Android9.0和10.0插件化原理实现
Activity的插件化解决的一个根本性问题就是插件中的Activity并没有在宿主的AndroidManifest.xml中进行注册，也就是说我们需要启动一个未注册的Activity，因此需要对Activity的启动过程有个了解，Android各个版本源码启动流程略有不同,但大致流程一样，这里给出9.0和10.0实现的二种方式。
1.继承Instrumentation的方式，这种方式比较简单在9.0和10.0都能用
1.重写一个类继承Instrumentation
public class InstrumentationProxy extends Instrumentation { private Instrumentation mInstrumentation;
public InstrumentationProxy(Instrumentation instrumentation) {
mInstrumentation = instrumentation;
}
public ActivityResult execStartActivity(
Context who, IBinder contextThread, IBinder token, Activity target,
Intent intent, int requestCode, Bundle options) {
List resolveInfo = who.getPackageManager().queryIntentActivities(intent, PackageManager.MATCH_ALL);
LogUtil.logE("execStartActivityexecStartActivity");
//判断启动的插件Activity是否在AndroidManifest.xml中注册过
if (resolveInfo.size() == 0) {
//保存目标插件
intent.putExtra(Const.INTENT_DATA, intent.getComponent().getClassName());
//设置为占坑Activity
intent.setClassName(who, "com.example.client.hook.ProxyActivity");
}
try {
Method execStartActivity = getClass().getSuperclass().getDeclaredMethod("execStartActivity",
Context.class, IBinder.class, IBinder.class, Activity.class,
Intent.class, int.class, Bundle.class);
return (ActivityResult) execStartActivity.invoke(mInstrumentation, who, contextThread, token, target, intent, requestCode, options);
} catch (NoSuchMethodException e) {
e.printStackTrace();
} catch (IllegalAccessException e) {
e.printStackTrace();
} catch (InvocationTargetException e) {
e.printStackTrace();
}
return null;
}
@Override
public Activity newActivity(ClassLoader cl, String className, Intent intent) throws ClassNotFoundException, IllegalAccessException, InstantiationException {
String data = intent.getStringExtra(Const.INTENT_DATA);
if (!TextUtils.isEmpty(data)) {
return super.newActivity(cl, data, intent);
}
return super.newActivity(cl, className, intent);
}
}
2.在Application中onCreate方法中去替换我们自己的Instrumentation
private void hook1() { try {
Class clazz = Class.forName("android.app.ActivityThread");
//获取ActivityThread
Field sCurrentActivityThreadFiled = clazz.getDeclaredField("sCurrentActivityThread");
sCurrentActivityThreadFiled.setAccessible(true);
Object sCurrentActivityThread = sCurrentActivityThreadFiled.get(null);
//获取instrumentation
Field instrumentationFiled = clazz.getDeclaredField("mInstrumentation");
instrumentationFiled.setAccessible(true);
Instrumentation instrumentation = (Instrumentation) instrumentationFiled.get(sCurrentActivityThread);
//设置自己的instrumentation
InstrumentationProxy instrumentationProxy = new InstrumentationProxy(instrumentation);
instrumentationFiled.set(sCurrentActivityThread,instrumentationProxy);
} catch (Exception e) {
}
}
2.使用动态代理的方式，拦截启动activity的方法替换intent
大体的时序图
private void hook() {
try {
//1.获取IActivityManagerSingleton
Object IActivityManagerSingleton = getSingletonByVersion();
//2.获取mInstance
Class singletonclazz = Class.forName("android.util.Singleton");
Field mInstanceField = singletonclazz.getDeclaredField("mInstance");
mInstanceField.setAccessible(true);
if (Build.VERSION.SDK_INT == 29) {
//Q上需要动态执行create方法
Method getMethod = singletonclazz.getMethod("get");
getMethod.setAccessible(true);
getMethod.invoke(IActivityManagerSingleton);
}
Object mInstance = mInstanceField.get(IActivityManagerSingleton);
Logutils.LogE(mInstance+"");
//3.动态代理设置自己的mInstance
Object proxyInstance = Proxy.newProxyInstance(getClassLoader(),
mInstance.getClass().getInterfaces(),
new MyInvocationHandler(mInstance));
//4.设置代理的proxyInstance
mInstanceField.set(IActivityManagerSingleton, proxyInstance);
//5.获取ActivityThread实例
Class ActivityThreadclass = Class.forName("android.app.ActivityThread");
Field sCurrentActivityThreadFiled = ActivityThreadclass.getDeclaredField(
"sCurrentActivityThread");
sCurrentActivityThreadFiled.setAccessible(true);
Object sCurrentActivityThread = sCurrentActivityThreadFiled.get(null);
//6.获取mH实例
Field mHFiled = ActivityThreadclass.getDeclaredField("mH");
mHFiled.setAccessible(true);
Object mH = mHFiled.get(sCurrentActivityThread);
Field mCallbackFiled = Handler.class.getDeclaredField("mCallback");
mCallbackFiled.setAccessible(true);
//7.设置进入我们自己的Callback
mCallbackFiled.set(mH, new MyHandlerCallback((Handler) mH));
} catch (Exception e) {
e.printStackTrace();
Log.e("TAG------", e.toString());
}
}
需要注意的是10.0在获取mInstance的时候必须动态执行下create方法，否则拿不到mInstance 的实例.
private Object getSingletonByVersion() { try {
if (Build.VERSION.SDK_INT == 28) {
Class clazz = Class.forName("android.app.ActivityManager");
Field field = clazz.getDeclaredField("IActivityManagerSingleton");
field.setAccessible(true);
return field.get(null);
} else if (Build.VERSION.SDK_INT == 29) {
Class clazz = Class.forName("android.app.ActivityTaskManager");
Field field = clazz.getDeclaredField("IActivityTaskManagerSingleton");
field.setAccessible(true);
return field.get(null);
}
} catch (Exception e) {
e.printStackTrace();
Logutils.LogE(e.toString());
}
return null;
}
10.0和9.0获取SingleTon的方法也略有不同,10.0把几个类修改了下，但大致流程相同
private class MyInvocationHandler implements InvocationHandler {
private Object mIActivityManager;
public MyInvocationHandler(Object IActivityManager) {
mIActivityManager = IActivityManager;
}
@Override
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
if (method.getName().equals("startActivity")) {
for (Object arg : args) {
if (arg instanceof Intent) {
Intent intent = (Intent) arg;
//把插件的Activity类名传入
intent.putExtra(INTENT_DATA, intent.getComponent().getClassName());
//设置代理的activity
intent.setClass(getApplicationContext(), ProxyActivity.class);
}
}
}
return method.invoke(mIActivityManager, args);
}
}
使用动态让代理拦截startActivity方法替换intent里面的class绕过AndroidManifest的检测，并把我们设置的class当作参数传递。
private class MyHandlerCallback implements Handler.Callback { private Handler mHandler;
public MyHandlerCallback(Handler handler) {
mHandler = handler;
}
@Override
public boolean handleMessage(@NonNull Message msg) {
if (msg.what == 159) {
Object obj = msg.obj;
try {
//获取ClientTransaction中的mActivityCallbacks集合
Class clazz = Class.forName("android.app.servertransaction" +
".ClientTransaction");
Field mActivityCallbacksFiled = clazz.getDeclaredField("mActivityCallbacks");
mActivityCallbacksFiled.setAccessible(true);
List list = (List) mActivityCallbacksFiled.get(obj);
if (list != null && list.size() > 0) {
//得到集合中的LaunchActivityItem
Object o = list.get(0);
//获取LaunchActivityItem中的mIntent
Class LaunchActivityItemClazz = Class.forName("android.app" +
".servertransaction.LaunchActivityItem");
Field mIntentFiled = LaunchActivityItemClazz.getDeclaredField("mIntent");
mIntentFiled.setAccessible(true);
Intent intent = (Intent) mIntentFiled.get(o);
//得到我们设置的class 替换进去
if (intent.getStringExtra(INTENT_DATA) != null) {
String className = intent.getStringExtra(INTENT_DATA);
intent.setClassName(getApplicationContext(), className);
}
}
} catch (Exception e) {
e.printStackTrace();
Logutils.LogE(e.toString());
}
}
mHandler.handleMessage(msg);
return true;
}
}
在ActivityThread回调的handlemessage方法中在创建activity时来替换我们原来设置的Activity，从intent中获取我们设置的参数, 有了上面的代码后在Activity中可以正常运行但是在AppcompatActivity中还是报错需要再次Hook
private void hook1() { try {
Class ActivityThreadclass = Class.forName("android.app.ActivityThread");
Field sCurrentActivityThreadFiled = ActivityThreadclass.getDeclaredField(
"sCurrentActivityThread");
sCurrentActivityThreadFiled.setAccessible(true);
Object sCurrentActivityThread = sCurrentActivityThreadFiled.get(null);
Field sPackageManagerFiled = ActivityThreadclass.getDeclaredField(
"sPackageManager");
sPackageManagerFiled.setAccessible(true);
Object sPackageManager = sPackageManagerFiled.get(null);
Object proxyInstance = Proxy.newProxyInstance(getClassLoader(),
sPackageManager.getClass().getInterfaces(),
new PackageManagerHandler(sPackageManager));
sPackageManagerFiled.set(sCurrentActivityThread, proxyInstance);
} catch (Exception e) {
e.printStackTrace();
}
}
private class PackageManagerHandler implements InvocationHandler {
private Object IPackageManager;
public PackageManagerHandler(Object IPackageManager) {
this.IPackageManager = IPackageManager;
}
@Override
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
if ("getActivityInfo".equals(method.getName())) {
args[0] = new ComponentName(getPackageName(), ProxyActivity.class.getName());
}
return method.invoke(IPackageManager, args);
}
}
在getActivityInfo时候找不到我们的Activity，依然使用动态代理的方式替换我们代理的Activity。
作者：digtal_
链接：https://www.jianshu.com/p/ab97cb4392b4
关注我获取更多知识或者投稿
