深入浅出Service插件化原理

人生一切难题,知识给你答案

Service插件化的重点是保证它的优先级,需要一个真正的Service来实现,当启动插件Service时,就会先启动代理Service,当这个代理Service运行起来后,在它的onStartCommand等方法里面进行分发,执行插件Service的onCreate等方法,这种方案叫代理分发。

未命名文件 (9).png

也就是在启动插件Service时替换为代理Service,什么时候替换?通过startService方法启动Service会调用ContextWrapper的startService方法,如下所示:

//路径:/frameworks/base/core/java/android/content/ContextWrapper.java
public class ContextWrapper extends Context {
    
    Context mBase;
    
    ...
    
    @Override
    public ComponentName startService(Intent service) {
        return mBase.startService(service);
    }
    
    ...
}

在ContextWrapper的startService方法中调用mBase的startService方法,mBase的类型是Context,而Context是一个抽象类,内部定义了很多方法以及静态常量,它的具体实现类是ContextImpl,进入ContextImpl的startService方法:

    //路径:/frameworks/base/core/java/android/app/ContextImpl.java
    @Override
    public ComponentName startService(Intent service) {
        warnIfCallingFromSystemProcess();
        return startServiceCommon(service, false, mUser);
    }

ContextImpl的startService方法中又调用了startServiceCommon方法:

    //路径:/frameworks/base/core/java/android/app/ContextImpl.java
    private ComponentName startServiceCommon(Intent service, boolean requireForeground,
            UserHandle user) {
        try {
            validateServiceIntent(service);
            service.prepareToLeaveProcess(this);
            //注释1
            ComponentName cn = ActivityManager.getService().startService(
                mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(
                            getContentResolver()), requireForeground,
                            getOpPackageName(), user.getIdentifier());
            ...
            return cn;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

注释1处通过ActivityManager的getService方法获取ActivityManagerService的代理类IActivityManager,进入ActivityManager的getService方法:

    //路径:/frameworks/base/core/java/android/app/ActivityManager.java
    public static IActivityManager getService() {
        return IActivityManagerSingleton.get();
    }

    private static final Singleton IActivityManagerSingleton =
            new Singleton() {
                @Override
                protected IActivityManager create() {
                    final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                    final IActivityManager am = IActivityManager.Stub.asInterface(b);
                    return am;
                }
            };

getService方法通过IActivityManagerSingleton的get方法获取IActivityManager对象,IActivityManagerSingleton是一个单例类,在create方法中从ServiceManager中获取一个名叫“activity”的Service引用,同时也是IBinder类型的ActivityManagerService的引用,最后通过IActivityManager.Stub.asInterface方法将它转换成IActivityManager,看到IActivityManager.Stub.asInterface这段代码时可以知道这里采用的是AIDL方式来实现进程间通信,也就是说服务端ActivityManagerService会实现IActivityManager.Stub类并实现相应的方法。

继续回到ContextImpl的startServiceCommon方法:

    //路径:/frameworks/base/core/java/android/app/ContextImpl.java
    private ComponentName startServiceCommon(Intent service, boolean requireForeground,
            UserHandle user) {
        try {
            validateServiceIntent(service);
            service.prepareToLeaveProcess(this);
            //注释1
            ComponentName cn = ActivityManager.getService().startService(
                mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(
                            getContentResolver()), requireForeground,
                            getOpPackageName(), user.getIdentifier());
            ...
            return cn;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

在注释1处获取到ActivityManagerService的代理类IActivityManager,接着通过这个代理类向ActivityManagerService发送startService的消息。

将上面的知识点进行总结,如下图所示:

image.png

替换代理Service可以通过Hook IActivityManager生成动态代理类来实现。

Service插件化需要一个真正的Service来实现,先在AndroidManifest.xml中注册代理ProxyService:


    ...
    
        ...
        
    


接着启动插件Service:

public class MainActivity extends AppCompatActivity {

    private Button mBtnNormal;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        initViews();
        initEvent();
    }

    private void initViews(){
        mBtnNormal=findViewById(R.id.btn_normal);
    }
    private void initEvent(){
        mBtnNormal.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                Intent intent=new Intent(MainActivity.this,TargetService.class);
                startService(intent);
            }
        });
    }
}

这个TargetService用来模拟插件Service,不能够直接启动,因此需要Hook IActivityManager,定义替换IActivityManager的代理类IActivityManagerProxy,代码如下:

public class IActivityManagerProxy implements InvocationHandler {

    private Object mActivityManager;

    public IActivityManagerProxy(Object activityManager){
        this.mActivityManager=activityManager;
    }

    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        if("startService".equals(method.getName())){
            Intent intent=null;
            int index=0;
            for(int i=0,length=args.length;i

上述代码中通过拦截startService方法,获取启动TargetService的Intent,再创建代理Service的Intent,将TargetService的Intent的相关信息保存在代理Service的Intent中,最后将启动的Intent替换成代理Service的Intent,也就是说最后启动的是ProxyService。

接着用IActivityManagerProxy替换系统的IActivityManager,代码如下:

public class HookUtil {

    public static void hookAMS() {
        Object defaultSingleton = null;
        try {
            if (Build.VERSION.SDK_INT >= 26) {
                Class activityManagerClass = Class.forName("android.app.ActivityManager");
                Field field=activityManagerClass.getDeclaredField("IActivityManagerSingleton");
                field.setAccessible(true);
                defaultSingleton=field.get(null);
            } else {
                Class activityManagerNativeClass=Class.forName("android.app.ActivityManagerNative");
                Field field=activityManagerNativeClass.getDeclaredField("gDefault");
                field.setAccessible(true);
                defaultSingleton=field.get(null);
            }
            Class singletonClass=Class.forName("android.util.Singleton");
            Field mInstanceField=singletonClass.getDeclaredField("mInstance");
            mInstanceField.setAccessible(true);
            //获取IActivityManager
            Object iActivityManager=mInstanceField.get(defaultSingleton);
            
            Class iActivityManagerClazz=Class.forName("android.app.IActivityManager");
            
            Object proxy=Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(),
                    new Class[]{iActivityManagerClazz},new IActivityManagerProxy(iActivityManager));
            
            mInstanceField.set(defaultSingleton,proxy);
            
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        } catch (NoSuchFieldException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
    }

}

上述代码中主要做了这些事:

  • 对版本进行区分,最终获取的是Singleton类型的IActivityManagerSingleton或者gDefault字段。
  • 获取Singleton类中的mInstance字段并获取系统的IActivityManager。
  • 创建代理类IActivityManagerProxy,来替换系统的IActivityManager。

接着在Application中调用这个方法:

public class MyApplication extends Application {

    @Override
    protected void attachBaseContext(Context base) {
        super.attachBaseContext(base);
        HookUtil.hookAMS();
    }
}

到这里启动的Service不是插件的Service,而是代理的Service,接下来需要在ProxyService中进行代理分发。

public class ProxyService extends Service {
    @Override
    public IBinder onBind(Intent intent) {
        return null;
    }

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        if (null == intent || !intent.hasExtra("TARGET_SERVICE")) {
            return START_STICKY;
        }

        String serviceName = intent.getStringExtra("TARGET_SERVICE");
        if (TextUtils.isEmpty(serviceName)) {
            return START_STICKY;
        }

        //=============反射调用插件Service的attach方法===========================

        try {
            //获取attach方法需要的ActivityThread
            Class activityThreadClazz = Class.forName("android.app.ActivityThread");
            Field sCurrentActivityThread = activityThreadClazz.getDeclaredField("sCurrentActivityThread");
            sCurrentActivityThread.setAccessible(true);
            Object activityThread = sCurrentActivityThread.get(null);

            //获取attach方法需要的token
            Method getActivityThreadMethod = activityThreadClazz.getDeclaredMethod("getApplicationThread");
            getActivityThreadMethod.setAccessible(true);
            Object applicationThread = getActivityThreadMethod.invoke(activityThread);

            Class iInterfaceClazz = Class.forName("android.os.IInterface");
            Method asBinderMethod = iInterfaceClazz.getDeclaredMethod("asBinder");
            asBinderMethod.setAccessible(true);

            Object token = asBinderMethod.invoke(applicationThread);

            //反射获取attach方法
            Class serviceClazz = Class.forName("android.app.Service");
            Method attachMethod = serviceClazz.getDeclaredMethod("attach",
                    Context.class, activityThreadClazz, String.class, IBinder.class, Application.class, Object.class);
            attachMethod.setAccessible(true);

            //获取IActivityManager
            Object defaultSingleton = null;
            if (Build.VERSION.SDK_INT >= 26) {
                Class activityManagerClass = Class.forName("android.app.ActivityManager");
                Field field = activityManagerClass.getDeclaredField("IActivityManagerSingleton");
                field.setAccessible(true);
                defaultSingleton = field.get(null);
            } else {
                Class activityManagerNativeClass = Class.forName("android.app.ActivityManagerNative");
                Field field = activityManagerNativeClass.getDeclaredField("gDefault");
                field.setAccessible(true);
                defaultSingleton = field.get(null);
            }
            Class singletonClass = Class.forName("android.util.Singleton");
            Field mInstanceField = singletonClass.getDeclaredField("mInstance");
            mInstanceField.setAccessible(true);
            Object iActivityManager = mInstanceField.get(defaultSingleton);

            //反射执行插件Service
            Service targetService = (Service) Class.forName(serviceName).newInstance();
            attachMethod.invoke(targetService, this,
                    activityThread,
                    intent.getComponent().getClassName(),
                    token,
                    getApplication(),
                    iActivityManager);
            //执行插件Service的onCreate、onStartCommand方法
            targetService.onCreate();
            targetService.onStartCommand(intent,flags,startId);

        } catch (ClassNotFoundException e) {
            e.printStackTrace();
                       return START_STICKY;
        } catch (NoSuchMethodException e) {
            e.printStackTrace();
            return START_STICKY;
        } catch (NoSuchFieldException e) {
            e.printStackTrace();
            return START_STICKY;
        } catch (IllegalAccessException e) {
            e.printStackTrace();
            return START_STICKY;
        } catch (InvocationTargetException e) {
            e.printStackTrace();
            return START_STICKY;
        } catch (InstantiationException e) {
            e.printStackTrace();
            return START_STICKY;
        }
        return START_STICKY;
    }
}

上诉代码主要做了以下几件事:

  • 判断参数条件不满足、出现异常和代码执行完毕返回START_STICKY,这样ProxyService会重新创建并执行onStartCommand方法。
  • 创建插件Service,并反射调用attach方法。
  • 进行代理分发,执行插件Service的onCreate和onStartCommand方法。

插件TargetService如下所示:

public class TargetService extends Service {
    @Override
    public IBinder onBind(Intent intent) {
        return null;
    }

    @Override
    public void onCreate() {
        super.onCreate();
        Log.e("TargetService","----onCreate-----");
    }

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        Log.e("TargetService","----onStartCommand-----");
        return super.onStartCommand(intent, flags, startId);
    }
}

运行看是否会在onCreate和onStartCommand方法中打印Log:

wq2.gif

你可能感兴趣的:(深入浅出Service插件化原理)