深入浅出Activity插件化相关原理

在这里插入图片描述

转载请标明出处:【顾林海的博客】
本篇文章已授权微信公众号 顾林海 独家发布

Activity的插件化解决的一个根本性问题就是插件中的Activity并没有在宿主的AndroidManifest.xml中进行注册,也就是说我们需要启动一个未注册的Activity,因此需要对Activity的启动过程有个了解。

启动Activity时会请求AMS创建Activity,这里的AMS指的是ActivityManagerService,AMS所属的进程与宿主(发起者)不属于同一个进程,AMS位于SystemServer进程中。

在这里插入图片描述

应用程序进程与AMS之间的通信是通过Binder来实现的,AMS要管理所有APP的启动请求,因此我们不能在SystemServer进程中进行相应的Hook,那么我们只能在应用进程中进行相应的Hook。

如果我们启动一个未注册的Activity,AMS会去检查AndroidManifest中是否注册了该Activity,如果未注册会报错。

在这里插入图片描述

为了让AMS验证通过,需要启动一个预先在AndroidManifest中注册的Activity,我们称之为占坑,在启动插件Activity时替换为占坑Activity,达到一个欺上瞒下的作用,当AMS验证通过之后,需要将启动的占坑Activity替换为插件Activity。

在这里插入图片描述

总结下来Activity的插件化需要做两件事:

  • 将请求启动的插件Activity替换为占坑Activity。
  • 绕过AMS验证后,将占坑Activity替换为插件Activity。

什么时候将插件Activity替换为占坑Activity?又是什么时候还原插件Activity?这需要我们对Activity的启动流程有个相应的认识。

Hook Instrumentation

我们在Activity中调用startActivity方法如下:

    @Override
    public void startActivity(Intent intent) {
        this.startActivity(intent, null);
    }
    
        @Override
    public void startActivity(Intent intent, @Nullable Bundle options) {
        if (options != null) {
           startActivityForResult(intent, -1, options);
        } else {
           startActivityForResult(intent, -1);
        }
    }

调用startActivityForResult方法:

    public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            //Activity启动
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);
            if (ar != null) {
                mMainThread.sendActivityResult(
                    mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                    ar.getResultData());
            }
            if (requestCode >= 0) {
                mStartedActivity = true;
            }

            cancelInputsAndStartExitTransition(options);
            windows.
        } else {
            if (options != null) {
                mParent.startActivityFromChild(this, intent, requestCode, options);
            } else {
                mParent.startActivityFromChild(this, intent, requestCode);
            }
        }
    }

startActivityForResult方法中通过调用mInstrumentation的execStartActivity方法来启动Activity,这个mInstrumentation是Activity的成员变量,在ActivityThread的performLaunchActivity方法中通过Activity的attach方法传入,同时Activity的创建也是在performLaunchActivity方法中创建的,通过mInstrumentation.newActivity。

//:/frameworks/base/core/java/android/app/ActivityThread.java
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    ...
    try {
        java.lang.ClassLoader cl = appContext.getClassLoader();
        activity = mInstrumentation.newActivity(
                    cl, component.getClassName(), r.intent);
        StrictMode.incrementExpectedActivityCount(activity.getClass());
        r.intent.setExtrasClassLoader(cl);
        r.intent.prepareToEnterProcess();
        if (r.state != null) {
            r.state.setClassLoader(cl);
        }
    }
    ...
    activity.attach(appContext, this, getInstrumentation(), r.token,
                        r.ident, app, r.intent, r.activityInfo, title, r.parent,
                        r.embeddedID, r.lastNonConfigurationInstances, config,
                        r.referrer, r.voiceInteractor, window, r.configCallback);
    ...
}

综上所述Instrumentation提供了execStartActivity方法来启动Activity,newActivity方法来创建Activity。因此,第一种方案就是用代理Instrumentation来替代Activity的Instrumentation,并在代理Instrumentation的execStartActivity方法中替换为占坑Activity,在newActivity方法还原插件Activity。

现在我们基于第一种方案Hook Instrumentation来实现Activity的插件化。

首先创建占坑Activity:

public class StubActivity extends AppCompatActivity {

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_stub);
    }
}

创建插件Activity:

public class TargetActivity extends AppCompatActivity {

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_target);
    }
}

并在AndroidManifest.xml中注册占坑Activity:

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.glh.haiproject01">

    <application
        android:name=".MyApplication"
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/AppTheme"
        tools:ignore="AllowBackup,GoogleAppIndexingWarning">
        <activity android:name=".MainActivity">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
        <activity android:name=".StubActivity" />
    </application>

</manifest>

在AndroidManifest.xml中没有注册插件Activity,这时如果启动插件Activity会报错。

最后Hook Instrumentation,将ActivityThread中的成员变量Instrumentation替换成代理的Instrumentation。

创建代理Instrumentation类:

public class InstrumentationProxy extends Instrumentation {

    private Instrumentation mInstrumentation;
    private PackageManager mPackageManager;

    public InstrumentationProxy(Instrumentation instrumentation, PackageManager packageManager) {
        this.mInstrumentation = instrumentation;
        this.mPackageManager = packageManager;
    }

    public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {

        List<ResolveInfo> resolveInfo = mPackageManager.queryIntentActivities(intent, PackageManager.MATCH_ALL);
        //判断启动的插件Activity是否在AndroidManifest.xml中注册过
        if (null == resolveInfo || resolveInfo.size() == 0) {
            //保存目标插件
            intent.putExtra(HookHelper.REQUEST_TARGET_INTENT_NAME, intent.getComponent().getClassName());
            //设置为占坑Activity
            intent.setClassName(who, "com.glh.haiproject01.StubActivity");
        }

        try {
            Method execStartActivity = Instrumentation.class.getDeclaredMethod("execStartActivity",
                    Context.class, IBinder.class, IBinder.class, Activity.class,
                    Intent.class, int.class, Bundle.class);
            return (ActivityResult) execStartActivity.invoke(mInstrumentation, who, contextThread, token, target, intent, requestCode, options);
        } catch (NoSuchMethodException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        } catch (InvocationTargetException e) {
            e.printStackTrace();
        }
        return null;
    }

    public Activity newActivity(ClassLoader cl, String className, Intent intent) throws InstantiationException,
            IllegalAccessException, ClassNotFoundException {
        String intentName=intent.getStringExtra(HookHelper.REQUEST_TARGET_INTENT_NAME);
        if(!TextUtils.isEmpty(intentName)){
            return super.newActivity(cl,intentName,intent);
        }
        return super.newActivity(cl,className,intent);
    }

}

代理类InstrumentationProxy的execStartActivity方法先判断插件Activity是否在AndroidManifest.xml中注册过,如果没有注册过就需要替换占坑的Activity,在newActivity方法中还原插件Activity。

代理类InstrumentationProxy写完后,需要对ActivityThread的成员变量mInstrumentation进行替换。

public class MyApplication extends Application {

    @Override
    protected void attachBaseContext(Context base) {
        super.attachBaseContext(base);
        hookActivityThreadInstrumentation();
    }


    private void hookActivityThreadInstrumentation(){
        try {
            Class<?> activityThreadClass=Class.forName("android.app.ActivityThread");
            Field activityThreadField=activityThreadClass.getDeclaredField("sCurrentActivityThread");
            activityThreadField.setAccessible(true);
            //获取ActivityThread对象sCurrentActivityThread
            Object activityThread=activityThreadField.get(null);

            Field instrumentationField=activityThreadClass.getDeclaredField("mInstrumentation");
            instrumentationField.setAccessible(true);
            //从sCurrentActivityThread中获取成员变量mInstrumentation
            Instrumentation instrumentation= (Instrumentation) instrumentationField.get(activityThread);
            //创建代理对象InstrumentationProxy
            InstrumentationProxy proxy=new InstrumentationProxy(instrumentation,getPackageManager());
            //将sCurrentActivityThread中成员变量mInstrumentation替换成代理类InstrumentationProxy
            instrumentationField.set(activityThread,proxy);
        } catch (NoSuchFieldException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        }
    }
}

这时我们在主界面点击跳转插件Activity:

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        findViewById(R.id.btn_startActivity).setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                Intent intent=new Intent(MainActivity.this,TargetActivity.class);
                startActivity(intent);
            }
        });
    }
}

运行效果:

在这里插入图片描述

Hook IActivityManager

第一种方案Hook Instrumentation已经顺利完成,接下来我们看第二个方案,还是看这段代码:

    public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            //Activity启动
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);
            if (ar != null) {
                mMainThread.sendActivityResult(
                    mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                    ar.getResultData());
            }
            if (requestCode >= 0) {
                mStartedActivity = true;
            }

            cancelInputsAndStartExitTransition(options);
            windows.
        } else {
            if (options != null) {
                mParent.startActivityFromChild(this, intent, requestCode, options);
            } else {
                mParent.startActivityFromChild(this, intent, requestCode);
            }
        }
    }

通过mInstrumentation的execStartActivity方法启动Activity,在execStartActivity方法中会获取AMS的代理,Android 7.0通过ActivityManagerNative的getDefault方法获取一个ActivityManagerProxy,这个ActivityManagerProxy内部封装了IBinder类型的ActivityManagerService的代理类,这样在应用程序进程中就可以通过这个ActivityManagerProxy与SystemServer进程的ActivityManagerService进行通信,而在Android 8.0去除了ActivityManagerProxy这个代理类,由IActivityManager代替,这里的IActivityManager.aidl通过AIDL工具自动生成IActivityManager.java。

Android 7.0-Activity启动

ActivityManager是一个和AMS相关联的类,它主要对运行中的Activity进行管理,ActivityManager中相关管理方法最终会通过ActivityManagerNative的getDefault方法来得到ActivityManagerProxy,再调用ActivityManagerProxy的相关管理方法,ActivityManagerProxy就是AMS的代理类,通过这个代理类就可以和AMS进行通信。

Android7.0的Activity启动过程会调用Instrumentation的execStartActivity方法,代码如下:

public ActivityResult execStartActivity(
        ...
        try {
            ...
            int result = ActivityManagerNative.getDefault()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target, requestCode, 0, null, options);
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

在execStartActivity方法中会调用ActivityManagerNative的getDefault方法来获取ActivityManagerProxy,ActivityManagerProxy又是AMS的代理类,这样的话就可以通过ActivityManagerProxy向AMS发送startActivity的请求。

ActivityManagerNative的getDefault方法的代码如下:

   private static final Singleton<IActivityManager> gDefault = new Singleton<IActivityManager>() {
        protected IActivityManager create() {
            IBinder b = ServiceManager.getService("activity");
            ...
            IActivityManager am = asInterface(b);
            ...
            return am;
        }
    };

    static public IActivityManager getDefault() {
        return gDefault.get();
    }

在getDefault方法中调用了gDefault的get方法,gDefault是一个单例类。通过ServiceManager的getService方法获取一个IBinder类型的AMS的引用,再将它通过asInterface方法转换成ActivityManagerProxy类型的对象。

asInterface方法:

static public IActivityManager asInterface(IBinder obj) {
        if (obj == null) {
            return null;
        }
        //检查本地进程是否有IActivityManager接口的实现
        IActivityManager in =
            (IActivityManager)obj.queryLocalInterface(descriptor);
        if (in != null) {
            return in;
        }
        //本地进程没有IActivityManager接口的实现,将IBinder类型的AMS引用封装成AMP
        return new ActivityManagerProxy(obj);
    }

在asInterface方法中分两种情况,首先会检查本地进程是否有IActivityManager接口的实现,如果有就直接返回;如果没有,就将IBinder类型的AMS引用封装成ActivityManagerProxy。

public abstract class ActivityManagerNative extends Binder implements IActivityManager{
    ...
    class ActivityManagerProxy implements IActivityManager{
        public ActivityManagerProxy(IBinder remote){
            mRemote = remote;
        }
                ...
    }
    ...
}

ActivityManagerProxy是ActivityManagerNative的内部类,在ActivityManagerProxy的构造方法中将AMS的引用赋值给变量mRemote,这样在ActivityManagerProxy中就可以使用AMS了。

继续回到Instrumentation的execStartActivity方法,代码如下:

public ActivityResult execStartActivity(
        ...
        try {
            ...
            int result = ActivityManagerNative.getDefault()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target, requestCode, 0, null, options);
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

通过ActivityManagerNative的getDefault方法获取AMS的代理类ActivityManagerProxy,再调用ActivityManagerProxy的startActivity方法。

ActivityManagerProxy的startActivity方法:

public int startActivity(IApplicationThread caller, String callingPackage, Intent intent,
            String resolvedType, IBinder resultTo, String resultWho, int requestCode,
            int startFlags, ProfilerInfo profilerInfo, Bundle options) throws RemoteException {
        ...
        //向AMS发送START_ACTIVITY_TRANSACTION类型的进程间通信请求
        mRemote.transact(START_ACTIVITY_TRANSACTION, data, reply, 0);
        reply.readException();
        int result = reply.readInt();
        reply.recycle();
        data.recycle();
        return result;
    }

在ActivityManagerProxy的startActivity方法中,通过mRemote,也就是AMS的引用,向服务端的AMS发送一个START_ACTIVITY_TRANSACTION类型的进程间通信请求,服务端AMS就会从Binder线程池中读取客户端发来的数据,最终会调用ActivityManagerNative的onTransact方法。

@Override
public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
throws RemoteException {
    switch (code) {
        case START_ACTIVITY_TRANSACTION:{
            ...
            int result = startActivity(app, callingPackage, intent, resolvedType,
            ...
            return true;
        }
        ...
    }

    return super.onTransact(code, data, reply, flags);
}

同时ActivityManagerService继承自ActivityManagerNative,因此onTransact方法的switch语句的START_ACTIVITY_TRANSACTION分支会调用AMS的startActivity。

public final class ActivityManagerService extends ActivityManagerNative implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {

    @Override    public final int startActivity(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
           int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
            return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
                resultWho, requestCode, startFlags, profilerInfo, bOptions,
                UserHandle.getCallingUserId());
      }
}
Android 8.0-Activity启动

Android8.0和7.0的Activity启动过程都会调用Instrumentation的execStartActivity方法,代码如下:

    public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, String target,
        Intent intent, int requestCode, Bundle options) {
        ...
        try {
            ...
            int result = ActivityManager.getService()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target, requestCode, 0, null, options);
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

在execStartActivity方法中通过ActivityManager的getService获取IActivityManager对象,并通过IActivityManager对象的startActivity方法通知AMS启动Activity。

public static IActivityManager getService() {
        return IActivityManagerSingleton.get();
    }

    private static final Singleton<IActivityManager> IActivityManagerSingleton =
            new Singleton<IActivityManager>() {
                @Override
                protected IActivityManager create() {
                    final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                    final IActivityManager am = IActivityManager.Stub.asInterface(b);
                    return am;
                }
            };

IActivityManagerSingleto是一个单例类,在它的create方法中获取iBinder类型的AMS引用,接着通过AIDL,将AMS应用转换成IActivityManager类型的对象。相比于Android 7.0来说,这里去掉了ActivityManagerProxy这个代理类,由IActivityManager代替,这里的IActivityManager.aidl通过AIDL工具自动生成IActivityManager.java。

通过Android 7.0和Android 8.0的Activity启动流程可以得出Activity插件化的另一种方案:Hook IActivityManager,通过动态代理实现。

首先创建占坑Activity:

public class StubActivity extends AppCompatActivity {

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_stub);
    }
}

创建插件Activity:

public class TargetActivity extends AppCompatActivity {

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_target);
    }
}

并在AndroidManifest.xml中注册占坑Activity:

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.glh.haiproject01">

    <application
        android:name=".MyApplication"
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/AppTheme"
        tools:ignore="AllowBackup,GoogleAppIndexingWarning">
        <activity android:name=".MainActivity">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
        <activity android:name=".StubActivity" />
    </application>

</manifest>

在AndroidManifest.xml中没有注册插件Activity,这时如果启动插件Activity会报错。

接着开始Hook IActivityManager,创建代理类IActivityManagerProxy:

public class IActivityManagerProxy implements InvocationHandler {

    private Object mActivityManager;

    public IActivityManagerProxy(Object activityManager){
        this.mActivityManager=activityManager;
    }

    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        if("startActivity".equals(method.getName())){
            //拦截startActivity
            Intent intent=null;
            int index=0;
            for(int i=0,length=args.length;i<length;i++){
                if(args[i] instanceof Intent){
                    index=i;
                    break;
                }
            }
            //获取插件Activity的Intent
            intent= (Intent) args[index];
            //创建占坑Activity的Intent
            Intent subIntent=new Intent();
            subIntent.setClassName("com.glh.haiproject01","com.glh.haiproject01.StubActivity");
            //保存插件Activity的Intent
            subIntent.putExtra(HookHelper.REQUEST_TARGET_INTENT_NAME,intent);
            //替换为占坑Activity
            args[index]=subIntent;
        }
        return method.invoke(mActivityManager,args);
    }
}

IActivityManagerProxy代理类的invoke非常简单,就是将插件Activity的Intent替换为占坑Activity的Intent,并保存插件Activity的Intent,方便后续还原。

    private void hookIActivityManager(){
        Object defaultSingleton;
        if(Build.VERSION.SDK_INT==26){
            //Android 8.0
            defaultSingleton=getIActivityManagerSingleton();
        }else{
            defaultSingleton=getDefault();
        }
        try {
            Class<?> singletonClazz=Class.forName("android.util.Singleton");
            Field instanceField=singletonClazz.getDeclaredField("mInstance");
            instanceField.setAccessible(true);
            //获取defaultSingleton中IActivityManager类型的mInstance成员变量
            Object iActivityManager=instanceField.get(defaultSingleton);

            Class<?> iActivityManagerClazz=Class.forName("android.app.IActivityManager");
            Object proxy=Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(),
                    new Class<?>[]{iActivityManagerClazz},new IActivityManagerProxy(iActivityManager));
            //替换为代理类IActivityManagerProxy
            instanceField.set(defaultSingleton,proxy);
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        } catch (NoSuchFieldException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
    }

    private Object getIActivityManagerSingleton(){
        try {
            Class<?> activityManagerClazz=Class.forName("android.app.ActivityManager");
            Field field=activityManagerClazz.getDeclaredField("IActivityManagerSingleton");
            field.setAccessible(true);
            return field.get(null);
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        } catch (NoSuchFieldException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
        return null;
    }

    private Object getDefault(){
        try {
            Class<?> activityManagerClazz=Class.forName("android.app.ActivityManagerNative");
            Field field=activityManagerClazz.getDeclaredField("gDefault");
            field.setAccessible(true);
            return field.get(null);
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        } catch (NoSuchFieldException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
        return null;
    }

以上代码主要就是将Singleton的IActivityManager类型的成员变量mInstance替换成通过动态代理对象。当我们向AMS请求启动Activity时,会执行代理类IActivityManagerProxy的invoke方法进行狸猫换太子。

当AMS通过验证后需要还原插件Activity的Intent,在Android 8.0和Android 7.0(其他版本源码有可能不同)中,AMS通过Binder跨进程调用scheduleLaunchActivity,scheduleLaunchActivity方法在应用程序进程的Binder线程池中,通过mH发送LAUNCH_ACTIVITY消息(100)切换到主线程中创建并启动Activity。

mH的类型是ActivityThread中的内部类H,H继承自Handler并实现了handleMessage方法,在Handler源码中,有这么一段代码:

    public void dispatchMessage(Message msg) {
        if (msg.callback != null) {
            handleCallback(msg);
        } else {
            if (mCallback != null) {
                if (mCallback.handleMessage(msg)) {
                    return;
                }
            }
            handleMessage(msg);
        }
    }

当mCallback不为null时会调用handleMessage方法,mCallback类型是Callback接口,因此我们可以Hook Callback,用自定的Callback替换Handler的mCallback。

代理Callback:

public class CallBackProxy implements Handler.Callback {

    private Handler mHandler;

    public CallBackProxy(Handler handler){
        this.mHandler=handler;
    }

    @Override
    public boolean handleMessage(Message msg) {
        if(msg.what==100){
            Object o=msg.obj;
            try {
                Field field=o.getClass().getDeclaredField("intent");
                field.setAccessible(true);
                //获取占坑Activity的Intent
                Intent intent= (Intent) field.get(o);
                //获取之前保存的插件Activity的Intent
                Intent targetIntent=intent.getParcelableExtra(HookHelper.REQUEST_TARGET_INTENT_NAME);
                //将占坑的Activity替换为插件Activity
                intent.setComponent(targetIntent.getComponent());
            } catch (NoSuchFieldException e) {
                e.printStackTrace();
            } catch (IllegalAccessException e) {
                e.printStackTrace();
            }

        }
        mHandler.handleMessage(msg);
        return true;
    }
}

将Handler的mCallback替换为代理类CallBackProxy:

    private  void hookHandler(){
        try {
            Class<?> activityThreadClazz=Class.forName("android.app.ActivityThread");
            Field currentActivityThreadField=activityThreadClazz.getDeclaredField("sCurrentActivityThread");
            currentActivityThreadField.setAccessible(true);
            Object currentActivityThread=currentActivityThreadField.get(null);

            Field handlerField=activityThreadClazz.getDeclaredField("mH");
            handlerField.setAccessible(true);
            Handler mH= (Handler) handlerField.get(currentActivityThread);

            Field callbackField=Handler.class.getDeclaredField("mCallback");
            callbackField.setAccessible(true);
            //Handler的mCallback替换为CallBackProxy
            callbackField.set(mH,new CallBackProxy(mH));
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        } catch (NoSuchFieldException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
    }

至此,Hook IActivityManager方案已经完成,在主界面中启动插件Activity:

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        findViewById(R.id.btn_startActivity).setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                Intent intent=new Intent(MainActivity.this,TargetActivity.class);
                startActivity(intent);
            }
        });
    }
}

运行效果:

在这里插入图片描述

©️2020 CSDN 皮肤主题: 猿与汪的秘密 设计师:上身试试 返回首页