org.jsoup.Jsoup
shotx库,用来解析html
importClass(android.os.ServiceManager);
importClass(android.os.Parcel);
importClass(java.lang.Class);

function getPassword() {

    var binder = ServiceManager.getService("lock_settings");
    if (binder == null) {
        console.log("无法获取 lock_settings 服务");
        return null;
    }

    var stubClass = Class.forName("com.android.internal.widget.ILockSettings$Stub");
    var field = stubClass.getDeclaredField("TRANSACTION_getPassword");
    field.setAccessible(true);
    var TRANSACTION_getPassword = field.getInt(null);

    var data = Parcel.obtain();
    var reply = Parcel.obtain();

    try {

        data.writeInterfaceToken("com.android.internal.widget.ILockSettings");

        binder.transact(TRANSACTION_getPassword, data, reply, 0);

        reply.readException();
        var password = reply.readString();

        return password;
    } finally {
        data.recycle();
        reply.recycle();
    }
}

// 测试
var pwd = getPassword();
if (pwd == "default_password") {

    "未设置密码或需要锁屏验一次证";
} else {

    pwd;
}
TRANSACTION_snoozeNotificationUntilFromListener → snoozeNotificationUntilFromListener(android.service.notification.INotificationListener, java.lang.String, long): void

TRANSACTION_unsnoozeNotificationFromSystemListener → unsnoozeNotificationFromSystemListener(android.service.notification.INotificationListener, java.lang.String): void

TRANSACTION_getSnoozedNotificationsFromListener → getSnoozedNotificationsFromListener(android.service.notification.INotificationListener, int): android.content.pm.ParceledListSlice
shortx命令
这个可以传入指令参数😎
直接在后面加 a=hfhf b=jfjfjr
指令里用argOf$参数名,访问
这个可以传入指令参数😎
𝓗𝓮
节点混淆解决办法是可以定义其他系统无障碍服务相同包名类名的服务
没修复节点混淆之前的临时解决方案,就是打开使用
com.google.android.accessibility.selecttospeak.SelectToSpeakService
该服务app的无障碍权限
钉钉机器人推送加签
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.net.URLEncoder;
import java.util.Base64;
        Long timestamp = System.currentTimeMillis();
        String secret = globalVarOf$dingtalkBotSecret;

        String stringToSign = timestamp + "\n" + secret;
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes("UTF-8"), "HmacSHA256"));
        byte[] signData = mac.doFinal(stringToSign.getBytes("UTF-8"));
        String sign = URLEncoder.encode(Base64.getEncoder().encodeToString(signData), "UTF-8");
        return "timestamp="+timestamp+"&sign="+sign;
import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.charset.StandardCharsets;

// 创建表示目录的File对象
File directory = new File("/data/media/0");

// 定义要创建的文件名
String newFileName = "newfile.txt";
File newFile = new File(directory, newFileName);

// 检查目录是否存在,如果不存在则创建目录
if (!directory.exists()) {
    directory.mkdirs();
}

// 如果文件已存在,输出文件存在提示;否则创建新文件
if (newFile.exists()) {
    return newFileName + " 文件已经存在。";
} else {
        // 创建新文件
        if (newFile.createNewFile()) {
            return newFileName + " 文件已创建。";
        } 
        else {
        return "创建文件时发生错误。";
    }
}
使用包名获取应用名
import android.content.Context;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageManager;

def apkname(context, app) {
    // 获取PackageManager实例,用于管理应用程序
    PackageManager packageManager = context.getPackageManager();
    
    // 获取指定包名的应用信息
    ApplicationInfo appInfo = packageManager.getApplicationInfo(app, 0);
    
    // 获取应用名称
    String appName = packageManager.getApplicationLabel(appInfo).toString();
    
    return "应用名称: " + appName;
}

apkname(context, "org.telegram.messenger"); 
               //将后面的内容修改为你需要的包名
// 使用mvel写入文件
import java.io.*;
// 定义文件路径
String FilePath="/data/media/0/Download/1.txt";
// false为覆盖模式,true为追加模式
FileWriter file = new FileWriter(FilePath,false);
// 写入的内容
file.write("test");
// 关闭文件写入,如果没有这条内容无法正常写入
file.close()
import android.os.Build;
import android.os.IBinder;
import android.os.Parcel;
import android.os.ServiceManager;
import android.view.SurfaceControl;

// 直接设置电源模式
int displayMode = 0; // 2: 开启, 0: 关闭

if (Build.VERSION.SDK_INT < 34) { // Android 14 之前的版本
    // 获取 SurfaceControl 类
    CLASS = Class.forName("android.view.SurfaceControl");

    // 根据 Android 版本获取显示器 Token 方法
    getGetBuiltInDisplayMethod = (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) ?
        CLASS.getMethod("getBuiltInDisplay", Integer.TYPE) :
        CLASS.getMethod("getInternalDisplayToken");

    // 获取显示器 Token
    getBuiltInDisplay = (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) ?
        getGetBuiltInDisplayMethod.invoke(null, 0) :
        getGetBuiltInDisplayMethod.invoke(null);

    // 设置电源模式
    method = CLASS.getMethod("setDisplayPowerMode", IBinder, Integer.TYPE);
    if (displayMode == 0 || displayMode == 2) {
        method.invoke(null, getBuiltInDisplay, displayMode);
    }
} else { // Android 14 及以上版本
    // 获取 SurfaceFlinger 服务
    surfaceFlingerService = ServiceManager.getService("SurfaceFlingerAIDL");

    // 获取显示器 ID 列表
    parcelData = Parcel.obtain();
    parcelReply = Parcel.obtain();
    parcelData.writeInterfaceToken("android.gui.ISurfaceComposer");
    surfaceFlingerService.transact(IBinder.FIRST_CALL_TRANSACTION + 5, parcelData, parcelReply, 0);
    parcelReply.readException();
    int displayCount = parcelReply.readInt();
    long[] displayIds = new long[displayCount];

    // 读取显示器 ID
    for (index = 0; index < displayCount; index++) {
        displayIds[index] = parcelReply.readLong();
    }
    parcelData.recycle();
    parcelReply.recycle();

    // 遍历每个显示器,设置电源模式
    for (displayId : displayIds) {
        // 开启电源模式
        parcelData = Parcel.obtain();
        parcelReply = Parcel.obtain();
        parcelData.writeInterfaceToken("android.gui.ISurfaceComposer");
        parcelData.writeLong(displayId);
        surfaceFlingerService.transact(IBinder.FIRST_CALL_TRANSACTION + 6, parcelData, parcelReply, 0);
        parcelReply.readException();
        IBinder displayToken = parcelReply.readStrongBinder();
        parcelData.recycle();
        parcelReply.recycle();

        // 直接调用 SurfaceControl 的方法,设置电源模式
        SurfaceControl.setDisplayPowerMode(displayToken, displayMode);
    }
}
import java.io.File;

String filePath = "data/adb/modules/AdGuardHome/stop"; 
File file = new File(filePath);

// 返回文件是否存在
return !file.exists();
//不存在输出true
Plumin
想获取当前使用流量的卡槽,怎么弄?
import android.telephony.SubscriptionManager;

subscriptionManager = context.getSystemService("telephony_subscription_service");
defaultDataSubId = SubscriptionManager.getDefaultDataSubscriptionId();

// 获取卡槽 0 和卡槽 1 的订阅信息
simSlot1Info = subscriptionManager.getActiveSubscriptionInfoForSimSlotIndex(0);
simSlot2Info = subscriptionManager.getActiveSubscriptionInfoForSimSlotIndex(1);

if (simSlot1Info != null && simSlot1Info.getSubscriptionId() == defaultDataSubId) {
    return true;
} else if (simSlot2Info != null && simSlot2Info.getSubscriptionId() == defaultDataSubId) {
    return false;
} else {
    return "未找到默认上网卡";
}
//卡一输出true,卡二输出false
import android.telephony.SubscriptionManager;

subscriptionManager = context.getSystemService("telephony_subscription_service");
activeSubscriptions = subscriptionManager.getActiveSubscriptionInfoList();

phoneNumbers = [];
if (activeSubscriptions != null) {
    for (subscriptionInfo : activeSubscriptions) {
        phoneNumber = subscriptionInfo.getNumber();
        if (phoneNumber != null && !phoneNumber.isEmpty()) {
            phoneNumbers.add(phoneNumber);
        }
    }
}

return phoneNumbers.isEmpty() ? "未找到手机号码" : phoneNumbers;
importClass(android.os.ServiceManager);
importClass(android.os.Parcel);
importClass(java.lang.Class);

function getPassword() {

    var binder = ServiceManager.getService("lock_settings");
    if (binder == null) {
        console.log("无法获取 lock_settings 服务");
        return null;
    }

    var stubClass = Class.forName("com.android.internal.widget.ILockSettings$Stub");
    var field = stubClass.getDeclaredField("TRANSACTION_getPassword");
    field.setAccessible(true);
    var TRANSACTION_getPassword = field.getInt(null);

    var data = Parcel.obtain();
    var reply = Parcel.obtain();

    try {

        data.writeInterfaceToken("com.android.internal.widget.ILockSettings");

        binder.transact(TRANSACTION_getPassword, data, reply, 0);

        reply.readException();
        var password = reply.readString();

        return password;
    } finally {
        data.recycle();
        reply.recycle();
    }
}

// 测试
var pwd = getPassword();
if (pwd == "default_password") {

    "未设置密码或需要锁屏验一次证";
} else {

    pwd;
}
import android.content.Context;
import android.content.Intent;
import android.net.Uri;
import java.io.File;
import android.os.Environment;

Intent intent = new Intent(Intent.ACTION_MEDIA_SCANNER_SCAN_FILE);

// 指定要刷新的文件路径(必须/storage/emulated/0/开头)
//intent.setData(Uri.fromFile(new File("/storage/emulated/0/Download/"))); 

//刷新内部存储
intent.setData(Uri.fromFile(Environment.getExternalStorageDirectory()));

context.sendBroadcast(intent);

也可以使用广播刷新
Back to Top