Injector.java

package com.elynx.pogoxmitm;

import android.os.Build;

import java.io.InputStream;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.nio.ByteBuffer;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;

/**
 * Class that manages injection of code into target app
 */
public class Injector implements IXposedHookLoadPackage {
    protected static String[] Methods = {"GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS", "TRACE"};

    protected static ThreadLocal<RpcContext> rpcContext = new ThreadLocal<RpcContext>() {
        @Override
        protected RpcContext initialValue() {
            return new RpcContext();
        }
    };

    public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
        if (!lpparam.packageName.equals("com.nianticlabs.pokemongo"))
            return;

        String NiaNetName = "com.nianticlabs.nia.network.NiaNet";

        // real http class names are from
        // https://goshin.github.io/2016/07/14/Black-box-test-using-Xposed/
        String HttpURLConnectionImplName;
        int apiLevel = Build.VERSION.SDK_INT;

        if (apiLevel >= 23) {
            HttpURLConnectionImplName = "com.android.okhttp.internal.huc.HttpURLConnectionImpl";
        } else if (apiLevel >= 19) {
            HttpURLConnectionImplName = "com.android.okhttp.internal.http.HttpURLConnectionImpl";
        } else {
            HttpURLConnectionImplName = "libcore.net.http.HttpURLConnectionImpl";
        }

        XposedBridge.log("Injecting into PoGo");

        // methods below are roughly in order or being called
        // note that joinHeaders and readDataSteam are called from doSyncRequest
        // method is executed in unknown context, make sure this is response for NiaNet
        findAndHookMethod(HttpURLConnectionImplName, lpparam.classLoader,
                "getOutputStream",
                new XC_MethodHook() {
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        RpcContext context = rpcContext.get();

                        XposedBridge.log("[request] " + context.shortDump());

                        MitmOutputStream replacement = new MitmOutputStream((OutputStream) param.getResult(), context.requestId);
                        param.setResult(replacement);

                        if (BuildConfig.DEBUG) {
                            XposedBridge.log("Output stream replaced");
                        }
                    }
                });

        // method is executed in unknown context, make sure this is response for NiaNet
        findAndHookMethod(HttpURLConnectionImplName, lpparam.classLoader,
                "getInputStream",
                new XC_MethodHook() {
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        RpcContext context = rpcContext.get();

                        XposedBridge.log("[response] " + context.shortDump());

                        MitmInputStream replacement = new MitmInputStream((InputStream) param.getResult(), context.requestId);
                        param.setResult(replacement);

                        if (BuildConfig.DEBUG) {
                            XposedBridge.log("Input stream replaced");
                        }
                    }
                });
    }
}