java - Xposed で Android クラスをフックする

Question

Xposed フレームワークを使用してandroid.bluetooth.BluetoothGatt.writeCharacteristicメソッドにフックしようとしています。私の知る限り、Android のネイティブ bluetooth クラスのように動的にリンクされているメソッドにフックするにはどうすればよいですか? jdb でクラスを見つけて、次のようにその変数を出力できました。

> stop in android.bluetooth.BluetoothGatt.writeCharacteristic
Set breakpoint android.bluetooth.BluetoothGatt.writeCharacteristic
> 
Breakpoint hit: "thread=main", 
android.bluetooth.BluetoothGatt.writeCharacteristic(), line=926 bci=0

main[1] dump characteristic.mValue
 characteristic.mValue = {
 116, 101, 115, 116, 49, 51, 51
 }

ただし、Xposed フレームワークを使用してクラスをフックしようとすると、次のエラーが表示されます。

I/Xposed  (11661): Loaded app: com.macdom.ble.blescanner
E/Xposed  (11661): java.lang.NoSuchMethodError: android.bluetooth.BluetoothGatt#writeCharacteristic()#bestmatch
E/Xposed  (11661):  at de.robv.android.xposed.XposedHelpers.findMethodBestMatch(XposedHelpers.java:440)
E/Xposed  (11661):  at com.example.test.xposed3.Xposed3.handleLoadPackage(Xposed3.java:34)
E/Xposed  (11661):  at de.robv.android.xposed.IXposedHookLoadPackage$Wrapper.handleLoadPackage(IXposedHookLoadPackage.java:34)
E/Xposed  (11661):  at de.robv.android.xposed.callbacks.XC_LoadPackage.call(XC_LoadPackage.java:61)
E/Xposed  (11661):  at de.robv.android.xposed.callbacks.XCallback.callAll(XCallback.java:106)
E/Xposed  (11661):  at de.robv.android.xposed.XposedInit$2.beforeHookedMethod(XposedInit.java:116)
E/Xposed  (11661):  at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:314)
E/Xposed  (11661):  at android.app.ActivityThread.handleBindApplication(<Xposed>)
E/Xposed  (11661):  at android.app.ActivityThread.access$1500(ActivityThread.java:151)
E/Xposed  (11661):  at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1364)
E/Xposed  (11661):  at android.os.Handler.dispatchMessage(Handler.java:102)
E/Xposed  (11661):  at android.os.Looper.loop(Looper.java:135)
E/Xposed  (11661):  at android.app.ActivityThread.main(ActivityThread.java:5254)
E/Xposed  (11661):  at java.lang.reflect.Method.invoke(Native Method)
E/Xposed  (11661):  at java.lang.reflect.Method.invoke(Method.java:372)
E/Xposed  (11661):  at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
E/Xposed  (11661):  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)
E/Xposed  (11661):  at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:102)
I/Xposed  (11661): Calling com.macdom.ble.blescanner.a onStart()

java.lang.NoSuchMethodErrorエラーを引き起こす私のコードは次のとおりです。

package com.example.test.xposed3;

import java.lang.reflect.Method;

import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;
import static de.robv.android.xposed.XposedHelpers.findClass;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;

public class Xposed3 implements IXposedHookLoadPackage {
    public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
        if (!lpparam.packageName.equals("com.macdom.ble.blescanner"))
            return;

        XposedBridge.log("Loaded app: " + lpparam.packageName);

        findAndHookMethod("com.macdom.ble.blescanner.a", lpparam.classLoader, "onStart", new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                XposedBridge.log("Calling com.macdom.ble.blescanner.a onStart()");
            }
        });

        Class<?> BluetoothGatt = findClass("android.bluetooth.BluetoothGatt", lpparam.classLoader);
        Method writeCharacteristic = XposedHelpers.findMethodBestMatch(BluetoothGatt, "writeCharacteristic");
        XposedBridge.hookMethod(writeCharacteristic, new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                XposedBridge.log("Calling android.bluetooth.BluetoothGatt writeCharacteristic()");
            }
        });
    }
}