Android 用 AccessibilityService 做钉钉自动签到

无障碍配置放到 res/xml/accessibility_service_config.xml，这里直接限定了目标包名 com.alibaba.android.rimet。

<?xml version="1.0" encoding="utf-8"?>
<accessibility-service xmlns:android="http://schemas.android.com/apk/res/android"
    android:accessibilityEventTypes="typeAllMask"
    android:accessibilityFeedbackType="feedbackGeneric"
    android:accessibilityFlags="flagDefault"
    android:canRetrieveWindowContent="true"
    android:description="@string/accessibility_description"
    android:notificationTimeout="100"
    android:packageNames="com.alibaba.android.rimet" />

启动第三方应用

先写一个工具类，按包名找到启动入口并拉起应用。这里用了 PackageManager.queryIntentActivities()，再反查出 Launcher 对应的 Activity。

package com.example.dingsign;

import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.pm.PackageInfo;
import android.content.pm.PackageManager;
import android.content.pm.ResolveInfo;

public class Utils {
    public static void openApp(String packageName, Context context) {
        PackageManager packageManager = context.getPackageManager();
        PackageInfo pi = null;
        try {
            pi = packageManager.getPackageInfo(packageName, 0);
        } catch (PackageManager.NameNotFoundException e) {
            e.printStackTrace();
            return;
        }
        Intent resolveIntent = new Intent(Intent.ACTION_MAIN, null);
        resolveIntent.addCategory(Intent.CATEGORY_LAUNCHER);
        resolveIntent.setPackage(pi.packageName);
        java.util.List<ResolveInfo> apps = packageManager.queryIntentActivities(resolveIntent, 0);
        ResolveInfo ri = apps.iterator().next();
        if (ri != null) {
            String className = ri.activityInfo.name;
            Intent intent = new Intent(Intent.ACTION_MAIN);
            intent.addCategory(Intent.CATEGORY_LAUNCHER);
            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
            ComponentName cn = new ComponentName(packageName, className);
            intent.setComponent(cn);
            context.startActivity(intent);
        }
    }
}

来电触发入口

PhoneReceiver 监听电话状态。收到指定号码时，启动钉钉，并把无障碍服务状态重置为可执行。

package com.example.dingsign;

import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.telephony.TelephonyManager;
import android.util.Log;

public class PhoneReceiver extends BroadcastReceiver {
    private static final String TAG = "PhoneReceiver";
    private static boolean mIncomingFlag = false;
    private static String mIncomingNumber = null;

    @Override
    public void onReceive(Context context, Intent intent) {
        String action = intent.getAction();
        if (Intent.ACTION_NEW_OUTGOING_CALL.equals(action)) {
            mIncomingFlag = false;
            String phoneNumber = intent.getStringExtra(Intent.EXTRA_PHONE_NUMBER);
            Log.i(TAG, "call OUT:" + phoneNumber);
        } else {
            TelephonyManager tManager = (TelephonyManager) context.getSystemService(Context.TELEPHONY_SERVICE);
            switch (tManager.getCallState()) {
                case TelephonyManager.CALL_STATE_RINGING:
                    mIncomingNumber = intent.getStringExtra("incoming_number");
                    Log.i(TAG, "RINGING:" + mIncomingNumber);
                    // 替换为你自己的手机号进行匹配
                    if (mIncomingNumber != null && mIncomingNumber.equals("你的手机号")) {
                        Utils.openApp("com.alibaba.android.rimet", context);
                        DingService.instance.setServiceEnable();
                    }
                    break;
                case TelephonyManager.CALL_STATE_OFFHOOK:
                    if (mIncomingFlag) {
                        Log.i(TAG, "incoming ACCEPT:" + mIncomingNumber);
                    }
                    break;
                case TelephonyManager.CALL_STATE_IDLE:
                    if (mIncomingFlag) {
                        Log.i(TAG, "incoming IDLE");
                    }
                    break;
            }
        }
    }
}

无障碍服务里的点击逻辑

核心还是遍历节点树。先找'工作'，再找'签到'，中间如果弹出引导页或者提示框，就顺手点掉。这个实现比较朴素，但胜在容易读，排障时也不绕。

package com.example.dingsign;

import android.accessibilityservice.AccessibilityService;
import android.view.accessibility.AccessibilityEvent;
import android.view.accessibility.AccessibilityNodeInfo;
import android.widget.Toast;
import android.util.Log;

import java.util.ArrayList;
import java.util.List;

public class DingService extends AccessibilityService {
    private static final String TAG = "DingService";
    private boolean isFinish = false;
    public static DingService instance;
    private int index = 1; // 状态机索引

    @Override
    public void onAccessibilityEvent(AccessibilityEvent event) {
        if (isFinish) return;

        AccessibilityNodeInfo nodeInfo = getRootInActiveWindow();
        if (nodeInfo == null) {
            Log.w(TAG, "rootWindow 为空");
            return;
        }

        switch (index) {
            case 1:
                OpenHome(event.getEventType(), nodeInfo);
                break;
            case 2:
                OpenQianDao(event.getEventType(), nodeInfo);
                break;
            case 3:
                doQianDao(event.getEventType(), nodeInfo);
                break;
            default:
                break;
        }
    }

    private void OpenHome(int type, AccessibilityNodeInfo nodeInfo) {
        if (type == AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED) {
            List<AccessibilityNodeInfo> homeList = nodeInfo.findAccessibilityNodeInfosByText("工作");
            if (!homeList.isEmpty()) {
                click("工作");
                index = 2;
                Log.i(TAG, "点击进入主页签到");
            }
        }
    }

    private void OpenQianDao(int type, AccessibilityNodeInfo nodeInfo) {
        if (type == AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED) {
            List<AccessibilityNodeInfo> qianList = nodeInfo.findAccessibilityNodeInfosByText("签到");
            if (!qianList.isEmpty()) {
                click("签到");
                index = 3;
                Log.i(TAG, "点击进入签到页面详情");
            }
        }
    }

    private void doQianDao(int type, AccessibilityNodeInfo nodeInfo) {
        if (type == AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED) {
            // 处理弹窗或引导页
            List<AccessibilityNodeInfo> case1 = nodeInfo.findAccessibilityNodeInfosByText("开启我的签到之旅");
            if (!case1.isEmpty()) {
                click("开启我的签到之旅");
                Log.i(TAG, "点击签到之旅");
            }
            List<AccessibilityNodeInfo> case2 = nodeInfo.findAccessibilityNodeInfosByText("我知道了");
            if (!case2.isEmpty()) {
                click("我知道了");
                Log.i(TAG, "点击我知道对话框");
            }
            // 最终签到按钮
            List<AccessibilityNodeInfo> case3 = nodeInfo.findAccessibilityNodeInfosByText("签到");
            if (!case3.isEmpty()) {
                Toast.makeText(getApplicationContext(), "发现目标啦", Toast.LENGTH_SHORT).show();
                click("签到");
                isFinish = true;
            }
        }
    }

    // 通过文字查找并点击
    private boolean click(String viewText) {
        AccessibilityNodeInfo nodeInfo = getRootInActiveWindow();
        if (nodeInfo == null) {
            Log.w(TAG, "点击失败，rootWindow 为空");
            return false;
        }
        List<AccessibilityNodeInfo> list = nodeInfo.findAccessibilityNodeInfosByText(viewText);
        if (list.isEmpty()) {
            Log.w(TAG, "点击失败，" + viewText + "控件列表为空");
            return false;
        } else {
            AccessibilityNodeInfo view = list.get(0);
            return onclick(view);
        }
    }

    // 递归向上查找可点击的父节点
    private boolean onclick(AccessibilityNodeInfo view) {
        if (view.isClickable()) {
            view.performAction(AccessibilityNodeInfo.ACTION_CLICK);
            Log.w(TAG, "点击成功");
            return true;
        } else {
            AccessibilityNodeInfo parent = view.getParent();
            if (parent == null) return false;
            return onclick(parent);
        }
    }

    @Override
    protected void onServiceConnected() {
        super.onServiceConnected();
        Log.i(TAG, "service connected!");
        Toast.makeText(getApplicationContext(), "连接成功", Toast.LENGTH_SHORT).show();
        instance = this;
    }

    public void setServiceEnable() {
        isFinish = false;
        Toast.makeText(getApplicationContext(), "服务可用开启", Toast.LENGTH_SHORT).show();
        index = 1;
    }

    @Override
    public void onInterrupt() {
    }
}

调试时常见的几个坑

• 权限没开，服务就不会连上。安装完还得去系统设置里手动启用无障碍。
• 页面节点不是固定的。钉钉版本一变，文本、层级、弹窗样式都可能跟着变，findAccessibilityNodeInfosByText() 也就不一定还能命中。
• 点击太快容易失效。必要时加一点延时，别一股脑把所有动作都打出去。
• 服务容易被系统回收，实际用的时候最好考虑前台服务或电池优化白名单，不然跑着跑着就断了。

安全和合规

无障碍权限的能力很大，能读屏幕内容，也能模拟输入，权限边界比普通应用宽得多。只装可信来源的应用，这个不用解释。

另外，签到自动化本身也可能触发平台风控。它能省操作，但不等于适合长期、无节制地跑。还有一点，别把这类能力拿去做爬取、绕过限制或者别的违规操作。

小结

这套方案的关键不在'自动点一下'，而在把触发、页面识别和状态控制拆开。触发层负责把应用拉起来，无障碍服务负责找节点和点按钮，状态机负责把流程收住。页面改动是迟早的事，代码写得越死，后面维护就越麻烦。