The Value and Implementation of Android Click Simulation Technology

Related Reading:

Awesome! Complete Source Code for 74 Apps!

Interview Question Discussion: Execution Order When Return Statement is in Try Block

Android Projects with Over 2k Stars on GitHub and Code Style Guide (Absolutely Valuable)

Source: http://www.jianshu.com/p/d83b2caa5249

“Action!” Welcome to this large-scale practical tech show, “Xiaoming Tells Stories.” Hello everyone, I am Xiaoming! Today’s theme is how if Sun Bin, Zhuge Liang, and Zeng Guofan were programmers, they would implement Android automatic click simulation. Here we can have Android phone ads, but without sponsors, we continue. It’s hard to imagine that those three historical figures are programmers, right? Let’s clarify the value of Android click simulation for us, just for profit!

1. Value of Click Simulation

1. There are situations where the phone’s email receives many emails daily, and among them are unread emails that I don’t want to look at or are expired. I have a compulsion to remove those evil little red dots, and I am too lazy to click select all to mark them as read. Wouldn’t it be great to have an automatic click?

2. There’s also a situation where I really like a mobile game, but leveling up is slow, and grinding monsters is monotonous. Wouldn’t it be great to have a little cheat to help me click while I do other things? At this moment, you might want to respond, “Yes, it would be great if there’s something to help click on WeChat red envelopes!”

3. Lastly, despite our laziness, and although we want to cheat on exams with little notes, we can still stand at the center of the universe calling for love. For some people with physical disabilities, using certain phone functions is indeed necessary, and click simulation is particularly caring. Love is multi-faceted; once your TA’s phone receives their information, it automatically clicks open and plays a line, “Dear, I’m here, where are you?” How romantic is that?

Well, the value of click simulation is evident, mainly in the following three points:

1. Accessibility love service. [Love is still the first priority]2. More automatic completion of specific daily uses.3. Cheating cheats. [It’s unavoidable to feel a little excitement, right?]

2. MotionEvent Implementation of Click Simulation

1. Implementation Principle

1) Obtain the View to be clicked.2) Simulate click events MotionEvent.ACTION_DOWN and MotionEvent.ACTION_UP.

2. Implementation Process

Oh, we have neglected the three historical figures for a long time. Please welcome Sun Bin, the proud disciple of Mr. Guigu!1) Sun Bin’s cunning plan

Since Sun Bin was envious and suspected by his classmate Pang Juan and was framed to receive a punishment (he was only slightly injured in the knee), Pang Juan, to cover up his evil and wild nature, supported Sun Bin, hoping to extract from him the “Art of War” he learned from Mr. Guigu. Later, Sun Bin learned that all his suffering was caused by Pang Juan, and apart from despair and helplessness, he wanted to escape Pang Juan’s clutches as soon as possible. In this situation, Sun Bin used the cunning plan of the “Art of War” to feign madness and stupidity to deceive Pang Juan into not forcing him to memorize the “Art of War,” while also reducing his vigilance against him. Finally, on a dark and windy night, he was rescued by the Qi state envoy Chunyu Kun.

①. Sun Bin’s escape is like a MotionEvent event. ②. Feigning madness and stupidity is like pretending to click to trigger MotionEvent.ACTION_DOWN and MotionEvent.ACTION_UP events.

2) Show Code

//Sun Bin's cunning planprivate void manTianGuoHai(View view, float x, float y) {    long downTime = SystemClock.uptimeMillis();    //Feign madness    MotionEvent downEvent = MotionEvent.obtain(downTime, downTime, MotionEvent.ACTION_DOWN, x, y, 0);    downTime += 1000;    //Feign stupidity    MotionEvent upEvent = MotionEvent.obtain(downTime, downTime, MotionEvent.ACTION_UP, x, y, 0);    view.onTouchEvent(downEvent);    view.onTouchEvent(upEvent);    downEvent.recycle();    upEvent.recycle();}

2) View Effect

MotionEvent Click Simulation

Wow, this works! I can also pretend to be silly! Nowadays, voice payment is popular. If Xiaoming picks up the phone of actress Lin Chi-ling, I must try voice payment on her phone, shouting sweetly at her phone, “Mengmeng get up, come on, Mengmeng get up~”. For being a brother, hey~ hey hey, the vomit bag is prepared on the seat to the right!!

With Lin Chi-ling’s voice in the Gaode map navigation, we returned to the Three Kingdoms’ Red Cliff. Just in time, I ran into Mr. Kongming. “I am Xiaoming, I have long admired your name, Mr. Zhuge!” Kongming, seeing Xiaoming with short hair, short sleeves, short pants, and short legs, was horrified, “What kind of monster are you?” “Puff~~

3. AccessibilityService Implementation of Click Simulation

1. Basic Concept

AccessibilityService is an auxiliary service provided by Android for some people with disabilities to help them interact with their Android devices in various ways, such as clicking on the screen. It’s a very caring service. The official introduction to this function is as follows:

Many Android users have different abilities that require them to interact with their Android devices in different ways. These include users who have visual, physical or age-related limitations that prevent them from fully seeing or using a touchscreen, and users with hearing loss who may not be able to perceive audible information and alerts.

2. Implementation Principle

1) Obtain the corresponding View through resource-id.

nodeInfo.findAccessibilityNodeInfosByViewId(resId);

2) Or through View with text attribute.

nodeInfo.findAccessibilityNodeInfosByText(text);

3) Execute the specified method of AccessibleService to implement the click.

targetNode.performAction(AccessibilityNodeInfo.ACTION_CLICK);

3. Implementation Process

1) Zhuge Liang’s Borrowing Arrows with Straw Boats

This is something everyone is familiar with, the borrowing of arrows with straw boats after debating with various scholars.

Zhou Yu said, “I only have ships and water troops here, I don’t have ‘cheap’, Mr. Kongming, you should ‘cheap’!” Mr. Kongming, being a gentleman, how could he be ‘cheap’? “If you want me to ‘cheap’ in a short time, can we cooperate?” “Okay, as long as you bring out ‘cheap’, I agree, let’s establish a military order!” Zhou Yu provocatively said. The wise Zhuge Liang thought, “I won’t ‘cheap’, I’ll find someone to ‘cheap’!”

Isn’t that wonderful? With so many ‘cheap’ from Cao Cao, the straw boats came over, shook off the ‘cheap’, and took them away!

①. The cooperation after debating with various scholars to repel Cao Cao is like the AccessibleService service. ②. Zhou Yu providing ships and water troops is the specific findAccessibilityNodeInfosByViewId(resId) and findAccessibilityNodeInfosByText(text). ③. Zhuge Liang beating the drum is performAction(AccessibilityNodeInfo.ACTION_CLICK);

2) How to Obtain resource-id or text ①. If you are obtaining your app’s resource-id, that is defined in the layout xml as @id/shuijun or @+id/chuan. ②. For other software, you can find the resource-id or text by dumping the view hierarchy outline.

Dump page analysis

3) Declare the service requirements to be used Zhuge Liang must declare that he can use troops and ships. ① Configuration in click_config.xml file

<?xml version="1.0" encoding="utf-8"?><accessibility-service    xmlns:android="http://schemas.android.com/apk/res/android"    android:description="@string/click_auto"    android:accessibilityEventTypes="typeNotificationStateChanged|typeWindowStateChanged"    android:packageNames="com.youmi.android.addemo"    android:accessibilityFeedbackType="feedbackGeneric"    android:notificationTimeout="100"    android:accessibilityFlags=""    android:canRetrieveWindowContent="true"/>

② Configuration in AndroidManifest.xml file

<service    android:label="@string/app_name"    android:name="com.minggo.autoclick.ClickService"    android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE">    <intent-filter>         <action android:name="android.accessibilityservice.AccessibilityService"/>    </intent-filter>    <meta-data        android:name="android.accessibilityservice"        android:resource="@xml/click_config"/></service>

4) Authorize the use of auxiliary service applications Cooperation has been achieved, and Zhuge Liang must be authorized to do the work.

Authorization to start auxiliary service

5) Show Code Finally, let’s borrow arrows with Lu Su

//Borrow arrows (click)private void performClick(String resourceId) {    Log.i("mService","Click executed");    AccessibilityNodeInfo nodeInfo = this.getRootInActiveWindow();    AccessibilityNodeInfo targetNode = null;    targetNode = findNodeInfosById(nodeInfo,"com.youmi.android.addemo:id/"+resourceId);    if (targetNode.isClickable()) {        targetNode.performAction(AccessibilityNodeInfo.ACTION_CLICK);    }}//Call troops (search by id)public static AccessibilityNodeInfo findNodeInfosById(AccessibilityNodeInfo nodeInfo, String resId) {    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN_MR2) {        List<AccessibilityNodeInfo> list = nodeInfo.findAccessibilityNodeInfosByViewId(resId);        if(list != null && !list.isEmpty()) {            return list.get(0);        }}    return null;}//Call ships (search by text)public static AccessibilityNodeInfo findNodeInfosByText(AccessibilityNodeInfo nodeInfo, String text) {    List<AccessibilityNodeInfo> list = nodeInfo.findAccessibilityNodeInfosByText(text);    if(list == null || list.isEmpty()) {        return null;    }    return list.get(0);}

6) View Effect

Accessibility service click

‘Cheap’ Zhou Yu still got a hundred thousand, but that mouthful of old blood almost spurted out. Zhou Yu probably wished to invite Zhuge Liang to his bathhouse to thank him for providing 24-hour comprehensive protection for his family.

This shared half-day life probably won’t last long, and soon the cooperation will collapse, causing chaos. Life is full of changes, and soon we will look up at the “blue blue~ sky~~ oh!” Realizing not to go against heaven, it’s still okay to be heavenly, feeling great, let’s shave our heads and start over.

4. Achieving Click Simulation through Reflection

1. Basic Concept

Java’s reflection mechanism allows you to know all properties and methods of any class at runtime; for any object, you can call any of its methods and properties. This dynamic acquisition of information and the ability to dynamically call methods of objects is known as the reflection mechanism in Java.

Note: Reflection itself violates the encapsulation principle of object-oriented programming, so it has destructive potential; reflection is widely used in Gson, Afinal framework, Spring dependency injection annotations, etc. It should be viewed from both sides; do not be rigid.

2. Basic Operations

1) Get entity type

Class clazz = spotManager.getClass();

2) Get class variables

Field f = clazz.getDeclaredField("F");f.setAccessible(true); // This allows you to read private properties

3) Get variable value

o oInstance = f.get(spotManager);

3. Implementation Process

1) Zeng Guofan’s Counterespionage “Zeng’s Barber Shop” is eye-catching; let’s go in for a haircut. “Guest, I see you have a full head of hair and a handsome face…”, “Oh, you must be Zeng Guofan, right? I am Xiaoming, I respect you!” “Can I get a pepper? Otherwise, can I invite you to eat stinky tofu?” Mr. Zeng licked his tongue, “Okay, let’s eat stinky tofu first; if you don’t eat stinky tofu here, it’s a waste.” “Mr. Zeng, could you tell me how you turned Wei Jun?” “Xiaoming, let’s chat while we walk…”

“Tianjing Incident,” Wei Jun was implicated by two Wei Changhui and could be called back to be executed at any time. Wei Jun liked hunting and playing chess; I asked Kangfu to wait for him on the mountain to meet him and play chess, and I had to win. After a month and a half of playing, I finally caught the opportunity; the Heavenly Kingdom sent an edict requiring Wei Jun to return to the capital (Nanjing). Kangfu persuaded him and revealed his identity, expressing my appreciation and invitation. Under such circumstances, he chose me and informed them of the art of war, which I recorded as the “Long Hair Tactics.” Chizhou is my birthplace.

“Mr. Zeng, I admire you! How powerful Kangfu is! I searched for him everywhere, but that person was not in the lantern’s dim light.” Mr. Zeng pondered, “You should ask Tang Haoming!”…

① The potential betrayal of Wei Jun is the destructive nature of the reflection mechanism. ② Wei Jun’s love for hunting and chess is like exposing the approach to spotManager.getClass() and f.setAccessible(true); ③ Wei Jun revealing his identity to Kangfu is like putting down his sword and being openly persuaded o oInstance = f.get(spotManager);

2) How to find the entity to be reflected To test the persuasion of Wei Jun, I cannot go to the wrong mountain; otherwise, I can only perform a major scene, “Your Majesty, do you still remember the summer rain lotus by the Daming Lake?” This is a major scene!

5. Analyzing Youmi Interstitial Ads

We are not responsible for the advertising that is not self-produced; let’s follow the heavenly will and see if we can achieve enlightenment.

1. Dump the Youmi Interstitial Ad Page

Youmi Interstitial Ad.png

From the image, we can only find the horizontal ad’s webview (having obtained this, we can implement clicks on this area using the previous two methods to do what you want), but there’s no hierarchical information for the interstitial ad view. Heaven does not abandon people; the best is yet to come.

2. Decompile to Find Location

1) Start with determining the ad launch class

btnShowSpot.setOnClickListener(new OnClickListener() {        @Override        public void onClick(View v) {            // Display interstitial ad, can be used independently without calling the preloading method            // Start from here, analyze interstitial ad code, find corresponding ad view            SpotManager.getInstance(mContext)                    .showSpotAds(mContext, new SpotDialogListener() {            ...

It’s determined to be messing around in the SpotManager class. 2) Decompile SpotManager ① Let’s see what attributes it has:

private o F;protected SplashView n;

These two attributes are most likely; the others are String, int, boolean attributes. Splash, as the name suggests, is for splash ads; let’s leave it for now and analyze the o F class.

Decompile to find the b method

② Next, we enter the a method

Important information in the a method

Indeed, there’s an instance of o F that adds and uses the k method. 3) Decompile the o class to check attributes

Decompile the o class

Wei Jun puts down his sword and goes to meet Mr. Zeng; everything has come to an end. Lay down the sword and become a hero.

3. Aim at the Target and Reflect to Extract

/** * 1. By decompiling [studio has built-in] view analysis of o F (o obfuscated class name, F is an instance of o) is the ad instance. * 2. The variable w in the o class is of ImageView type. * 3. Above is enough to obtain the interstitial ad image instance, reflecting each attribute value one by one. * 4. If there are many attributes after decompilation, write a reflection traversal of those attributes to brute force break through. */private void getO(){    SpotManager spotManager = SpotManager.getInstance(mContext);    Class clazz = spotManager.getClass();    Field f;    try {        f = clazz.getDeclaredField("F");        f.setAccessible(true);        Class deClazz = f.getType();        Log.i("mService","F type-->"+deClazz.getSimpleName());        if(f.get(spotManager)==null){            Log.i("mService","Ad class is null");        }else if(f.get(spotManager) instanceof o){            Log.i("mService","It is a unified type");            o adO = (o) f.get(spotManager);            Class oClazz = adO.getClass();            Field imgField = oClazz.getDeclaredField("w");            imgField.setAccessible(true);            if (imgField.get(adO) instanceof ImageView){                Log.i("mService","Attribute m is ImageView");                final ImageView adImageView = (ImageView) imgField.get(adO);                Log.i("mService","Ad image-->"+adImageView.getId());                if(adImageView==null){                    Log.i("mService","Ad image is null");                }else {                    if(adImageView.isClickable()){                        Log.i("mService","Ad image can be clicked");                    }else{                        Log.i("mService","Ad image cannot be clicked");                    }                    Log.i("mService","Ad width and height-->"+adImageView.getLayoutParams().width+","+adImageView.getLayoutParams().height);                    new Handler().postDelayed(new Runnable() {                        @Override                        public void run() {                            setSimulateClick(adImageView,adImageView.getWidth()/2,adImageView.getHeight()/2);                        }                    },3000);                }            }            //adImageView.setDrawingCacheEnabled(true);            //adImageView.getDrawable();            //ImageView imageViewxml = (ImageView) findViewById(R.id.imageView);            //imageViewxml.setImageDrawable(adImageView.getDrawable());        }    } catch (Exception e) {        e.printStackTrace();    }}

4. View Effect

Reflection of Youmi Interstitial Ad Auto Click Effect

“Mr. Zeng, no wonder your life seems to be hanging; why don’t you go to heaven?” As soon as the words fell, a purple light flashed in the center of Mr. Zeng’s chest, “Ding dong, ding dong, ding dong…” Wow, it even makes a sound, “With a snap”, Mr. Zeng disappeared into the clouds without a trace.

6. Summary and Extension

1. If the sky is your family’s, just directly deceive heaven.2. If half the sky is your family’s, just borrow arrows with straw boats.3. If the sky has nothing to do with you, just counter-espionage. Remember, I have never advocated that college students, especially those in computer majors, especially those who have the position of class leader, organize classmates to earn class meeting fees in this way. Because I didn’t do that during my time as class leader in college. The show is coming to an end; there should be applause here. Clap clap… Thank you, thank you all, let’s once again give a warm applause to today’s heavyweight guests Sun Bin, Zhuge Liang, and Zeng Guofan, and all teachers please walk slowly~~!

7. Source Code Address

https://github.com/minggo620/AndroidAutoClick

If you gained something from reading this article, please share it with more people

Java and Android Architecture

Welcome to follow us, let’s discuss technology together, scan and long-press the QR code below to quickly follow us. Or search for WeChat public account: JANiubility.

Public Account:JANiubility