./adb push frida-server /data/local/tmp
./adb kill-server && ./adb server && ./adb shell    # 这里我用了mumu模拟器，其他虚拟机连接adb方法请自行查询
cd /data/local/tmp
chmod 777 frida-server
./frida-server   #开始你的炸弹秀

@JSONField(name = "vvLevel")
public String getVVLevel() {
    return this.vvLevel;
}

@JSONField(name = "isVV")
public boolean isVV() {
    return this.isVV;
}

public int getLevel() {
    if(this.level == 0) {
        this.level = 1;
    }

    return this.level;
}

if(Java.available) {
    Java.perform(function(){
        var application = Java.use("android.app.Application");

        application.attach.overload('android.content.Context').implementation = function(context) {
            var result = this.attach(context); // 先执行原来的attach方法
            var classloader = context.getClassLoader(); // 获取classloader
            Java.classFactory.loader = classloader;
            var Hook_class = Java.classFactory.use("com.xxx.类名"); 
            console.log("Hook_class: " + Hook_class);
            // 下面代码和写正常的hook一样
            Hook_class.方法名.implementation = function()  // 有参数填参数          
            {
                //要执行的操作
            }
            return result;
        }
    });
}

if(Java.available) {
    console.log('ok111');
    Java.perform(function(){
        var application = Java.use("android.app.Application");
        console.log('ok222');
        application.attach.overload('android.content.Context').implementation = function(context) {
            console.log('ok333');
            var result = this.attach(context); // 先执行原来的attach方法
            var classloader = context.getClassLoader(); // 获取classloader
            Java.classFactory.loader = classloader;
            console.log('ok444');

            var userinfo = Java.classFactory.use("com.xxx.bean.UserBean");
            console.log("user: " + userinfo);

            userinfo.getLevel.implementation = function(){
                return 10;
            }

            userinfo.isVV.implementation = function(){
                return true;
            }

            userinfo.getVVLevel.implementation = function(){
                return "9";
            }

            return result;
        }
    });
}

import frida, sys

# hook代码，采用javascript编写
jscode = """
    //javascript代码
"""

# 自定义回调函数
def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_usb_device().attach('应用完整包名')
script = process.create_script(jscode)
script.on('message', on_message)
script.load()
sys.stdin.read()