有android killer，现在ida对android的支持等一些方便工具，此篇（关于搜索和修改代码）废弃。
没有好的调试工具下
常用插代码（如果怕影响寄存器值，可以将.locals xxx改多几个或者合适的地方，如返回前添加）：
1.
const-string v7, "log.v(xx, yy);"
invoke-static {v7, v7}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I
## v0 来自原有代码String，可能为空需要检查，类似这样使用，万无一失
const-string v7, "log.v(xx, yy);"
if-nez v0, :cond_3
const-string v0, "null"
:cond_3
invoke-static {v7, v0}, Landroid/util/Log;->v(Ljava/lang/String;Ljava/lang/String;)I
invoke-static {v1, v2, v0}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;Ljava/lang/Throwable;)I
2.
const-string v0, "Must ensure vx is Context class, then Toast.makeText(vx, xxx, 1).show();" # CharSequence对象类型
const/4 v1, 0x1 # I int类型
invoke-static {p0, v0, v1}, Landroid/widget/Toast;->makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast; # p0 是一个Context
move-result-object v0
invoke-virtual {v0}, Landroid/widget/Toast;->show()V
3. 不需要这个，一般很多。Activity启动关键字： 如Landroid/content/Intent;->
如startActivity[ForResult(](Landroid/content/Intent;)V
Landroid/content/Context;->startActivity(Landroid/content/Intent;Landroid/os/Bundle;)V
new-instance ??, Landroid/content/ComponentName;
4. 打印堆栈到标准流或Logcat，使用局部变量：v0（new Exception）和v1（字符串）
#new Exception("print trace").printStackTrace();
new-instance v0,Ljava/lang/Exception;
const-string v1,"print trace"
invoke-direct {v0,v1}, Ljava/lang/Exception;->(Ljava/lang/String;)V
invoke-virtual {v0}, Ljava/lang/Exception;->printStackTrace()V
栈跟踪信息是WARN级别，而且Tag名称被系统命令为System.err. 命令行：adb logcat -s System.err:V *:W
.method private a(Lcom/netease/mobimail/m/c/c;Z)V
.locals 11
Log.e(v9, v2, (v10=new Exception(v9)));
const-string v9,"PrintTrace"
new-instance v10,Ljava/lang/Exception;
invoke-direct {v10,v9}, Ljava/lang/Exception;->(Ljava/lang/String;)V
invoke-static {v9, v2, v10}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;Ljava/lang/Throwable;)I
5. 一般耗时操作需要线程里执行，关注新增线程和线程堆栈变化
1.静态查看
方法搜索需要扩展到父类的方法搜索，如
.class public Lcom/dataviz/dxtg/common/android/launcher/TabbedLauncherActivity;
.super Lcom/dataviz/dxtg/common/android/ApplicationActivity;
# interfaces
.implements Landroid/view/GestureDetector$OnGestureListener;
.implements Lcom/dataviz/dxtg/common/android/ar;
.implements Lcom/dataviz/dxtg/common/android/bt;
.implements Lcom/dataviz/dxtg/common/android/cs;
.implements Lcom/dataviz/dxtg/common/android/dv;
.implements Lcom/dataviz/dxtg/common/android/iap/d;
.implements Lcom/dataviz/dxtg/common/android/iap/z;
.method public c()V
.end method
搜索方法
Lcom/dataviz/dxtg/common/android/launcher/TabbedLauncherActivity;->c()V
也许搜索没有结果，就有可能是父类或 接口。
这里是Lcom/dataviz/dxtg/common/android/dv;->c()V
.class public interface abstract Lcom/dataviz/dxtg/common/android/dv;
.super Ljava/lang/Object;
# virtual methods
.method public abstract a(Ljava/lang/String;)V
.end method
.method public abstract a(Z)V
.end method
.method public abstract c()V
.end method
结果
Searching 7287 files for "Lcom/dataviz/dxtg/common/android/dv;->c()V"
D:\com.dataviz.docstogo\smali\com\dataviz\dxtg\common\android\do.smali:
91: invoke-interface {v0}, Lcom/dataviz/dxtg/common/android/dv;->c()V
289: invoke-interface {v0}, Lcom/dataviz/dxtg/common/android/dv;->c()V
2 matches in 1 file
然后看看调用这个方法的所在方法有没有判断跳转语句，如果没有可能还要继续查看谁调用。
2. 动态/运行时查看
制造异常查看函数调用堆栈
在查看方法调用时，制造空指针异常。回溯方法调用堆栈
.method public c()V
.locals 1 ## .locals 1 romove desktop tab
const/4 v0, 0x0
#new-instance v0, Lcom/dataviz/dxtg/common/android/bl;
#invoke-direct {v0}, Lcom/dataviz/dxtg/common/android/bl;->()V
invoke-direct {p0, v0}, Lcom/dataviz/dxtg/common/android/launcher/TabbedLauncherActivity;->a(Landroid/support/v4/app/Fragment;)Z
return-void
.end method
堆栈截图
