基本使用：http://www.jianshu.com/p/56d10037e116
基本原理
加载patch，使用DexFile读取其中的dex文件，根据注释，获得需要修改的类名和方法名，反射后得到bugMethod，在native层使用指针替换bug对象的属性；
Paste_Image.png
源码解析
在自定义Application类中，初始化PatchManager.
PatchManager mPatchManager = new PatchManager();
在源码中PatchManager的构造方法：
public PatchManager(Context context) {
mContext = context;
mAndFixManager = new AndFixManager(mContext);//初始化AndFxiManager
mPatchDir = new File(mContext.getFilesDir(), DIR);//初始化存放patch的文件夹
mPatchs = new ConcurrentSkipListSet();//初始化存在patch类的集合，即需要修复类的集合
mLoaders = new ConcurrentHashMap();//初始化类对应的classLoader集合
}
看AndFixManager的构造方法：
public AndFixManager(Context context) {
mContext = context;
mSupport = Compat.isSupport();//判断是否支持当前机型
if (mSupport) {
mSecurityChecker = new SecurityChecker(mContext);//
mOptDir = new File(mContext.getFilesDir(), DIR);//初始化patch存放目录
if (!mOptDir.exists() && !mOptDir.mkdirs()) {// make directory fail
mSupport = false;
Log.e(TAG, "opt dir create error.");
} else if (!mOptDir.isDirectory()) {// not directory
mOptDir.delete();
mSupport = false;
}
}
}
其中，检查是否支持当前机型：
public static synchronized boolean isSupport() {
//isChecked保证只检查一次
if (isChecked)
return isSupport;
isChecked = true;
//判断是否为YunOs,是否已经初始化完成，是否为支持的sdk版本
if (!isYunOS() && AndFix.setup() && isSupportSDKVersion()) {
isSupport = true;
}
//可自定义加入不予修复的名单中
if (inBlackList()) {
isSupport = false;
}
return isSupport;
}
@SuppressLint("DefaultLocale")
//判断是否为YunOS
private static boolean isYunOS() {
String version = null;
String vmName = null;
try {
Method m = Class.forName("android.os.SystemProperties").getMethod(
"get", String.class);
version = (String) m.invoke(null, "ro.yunos.version");
vmName = (String) m.invoke(null, "java.vm.name");
} catch (Exception e) {
// nothing todo
}
if ((vmName != null && vmName.toLowerCase().contains("lemur"))
|| (version != null && version.trim().length() > 0)) {
return true;
}else {
return false;
}
}
//支持版本范围：2.3 to 6.0
private static boolean isSupportSDKVersion() {
if (android.os.Build.VERSION.SDK_INT >= 8
&& android.os.Build.VERSION.SDK_INT <= 23) {
return true;
}
return false;
}
private static boolean inBlackList() {
return false;
}
是否初始化：
public static boolean setup() {
try {
final String vmVersion = System.getProperty("java.vm.version");
boolean isArt = vmVersion != null && vmVersion.startsWith("2");
int apilevel = Build.VERSION.SDK_INT;//判断是Art or Dalvik
return setup(isArt, apilevel);
} catch (Exception e) {
Log.e(TAG, "setup", e);
return false;
}
}
Art与Dalvik的区别：
Dalvik：即用于android的java虚拟机，与传统的JVM一样，是运行时编译；
Art：即Android run time，是在android4.4版本引入的安卓虚拟机。特点为在安装时编译，因此app只会在安装时编译一次，运行时不需要，提高了系统的运行效率。
使用中的初始化版本：
mPatchManager.init("version")
init源码：
public void init(String appVersion) {
if (!mPatchDir.exists() && !mPatchDir.mkdirs()) {// make directory fail
Log.e(TAG, "patch dir create error.");
return;
} else if (!mPatchDir.isDirectory()) {// not directory
mPatchDir.delete();
return;
}
//存储关于patch文件的信息
SharedPreferences sp = mContext.getSharedPreferences(SP_NAME,
Context.MODE_PRIVATE);
String ver = sp.getString(SP_VERSION, null);
//如果版本号与当前出入的版本号不同，则直接清空所有已加载的patch
//否则进行初始化
if (ver == null || !ver.equalsIgnoreCase(appVersion)) {
cleanPatch();
sp.edit().putString(SP_VERSION, appVersion).commit();
} else {
initPatchs();
}
}
patch的初始化(通过JarFile来读取patch的内容)
private void init() throws IOException {
JarFile jarFile = null;
InputStream inputStream = null;
try {
jarFile = new JarFile(mFile);
JarEntry entry = jarFile.getJarEntry(ENTRY_NAME);
inputStream = jarFile.getInputStream(entry);
Manifest manifest = new Manifest(inputStream);
Attributes main = manifest.getMainAttributes();
mName = main.getValue(PATCH_NAME);//获取META-INF/PATCH.MF
mTime = new Date(main.getValue(CREATED_TIME));//
mClassesMap = new HashMap>();
Attributes.Name attrName;
String name;
List strings;
for (Iterator it = main.keySet().iterator(); it.hasNext();) {
attrName = (Attributes.Name) it.next();
name = attrName.toString();
//判断name的后缀是否是-Classes，并把name对应的值加入到集合中，对应的值就是class类名的列表，在loadPatch的时候，会需要每个patch对应的类名集合
if (name.endsWith(CLASSES)) {
strings = Arrays.asList(main.getValue(attrName).split(","));
if (name.equalsIgnoreCase(PATCH_CLASSES)) {//获取Patch-Name
mClassesMap.put(mName, strings);
} else {
mClassesMap.put(name.trim().substring(0, name.length() - 8),// remove
strings);
}
}
}
} finally {
if (jarFile != null) {
jarFile.close();
}
if (inputStream != null) {
inputStream.close();
}
}
}
loadPatch
mPatchManager.loadPatch();
源码：
public void loadPatch() {
mLoaders.put("*", mContext.getClassLoader());// wildcard
Set patchNames;
List classes;
for (Patch patch : mPatchs) {
patchNames = patch.getPatchNames();
for (String patchName : patchNames) {
classes = patch.getClasses(patchName);////获取patch对用的class类的集合List
mAndFixManager.fix(patch.getFile(),mContext.getClassLoader(),classes);//bugFix
}
}
}
bugfix
public synchronized void fix(File file, ClassLoader classLoader,List classes) {
if (!mSupport) {
return;
}
//检查patch的签名
if (!mSecurityChecker.verifyApk(file)) {// security check fail
return;
}
try {
File optfile = new File(mOptDir, file.getName());
boolean saveFingerprint = true;
if (optfile.exists()) {
if (mSecurityChecker.verifyOpt(optfile)) {
saveFingerprint = false;
} else if (!optfile.delete()) {
return;
}
}
//加载patch文件中的DexFile
final DexFile dexFile = DexFile.loadDex(file.getAbsolutePath(),optfile.getAbsolutePath(), Context.MODE_PRIVATE);
if (saveFingerprint) {
mSecurityChecker.saveOptSig(optfile);
}
ClassLoader patchClassLoader = new ClassLoader(classLoader) {
//重写ClasLoader的findClass方法
@Override
protected Class findClass(String className) throws ClassNotFoundException {
Class clazz = dexFile.loadClass(className, this);
if (clazz == null&& className.startsWith("com.alipay.euler.andfix")) {
return Class.forName(className);// annotation’s class
}
if (clazz == null) {
throw new ClassNotFoundException(className);
}
return clazz;
}
};
Enumeration entrys = dexFile.entries();
Class clazz = null;
while (entrys.hasMoreElements()) {
String entry = entrys.nextElement();
if (classes != null && !classes.contains(entry)) {
continue;// skip, not need fix
}
clazz = dexFile.loadClass(entry, patchClassLoader);
if (clazz != null) {
fixClass(clazz, classLoader);
}
}
} catch (IOException e) {
Log.e(TAG, "pacth", e);
}
}
private void fixClass(Class clazz, ClassLoader classLoader) {
Method[] methods = clazz.getDeclaredMethods();
MethodReplace methodReplace;
String clz;
String meth;
for (Method method : methods) {
//获取此方法的注解
methodReplace = method.getAnnotation(MethodReplace.class);
if (methodReplace == null)
continue;
clz = methodReplace.clazz();//获取注解中clazz的值
meth = methodReplace.method();//获取注解中method的值
if (!isEmpty(clz) && !isEmpty(meth)) {
replaceMethod(classLoader, clz, meth, method);
}
}
}
private void replaceMethod(ClassLoader classLoader, String clz,
String meth, Method method) {
try {
String key = clz + "@" + classLoader.toString();
Class clazz = mFixedClass.get(key);
if (clazz == null) {// class not load
Class clzz = classLoader.loadClass(clz);
// initialize target class
clazz = AndFix.initTargetClass(clzz);
}
if (clazz != null) {// initialize class OK
mFixedClass.put(key, clazz);
Method src = clazz.getDeclaredMethod(meth, method.getParameterTypes());//获取有bug的method
AndFix.addReplaceMethod(src, method);//native层中替换指针
}
} catch (Exception e) {
Log.e(TAG, "replaceMethod", e);
}
}
反编译dex文件
Paste_Image.png
可看到其中注释，包括类名+方法名