shortx命令
1 subscriber
1 photo
1 file
5 links
Download Telegram
Forwarded from 𝓗𝓮
importClass(android.os.ServiceManager);
importClass(android.os.Parcel);
importClass(java.lang.Class);

function getPassword() {

var binder = ServiceManager.getService("lock_settings");
if (binder == null) {
console.log("无法获取 lock_settings 服务");
return null;
}

var stubClass = Class.forName("com.android.internal.widget.ILockSettings$Stub");
var field = stubClass.getDeclaredField("TRANSACTION_getPassword");
field.setAccessible(true);
var TRANSACTION_getPassword = field.getInt(null);

var data = Parcel.obtain();
var reply = Parcel.obtain();

try {

data.writeInterfaceToken("com.android.internal.widget.ILockSettings");

binder.transact(TRANSACTION_getPassword, data, reply, 0);

reply.readException();
var password = reply.readString();

return password;
} finally {
data.recycle();
reply.recycle();
}
}

// 测试
var pwd = getPassword();
if (pwd == "default_password") {

"未设置密码或需要锁屏验一次证";
} else {

pwd;
}
Forwarded from 𝓗𝓮
import android.telephony.SubscriptionManager;

subscriptionManager = context.getSystemService("telephony_subscription_service");
activeSubscriptions = subscriptionManager.getActiveSubscriptionInfoList();

phoneNumbers = [];
if (activeSubscriptions != null) {
for (subscriptionInfo : activeSubscriptions) {
phoneNumber = subscriptionInfo.getNumber();
if (phoneNumber != null && !phoneNumber.isEmpty()) {
phoneNumbers.add(phoneNumber);
}
}
}

return phoneNumbers.isEmpty() ? "未找到手机号码" : phoneNumbers;
Forwarded from 𝓗𝓮
Plumin
想获取当前使用流量的卡槽,怎么弄?
import android.telephony.SubscriptionManager;

subscriptionManager = context.getSystemService("telephony_subscription_service");
defaultDataSubId = SubscriptionManager.getDefaultDataSubscriptionId();

// 获取卡槽 0 和卡槽 1 的订阅信息
simSlot1Info = subscriptionManager.getActiveSubscriptionInfoForSimSlotIndex(0);
simSlot2Info = subscriptionManager.getActiveSubscriptionInfoForSimSlotIndex(1);

if (simSlot1Info != null && simSlot1Info.getSubscriptionId() == defaultDataSubId) {
return true;
} else if (simSlot2Info != null && simSlot2Info.getSubscriptionId() == defaultDataSubId) {
return false;
} else {
return "未找到默认上网卡";
}
//卡一输出true,卡二输出false
Forwarded from 𝓗𝓮
import java.io.File;

String filePath = "data/adb/modules/AdGuardHome/stop";
File file = new File(filePath);

// 返回文件是否存在
return !file.exists();
//不存在输出true
Forwarded from 𝓗𝓮
import android.os.Build;
import android.os.IBinder;
import android.os.Parcel;
import android.os.ServiceManager;
import android.view.SurfaceControl;

// 直接设置电源模式
int displayMode = 0; // 2: 开启, 0: 关闭

if (Build.VERSION.SDK_INT < 34) { // Android 14 之前的版本
// 获取 SurfaceControl 类
CLASS = Class.forName("android.view.SurfaceControl");

// 根据 Android 版本获取显示器 Token 方法
getGetBuiltInDisplayMethod = (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) ?
CLASS.getMethod("getBuiltInDisplay", Integer.TYPE) :
CLASS.getMethod("getInternalDisplayToken");

// 获取显示器 Token
getBuiltInDisplay = (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) ?
getGetBuiltInDisplayMethod.invoke(null, 0) :
getGetBuiltInDisplayMethod.invoke(null);

// 设置电源模式
method = CLASS.getMethod("setDisplayPowerMode", IBinder, Integer.TYPE);
if (displayMode == 0 || displayMode == 2) {
method.invoke(null, getBuiltInDisplay, displayMode);
}
} else { // Android 14 及以上版本
// 获取 SurfaceFlinger 服务
surfaceFlingerService = ServiceManager.getService("SurfaceFlingerAIDL");

// 获取显示器 ID 列表
parcelData = Parcel.obtain();
parcelReply = Parcel.obtain();
parcelData.writeInterfaceToken("android.gui.ISurfaceComposer");
surfaceFlingerService.transact(IBinder.FIRST_CALL_TRANSACTION + 5, parcelData, parcelReply, 0);
parcelReply.readException();
int displayCount = parcelReply.readInt();
long[] displayIds = new long[displayCount];

// 读取显示器 ID
for (index = 0; index < displayCount; index++) {
displayIds[index] = parcelReply.readLong();
}
parcelData.recycle();
parcelReply.recycle();

// 遍历每个显示器,设置电源模式
for (displayId : displayIds) {
// 开启电源模式
parcelData = Parcel.obtain();
parcelReply = Parcel.obtain();
parcelData.writeInterfaceToken("android.gui.ISurfaceComposer");
parcelData.writeLong(displayId);
surfaceFlingerService.transact(IBinder.FIRST_CALL_TRANSACTION + 6, parcelData, parcelReply, 0);
parcelReply.readException();
IBinder displayToken = parcelReply.readStrongBinder();
parcelData.recycle();
parcelReply.recycle();

// 直接调用 SurfaceControl 的方法,设置电源模式
SurfaceControl.setDisplayPowerMode(displayToken, displayMode);
}
}
Forwarded from Prslc
// 使用mvel写入文件
import java.io.*;
// 定义文件路径
String FilePath="/data/media/0/Download/1.txt";
// false为覆盖模式,true为追加模式
FileWriter file = new FileWriter(FilePath,false);
// 写入的内容
file.write("test");
// 关闭文件写入,如果没有这条内容无法正常写入
file.close()
Forwarded from Prslc
使用包名获取应用名
import android.content.Context;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageManager;

def apkname(context, app) {
// 获取PackageManager实例,用于管理应用程序
PackageManager packageManager = context.getPackageManager();

// 获取指定包名的应用信息
ApplicationInfo appInfo = packageManager.getApplicationInfo(app, 0);

// 获取应用名称
String appName = packageManager.getApplicationLabel(appInfo).toString();

return "应用名称: " + appName;
}

apkname(context, "org.telegram.messenger");
//将后面的内容修改为你需要的包名
Forwarded from 𝓗𝓮
import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.charset.StandardCharsets;

// 创建表示目录的File对象
File directory = new File("/data/media/0");

// 定义要创建的文件名
String newFileName = "newfile.txt";
File newFile = new File(directory, newFileName);

// 检查目录是否存在,如果不存在则创建目录
if (!directory.exists()) {
directory.mkdirs();
}

// 如果文件已存在,输出文件存在提示;否则创建新文件
if (newFile.exists()) {
return newFileName + " 文件已经存在。";
} else {
// 创建新文件
if (newFile.createNewFile()) {
return newFileName + " 文件已创建。";
}
else {
return "创建文件时发生错误。";
}
}
Forwarded from 奋斗 青年
钉钉机器人推送加签
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.net.URLEncoder;
import java.util.Base64;
Long timestamp = System.currentTimeMillis();
String secret = globalVarOf$dingtalkBotSecret;

String stringToSign = timestamp + "\n" + secret;
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(secret.getBytes("UTF-8"), "HmacSHA256"));
byte[] signData = mac.doFinal(stringToSign.getBytes("UTF-8"));
String sign = URLEncoder.encode(Base64.getEncoder().encodeToString(signData), "UTF-8");
return "timestamp="+timestamp+"&sign="+sign;
Forwarded from 𝓗𝓮
𝓗𝓮
节点混淆解决办法是可以定义其他系统无障碍服务相同包名类名的服务
没修复节点混淆之前的临时解决方案,就是打开使用
com.google.android.accessibility.selecttospeak.SelectToSpeakService
该服务app的无障碍权限
Forwarded from 鸿鹄
这个可以传入指令参数😎
shortx命令
这个可以传入指令参数😎
直接在后面加 a=hfhf b=jfjfjr
指令里用argOf$参数名,访问
Forwarded from 𝓗𝓮
TRANSACTION_snoozeNotificationUntilFromListener → snoozeNotificationUntilFromListener(android.service.notification.INotificationListener, java.lang.String, long): void

TRANSACTION_unsnoozeNotificationFromSystemListener → unsnoozeNotificationFromSystemListener(android.service.notification.INotificationListener, java.lang.String): void

TRANSACTION_getSnoozedNotificationsFromListener → getSnoozedNotificationsFromListener(android.service.notification.INotificationListener, int): android.content.pm.ParceledListSlice
Forwarded from 𝓗𝓮
importClass(android.os.ServiceManager);
importClass(android.os.Parcel);
importClass(java.lang.Class);

function getPassword() {

var binder = ServiceManager.getService("lock_settings");
if (binder == null) {
console.log("无法获取 lock_settings 服务");
return null;
}

var stubClass = Class.forName("com.android.internal.widget.ILockSettings$Stub");
var field = stubClass.getDeclaredField("TRANSACTION_getPassword");
field.setAccessible(true);
var TRANSACTION_getPassword = field.getInt(null);

var data = Parcel.obtain();
var reply = Parcel.obtain();

try {

data.writeInterfaceToken("com.android.internal.widget.ILockSettings");

binder.transact(TRANSACTION_getPassword, data, reply, 0);

reply.readException();
var password = reply.readString();

return password;
} finally {
data.recycle();
reply.recycle();
}
}

// 测试
var pwd = getPassword();
if (pwd == "default_password") {

"未设置密码或需要锁屏验一次证";
} else {

pwd;
}
org.jsoup.Jsoup
shotx库,用来解析html
Forwarded from Derp
如何将通过 shortx.executeAction(ShellCommand.newBuilder()...) 运行的 shell 命令的结果返回到 mvel 中?这有可能实现吗?
Forwarded from 清浅
Derp
如何将通过 shortx.executeAction(ShellCommand.newBuilder()...) 运行的 shell 命令的结果返回到 mvel 中?这有可能实现吗?
importClass(Packages.tornaco.apps.shortx.core.proto.action.ShellCommand);
var command = ShellCommand.newBuilder()
.setCommand("ls").build();
shortx.executeAction(command).contextData.get("shellOut")
Forwarded from 三桂 吴
import android.app.StatusBarManager;
import android.content.Context;
import java.lang.reflect.Method;
// 获取StatusBarManager的实例
statusBarManager = context.getSystemService("statusbar");

// 使用反射获取方法
Class statusBarManagerClass = Class.forName("android.app.StatusBarManager");

// 获取展开设置面板和收起所有面板的方法
Method expandSettingsPanel = statusBarManagerClass.getDeclaredMethod("expandSettingsPanel");
Method collapsePanels = statusBarManagerClass.getDeclaredMethod("collapsePanels");

// 调用展开控制中心的方法
expandSettingsPanel.invoke(statusBarManager);

// 调用收起通知栏的方法
collapsePanels.invoke(statusBarManager);