又变了。。。
https://android.googlesource.com/platform/frameworks/base/+/refs/tags/android-platform-11.0.0_r7/services/core/java/com/android/server/pm/PackageManagerService.java#16016
/**
* Given {@code targetDir}, returns {@code targetDir/~~[randomStrA]/[packageName]-[randomStrB].}
* Makes sure that {@code targetDir/~~[randomStrA]} directory doesn't exist.
* Notice that this method doesn't actually create any directory.
*
* @param targetDir Directory that is two-levels up from the result directory.
* @param packageName Name of the package whose code files are to be installed under the result
* directory.
* @return File object for the directory that should hold the code files of {@code packageName}.
*/
private File getNextCodePath(File targetDir, String packageName) {
SecureRandom random = new SecureRandom();
byte[] bytes = new byte[16];
File firstLevelDir;
do {
random.nextBytes(bytes);
String dirName = RANDOM_DIR_PREFIX
+ Base64.encodeToString(bytes, Base64.URL_SAFE | Base64.NO_WRAP);
firstLevelDir = new File(targetDir, dirName);
} while (firstLevelDir.exists());
random.nextBytes(bytes);
String suffix = Base64.encodeToString(bytes, Base64.URL_SAFE | Base64.NO_WRAP);
return new File(firstLevelDir, packageName + "-" + suffix);
}
变为先在/data/app/目录下创建随机的目录,
/data/app/~~Hla4zz56jaUwsb44fhZDmg==/pkg-dpjGrfyX2aVwmhQt_Yg2Kw==/base.apk
前后都加了前缀,不确定为什么这么做,难道有什么绕过随机后缀的方式得到路径,不然为什么还非要再加个前缀,当然肯定是更安全了。