基础书籍推荐:1.疯狂JAVA讲义；2.疯狂安卓讲义；

逆向分析必须知道他的原理，不然只会用工具，那就直接GG。

谷歌的镜像网站：https://developers.google.com/android/images

选择

n2g47o

然后要准备的东西有

1.上面的系统包
2.twrp
3.supersu

下载解压完成后，进入bootloader，然后./flash-all.sh

adb push SR5-SuperSU-v2.82-SR5-20171001224502.zip /sdcard

adb push de.robv.android.xposed.installer_3.1.5-43_minAPI15\(nodpi\)_apkmirror.com.apk /sdcard/Download/

adb reboot bootloader

fastboot flash recovery twrp-3.3.0-0-bullhead.img

然后如果失败的话就在本地进行fastboot替换就可以了。

然后再常规刷入即可。

【亲测有效】开机后wifi有感叹号, 时间无法同步解决办法 
在手机的shell里以root用户执行：
# settings put global captive_portal_http_url https://www.google.cn/generate_204
# settings put global captive_portal_https_url https://www.google.cn/generate_204
# settings put global ntp_server 1.hk.pool.ntp.org
# reboot

手调smail开始了

Xposed开发环境和Hello

<?xml version="1.0" encoding="utf-8"?>
<androidx.constraintlayout.widget.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto"
    xmlns:tools="http://schemas.android.com/tools"
    android:layout_width="match_parent"
    android:layout_height="match_parent"
    tools:context=".MainActivity">


    <TextView
        android:id="@+id/textView"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="请输入纯数字噢"
        app:layout_constraintBottom_toBottomOf="parent"
        app:layout_constraintLeft_toLeftOf="parent"
        app:layout_constraintRight_toRightOf="parent"
        app:layout_constraintTop_toTopOf="parent" />


    <EditText
        android:id="@+id/editText"
        android:hint="username"
        android:layout_width="fill_parent"
        android:layout_height="40dp"
        android:maxLength="20"
        app:layout_constraintBottom_toBottomOf="parent"
        app:layout_constraintEnd_toEndOf="parent"
        app:layout_constraintHorizontal_bias="1.0"
        app:layout_constraintStart_toStartOf="parent"
        app:layout_constraintTop_toTopOf="parent"
        app:layout_constraintVertical_bias="0.095" />

    <EditText
        android:id="@+id/editText2"
        android:hint="password"
        android:layout_width="fill_parent"
        android:layout_height="40dp"
        android:maxLength="20"
        app:layout_constraintBottom_toBottomOf="parent"
        app:layout_constraintTop_toTopOf="parent"
        app:layout_constraintVertical_bias="0.239" />

    <Button
        android:id="@+id/button"
        android:layout_width="100dp"
        android:layout_height="35dp"
        android:layout_gravity="right|center_horizontal"
        android:text="LOGIN"
        android:visibility="visible"
        app:layout_constraintBottom_toBottomOf="parent"
        app:layout_constraintEnd_toEndOf="parent"
        app:layout_constraintStart_toStartOf="parent"
        app:layout_constraintTop_toTopOf="parent"
        app:layout_constraintVertical_bias="0.745" />

</androidx.constraintlayout.widget.ConstraintLayout>

package com.example.demo10;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Base64;
import android.util.Log;
import android.view.View;
import android.widget.EditText;
import android.widget.TextView;

public class MainActivity extends AppCompatActivity {

    EditText username_et;
    EditText password_et;
    TextView message_tv;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        Log.i("demo10roysue","Hello from demo10!");

        password_et = (EditText) this.findViewById(R.id.editText2);
        username_et = (EditText) this.findViewById(R.id.editText);
        message_tv = ((TextView) findViewById(R.id.textView));

        this.findViewById(R.id.button).setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {

                if (username_et.getText().toString().compareTo("admin") == 0) {
                    message_tv.setText("You cannot login as admin");
                    return;
                }
                //hook target
                message_tv.setText("Sending to the server :" + Base64.encodeToString((username_et.getText().toString() + ":" + password_et.getText().toString()).getBytes(), Base64.DEFAULT));

            }
        });

    }
}