path

Note: After modifying SharedPreferences, the corresponding app needs to be restarted before it can read the modified value.

Available codes

public void setLastContentChooserPath() {<!-- -->

        // /data/data/com.estrongs.android.pop/shared_prefs/com.estrongs.android.pop_preferences.xml
        // <string name="last_content_chooser_path">/storage/emulated/0/DCIM/</string>
\t\t
        String cmd1 = "chmod 777 /data/data/com.estrongs.android.pop/";
        String cmd2 = "chmod 777 /data/data/com.estrongs.android.pop/shared_prefs/";
        String cmd3 = "chmod 777 /data/data/com.estrongs.android.pop/shared_prefs/com.estrongs.android.pop_preferences.xml";
        String[] cmds = {<!-- -->cmd1, cmd2, cmd3};
        ShellUtils.CommandResult result = ShellUtils.execCmd(cmds, true);
        Log.i(TAG, "result======" + result.successMsg);

        try {<!-- -->
            File preffile = new File("/data/data/com.estrongs.android.pop/shared_prefs/com.estrongs.android.pop_preferences.xml");
            Class prefimplclass = Class.forName("android.app.SharedPreferencesImpl");
            Constructor prefimplconstructor = prefimplclass.getDeclaredConstructor(File.class, int.class);
            prefimplconstructor.setAccessible(true);
            SharedPreferences prefimpl = (SharedPreferences) prefimplconstructor.newInstance(preffile, Context.MODE_WORLD_READABLE
                    | Context.MODE_WORLD_WRITEABLE);
            String chooserPath = prefimpl.getString("last_content_chooser_path", "");
            Log.i(TAG, "chooserPath======" + chooserPath);
            SharedPreferences.Editor editor = (SharedPreferences.Editor) prefimplclass.getMethod("edit").invoke(prefimpl);
            editor.putString("last_content_chooser_path", "/storage/emulated/0/DCIM/");
            editor.commit();
            Log.i(TAG, "set last_content_chooser_path======");
        } catch (Exception e) {<!-- -->
            e.printStackTrace();
        }

    }

ShellUtils.java

public final class ShellUtils {<!-- -->

    private static final String LINE_SEP = System.getProperty("line.separator");

    private ShellUtils() {<!-- -->
        throw new UnsupportedOperationException("u can't instantiate me...");
    }
    /**
     * Execute the command.
     *
     * @param command The command.
     * @param isRooted True to use root, false otherwise.
     * @return the single {@link CommandResult} instance
     */
    public static CommandResult execCmd(final String command, final boolean isRooted) {<!-- -->
        return execCmd(new String[]{<!-- -->command}, isRooted, true);
    }
    /**
     * Execute the command.
     *
     * @param commands The commands.
     * @param isRooted True to use root, false otherwise.
     * @return the single {@link CommandResult} instance
     */
    public static CommandResult execCmd(final List<String> commands, final boolean isRooted) {<!-- -->
        return execCmd(commands == null ? null : commands.toArray(new String[]{<!-- -->}), isRooted, true);
    }

    /**
     * Execute the command.
     *
     * @param commands The commands.
     * @param isRooted True to use root, false otherwise.
     * @return the single {@link CommandResult} instance
     */
    public static CommandResult execCmd(final String[] commands, final boolean isRooted) {<!-- -->
        return execCmd(commands, isRooted, true);
    }

    /**
     * Execute the command.
     *
     * @param command The command.
     * @param isRooted True to use root, false otherwise.
     * @param isNeedResultMsg True to return the message of result, false otherwise.
     * @return the single {@link CommandResult} instance
     */
    public static CommandResult execCmd(final String command,
                                        final boolean isRooted,
                                        final boolean isNeedResultMsg) {<!-- -->
        return execCmd(new String[]{<!-- -->command}, isRooted, isNeedResultMsg);
    }

    /**
     * Execute the command.
     *
     * @param commands The commands.
     * @param isRooted True to use root, false otherwise.
     * @param isNeedResultMsg True to return the message of result, false otherwise.
     * @return the single {@link CommandResult} instance
     */
    public static CommandResult execCmd(final List<String> commands,
                                        final boolean isRooted,
                                        final boolean isNeedResultMsg) {<!-- -->
        return execCmd(commands == null ? null : commands.toArray(new String[]{<!-- -->}),
                isRooted,
                isNeedResultMsg);
    }

    /**
     * Execute the command.
     *
     * @param commands The commands.
     * @param isRooted True to use root, false otherwise.
     * @param isNeedResultMsg True to return the message of result, false otherwise.
     * @return the single {@link CommandResult} instance
     */
    public static CommandResult execCmd(final String[] commands,
                                        final boolean isRooted,
                                        final boolean isNeedResultMsg) {<!-- -->
        int result = -1;
        if (commands == null || commands.length == 0) {<!-- -->
            return new CommandResult(result, "", "");
        }
        Process process = null;
        BufferedReader successResult = null;
        BufferedReader errorResult = null;
        StringBuilder successMsg = null;
        StringBuilder errorMsg = null;
        DataOutputStream os = null;
        try {<!-- -->
            process = Runtime.getRuntime().exec(isRooted? "su" : "sh");
            os = new DataOutputStream(process.getOutputStream());
            for (String command : commands) {<!-- -->
                if (command == null) {<!-- -->
                    continue;
                }
                os.write(command.getBytes());
                os.writeBytes(LINE_SEP);
                os.flush();
            }
            os.writeBytes("exit" + LINE_SEP);
            os.flush();
            result = process.waitFor();
            if (isNeedResultMsg) {<!-- -->
                successMsg = new StringBuilder();
                errorMsg = new StringBuilder();
                successResult = new BufferedReader(
                        new InputStreamReader(process.getInputStream(), "UTF-8")
                );
                errorResult = new BufferedReader(
                        new InputStreamReader(process.getErrorStream(), "UTF-8")
                );
                String line;
                if ((line = successResult.readLine()) != null) {<!-- -->
                    successMsg.append(line);
                    while ((line = successResult.readLine()) != null) {<!-- -->
                        successMsg.append(LINE_SEP).append(line);
                    }
                }
                if ((line = errorResult.readLine()) != null) {<!-- -->
                    errorMsg.append(line);
                    while ((line = errorResult.readLine()) != null) {<!-- -->
                        errorMsg.append(LINE_SEP).append(line);
                    }
                }
            }
        } catch (Exception e) {<!-- -->
            e.printStackTrace();
        } finally {<!-- -->
            try {<!-- -->
                if (os != null) {<!-- -->
                    os.close();
                }
            } catch (IOException e) {<!-- -->
                e.printStackTrace();
            }
            try {<!-- -->
                if (successResult != null) {<!-- -->
                    successResult.close();
                }
            } catch (IOException e) {<!-- -->
                e.printStackTrace();
            }
            try {<!-- -->
                if (errorResult != null) {<!-- -->
                    errorResult.close();
                }
            } catch (IOException e) {<!-- -->
                e.printStackTrace();
            }
            if (process != null) {<!-- -->
                process.destroy();
            }
        }
        return new CommandResult(
                result,
                successMsg == null ? "" : successMsg.toString(),
                errorMsg == null ? "" : errorMsg.toString()
        );
    }

    /**
     * The result of command.
     */
    public static class CommandResult {<!-- -->
        public int result;
        public String successMsg;
        public String errorMsg;

        public CommandResult(final int result, final String successMsg, final String errorMsg) {<!-- -->
            this.result = result;
            this.successMsg = successMsg;
            this.errorMsg = errorMsg;
        }

        @Override
        public String toString() {<!-- -->
            return "result: " + result + "\
" +
                    "successMsg: " + successMsg + "\
" +
                    "errorMsg: " + errorMsg;
        }
    }

}