Android手机端滴滴抢单外挂示例（技术研究用途）

// 模块入口：Hook滴滴APP的订单处理逻辑
public class DiDiGrabber implements IXposedHookLoadPackage {
    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
        if (!lpparam.packageName.equals("com.didi.psnger")) {
            return; // 只Hook滴滴司机端APP
        }

        // Hook订单推送方法
        XposedHelpers.findAndHookMethod(
            "com.didi.order.OrderManager",
            lpparam.classLoader,
            "onNewOrder",
            Order.class,
            new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    Order order = (Order) param.args[0];
                    if (order.getPrice() > 50) { // 只抢高价值订单
                        // 自动调用接单方法（绕过UI点击）
                        XposedHelpers.callMethod(
                            param.thisObject,
                            "acceptOrder",
                            order.getId()
                        );
                        Log.d("DiDiGrabber", "抢单成功: " + order.getId());
                    }
                }
            }
        );
    }
}

// 使用Android MockLocationProvider模拟位置
LocationManager lm = (LocationManager) context.getSystemService(Context.LOCATION_SERVICE);
lm.addTestProvider(
    LocationManager.GPS_PROVIDER,
    false,  // requiresNetwork
    false,  // requiresSatellite
    false,  // requiresCell
    false,  // hasMonetaryCost
    true,   // supportsAltitude
    true,   // supportsSpeed
    true,   // supportsBearing
    android.location.Criteria.POWER_LOW,
    android.location.Criteria.ACCURACY_FINE
);

// 设置虚假位置（北京国贸附近）
Location mockLocation = new Location(LocationManager.GPS_PROVIDER);
mockLocation.setLatitude(39.909);
mockLocation.setLongitude(116.45);
mockLocation.setAccuracy(5.0f);
mockLocation.setTime(System.currentTimeMillis());
lm.setTestProviderLocation(LocationManager.GPS_PROVIDER, mockLocation);

// 使用Frida Hook网络请求（示例）
Java.perform(function() {
    var OkHttpClient = Java.use("okhttp3.OkHttpClient");
    OkHttpClient.newCall.implementation = function(request) {
        if (request.url().contains("api.didi.com/order")) {
            console.log("拦截订单请求: " + request.url());
            // 修改请求参数（如强制接单）
            var modifiedRequest = request.newBuilder()
                .addHeader("X-Cheat", "true")
                .build();
            return this.newCall(modifiedRequest);
        }
        return this.newCall(request);
    };
});

<!-- AndroidManifest.xml 声明无障碍服务 -->
<service
    android:name=".OrderGrabService"
    android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE">
    <intent-filter>
        <action android:name="android.accessibilityservice.AccessibilityService"/>
    </intent-filter>
    <meta-data
        android:name="android.accessibilityservice"
        android:resource="@xml/accessibility_config"/>
</service>

// 自动点击"抢单"按钮
public class OrderGrabService extends AccessibilityService {
    @Override
    public void onAccessibilityEvent(AccessibilityEvent event) {
        AccessibilityNodeInfo rootNode = getRootInActiveWindow();
        if (rootNode == null) return;

        // 查找"抢单"按钮
        List<AccessibilityNodeInfo> nodes = rootNode.findAccessibilityNodeInfosByText("抢单");
        for (AccessibilityNodeInfo node : nodes) {
            node.performAction(AccessibilityNodeInfo.ACTION_CLICK);
        }
    }
}