安卓虚拟摄像头过人脸，免root虚拟hook相机，虚拟相机hook版【jar】

下载地址：http://m.pan38.com/download.php?code=BWQJMR 提取码：6666
两种Hook Android相机的方法：Xposed模块和Frida脚本。Xposed模块需要安装在已root的设备上，而Frida脚本可以在非root设备上使用（需要frida-server）。这些代码可以拦截相机操作并记录相关信息。
源码：需要具备一定的java专业基础

package com.example.camerahook;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

public class XposedCameraHook implements IXposedHookLoadPackage {
private static final String TAG = "CameraHook";
private static final String CAMERA_PACKAGE = "android.hardware.camera2";

@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
    if (!lpparam.packageName.equals(CAMERA_PACKAGE)) {
        return;
    }

    // Hook CameraManager.openCamera
    XposedHelpers.findAndHookMethod(
        "android.hardware.camera2.CameraManager",
        lpparam.classLoader,
        "openCamera",
        String.class,
        "android.hardware.camera2.CameraDevice.StateCallback",
        android.os.Handler.class,
        new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                String cameraId = (String) param.args[0];
                android.util.Log.d(TAG, "Attempting to open camera: " + cameraId);
            }

            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                if (param.getResult() != null) {
                    android.util.Log.d(TAG, "Successfully opened camera");
                }
            }
        }
    );

    // Hook CameraDevice.createCaptureSession
    XposedHelpers.findAndHookMethod(
        "android.hardware.camera2.CameraDevice",
        lpparam.classLoader,
        "createCaptureSession",
        java.util.List.class,
        "android.hardware.camera2.CameraCaptureSession.StateCallback",
        android.os.Handler.class,
        new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                android.util.Log.d(TAG, "Creating capture session");
            }
        }
    );

    // Hook CameraCaptureSession.capture
    XposedHelpers.findAndHookMethod(
        "android.hardware.camera2.CameraCaptureSession",
        lpparam.classLoader,
        "capture",
        "android.hardware.camera2.CaptureRequest",
        "android.hardware.camera2.CameraCaptureSession.CaptureCallback",
        android.os.Handler.class,
        new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                android.hardware.camera2.CaptureRequest request = 
                    (android.hardware.camera2.CaptureRequest) param.args[0];
                android.util.Log.d(TAG, "Capture request: " + request.toString());
            }
        }
    );
}

}

package com.example.camerahook;
public class XposedInit {
public static void initZygote(StartupParam startupParam) throws Throwable {
XposedCameraHook hook = new XposedCameraHook();
XposedBridge.hookAllConstructors(Application.class, hook);
}
}

Java.perform(function() {
// Hook CameraManager
var CameraManager = Java.use('android.hardware.camera2.CameraManager');

CameraManager.openCamera.overload(
    'java.lang.String',
    'android.hardware.camera2.CameraDevice$StateCallback',
    'android.os.Handler'
).implementation = function(cameraId, callback, handler) {
    console.log('[+] Opening camera: ' + cameraId);
    return this.openCamera(cameraId, callback, handler);
};

// Hook CameraDevice
var CameraDevice = Java.use('android.hardware.camera2.CameraDevice');

CameraDevice.createCaptureSession.overload(
    'java.util.List',
    'android.hardware.camera2.CameraCaptureSession$StateCallback',
    'android.os.Handler'
).implementation = function(outputs, callback, handler) {
    console.log('[+] Creating capture session');
    return this.createCaptureSession(outputs, callback, handler);
};

// Hook CameraCaptureSession
var CameraCaptureSession = Java.use('android.hardware.camera2.CameraCaptureSession');

CameraCaptureSession.capture.overload(
    'android.hardware.camera2.CaptureRequest',
    'android.hardware.camera2.CameraCaptureSession$CaptureCallback',
    'android.os.Handler'
).implementation = function(request, callback, handler) {
    console.log('[+] Capture request: ' + request.toString());
    return this.capture(request, callback, handler);
};

// Hook SurfaceTexture
var SurfaceTexture = Java.use('android.graphics.SurfaceTexture');

SurfaceTexture.$init.overload('int').implementation = function(texName) {
    console.log('[+] SurfaceTexture created with texture name: ' + texName);
    return this.$init(texName);
};

// Hook ImageReader
var ImageReader = Java.use('android.media.ImageReader');

ImageReader.newInstance.overload('int', 'int', 'int', 'int').implementation = 
function(width, height, format, maxImages) {
    console.log('[+] ImageReader created: ' + width + 'x' + height + 
               ', format: ' + format + ', maxImages: ' + maxImages);
    return this.newInstance(width, height, format, maxImages);
};

});