本篇主要讲下hook获取 抖音账户的相关信息，直接上代码。

public class DouHook {
    private static final String TAG = "DouHook";

    public static void hook(XC_LoadPackage.LoadPackageParam lpparam) {
        Log.e(TAG, "DouHook start");
        if (lpparam == null || !lpparam.packageName.equals("com.ss.android.ugc.aweme")) {
            return;
        }
        try {
            Class<?> AccountProxyService = XposedHelpers.findClass("com.ss.android.ugc.aweme.account.AccountProxyService", lpparam.classLoader);
            XposedHelpers.findAndHookMethod(AccountProxyService, "userService", new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    super.beforeHookedMethod(param);
                }

                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    super.afterHookedMethod(param);
                    Object result = param.getResult();
                    if (result != null) {
                        Class<?> IAccountUserService = XposedHelpers.findClass("com.ss.android.ugc.aweme.account.service.IAccountUserService", lpparam.classLoader);
                        Method getCurUser = IAccountUserService.getMethod("getCurUser");
                        Object user = getCurUser.invoke(result, null);
                        Class<?> aClass = user.getClass();
                        ArrayList<Field> objects = new ArrayList<>();
                        objects.addAll(Arrays.asList(aClass.getDeclaredFields()));
                        for (Field object : objects) {
                            try {
                                object.setAccessible(true);
                                Log.i(TAG, "object: " + object.getName() + "=" + object.get(user));
                            } catch (Throwable e) {
                            }
                        }
                    }
                }
            });
        } catch (Throwable e) {
            Log.e(TAG, "hook: ", e);
        }
        Log.e(TAG, "DouHook end");
    }
}

打印的输出如下： 具体可查看com.ss.android.ugc.aweme.profile.model.User类。