滴滴插件化框架(VirtualApk)分析

最新推荐文章于 2021-05-28 11:57:57 发布
最新推荐文章于 2021-05-28 11:57:57 发布
阅读量359 收藏
点赞数
分类专栏： 插件化 文章标签： 移动开发
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/m0_37778101/article/details/79853709
版权

相关分析连接：https://juejin.im/post/5d7a0d0551882523ee70a3ac

ClassLoader 介绍： https://www.jianshu.com/p/a620e368389a

上一篇文章我们分析了DynamicLoadApk的实现原理，它采用的是一种代理机制，用ProxyActivity代理要启动的TargetActivity,

而今天我们要分析的VirtualApk 的实现思路是采用了一种Hook机制，通过hook ActivityManagerNative,Instrumentation去实现启动插件apk中的Activity,Service,BroadcastReceiver,ContentProvider.

今天我们首先来分析启动插件Apk总的Activity的流程

先来学习了解以下Activity的启动流程  https://blog.csdn.net/yyh352091626/article/details/51086117

我们先来了解以下几个角色：

PluginManager: 作为插件管理者，包含了init, prepare , loadPlugin等操作

ActivityManagerProxy:  实现了对IActivityManagerService的代理行为

VAInstrumentation:  继承了Instrumentation，重写了启动activity，以及对TargetActivity的实例化

StubActivityInfo: 维护了所有了StubActivity(作为要targetActivity的代理)

1 首先分析PluginManager

step1: 初始化

 

public void init() {
    mComponentsHandler = new ComponentsHandler(this);
    RunUtil.getThreadPool().execute(new Runnable() {
        @Override
        public void run() {
            doInWorkThread();
        }
    });
}

这个流程里只是创建了ComponentsHandler，如果要处理启动插件Apk中的Activity,它的作用是用来处理intent,并将targetActivity作为参数封装到intent中，然后启动StubActivity.

 

public void markIntentIfNeeded(Intent intent) {
    if (intent.getComponent() == null) {
        return;
    }

    String targetPackageName = intent.getComponent().getPackageName();
    String targetClassName = intent.getComponent().getClassName();
    // search map and return specific launchmode stub activity
    if (!targetPackageName.equals(mContext.getPackageName()) && mPluginManager.getLoadedPlugin(targetPackageName) != null) {
        intent.putExtra(Constants.KEY_IS_PLUGIN, true);
        intent.putExtra(Constants.KEY_TARGET_PACKAGE, targetPackageName);
        intent.putExtra(Constants.KEY_TARGET_ACTIVITY, targetClassName);
        dispatchStubActivity(intent);
    }
}

private void dispatchStubActivity(Intent intent) {
    ComponentName component = intent.getComponent();
    String targetClassName = intent.getComponent().getClassName();
    LoadedPlugin loadedPlugin = mPluginManager.getLoadedPlugin(intent);
    ActivityInfo info = loadedPlugin.getActivityInfo(component);
    if (info == null) {
        throw new RuntimeException("can not find " + component);
    }
    int launchMode = info.launchMode;
    Resources.Theme themeObj = loadedPlugin.getResources().newTheme();
    themeObj.applyStyle(info.theme, true);
    String stubActivity = mStubActivityInfo.getStubActivity(targetClassName, launchMode, themeObj);
    Log.i(TAG, String.format("dispatchStubActivity,[%s -> %s]", targetClassName, stubActivity));
    intent.setClassName(mContext, stubActivity);
}
 

 

Step2:  prepare操作

 

private void prepare() {
    Systems.sHostContext = getHostContext();
    this.hookInstrumentationAndHandler();
    if (Build.VERSION.SDK_INT >= 26) {
        this.hookAMSForO();
    } else {
        this.hookSystemServices();
    }
}

 

private void hookInstrumentationAndHandler() {
    try {
        Instrumentation baseInstrumentation = ReflectUtil.getInstrumentation(this.mContext);
        if (baseInstrumentation.getClass().getName().contains("lbe")) {
            // reject executing in paralell space, for example, lbe.
            System.exit(0);
        }

        final VAInstrumentation instrumentation = new VAInstrumentation(this, baseInstrumentation);
        Object activityThread = ReflectUtil.getActivityThread(this.mContext);
        ReflectUtil.setInstrumentation(activityThread, instrumentation);
        ReflectUtil.setHandlerCallback(this.mContext, instrumentation);
        this.mInstrumentation = instrumentation;
    } catch (Exception e) {
        e.printStackTrace();
    }
}

 

private void hookSystemServices() {
    try {
        Singleton<IActivityManager> defaultSingleton = (Singleton<IActivityManager>) ReflectUtil.getField(ActivityManagerNative.class, null, "gDefault");
        IActivityManager activityManagerProxy = ActivityManagerProxy.newInstance(this, defaultSingleton.get());

        // Hook IActivityManager from ActivityManagerNative
        ReflectUtil.setField(defaultSingleton.getClass().getSuperclass(), defaultSingleton, "mInstance", activityManagerProxy);

        if (defaultSingleton.get() == activityManagerProxy) {
            this.mActivityManager = activityManagerProxy;
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}

 

从上面代码中可知，prepare 包含两部分：

 

 1 Hook Instrumentation, 用VAInstrumentation代理了ActivityThread中的mInstrumentation,  这里重新了execStartActivity 和 newActivity

 2 通过AOP 模式,使用了ActivityManagerProxy 来 hook IActivityManager,

 

@Override
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
    if ("startService".equals(method.getName())) {
        try {
            return startService(proxy, method, args);
        } catch (Throwable e) {
            Log.e(TAG, "Start service error", e);
        }
    } else if ("stopService".equals(method.getName())) {
        try {
            return stopService(proxy, method, args);
        } catch (Throwable e) {
            Log.e(TAG, "Stop Service error", e);
        }
    } else if ("stopServiceToken".equals(method.getName())) {
        try {
            return stopServiceToken(proxy, method, args);
        } catch (Throwable e) {
            Log.e(TAG, "Stop service token error", e);
        }
    } else if ("bindService".equals(method.getName())) {
        try {
            return bindService(proxy, method, args);
        } catch (Throwable e) {
            e.printStackTrace();
        }
    } else if ("unbindService".equals(method.getName())) {
        try {
            return unbindService(proxy, method, args);
        } catch (Throwable e) {
            e.printStackTrace();
        }
    } else if ("getIntentSender".equals(method.getName())) {
        try {
            getIntentSender(method, args);
        } catch (Exception e) {
            e.printStackTrace();
        }
    } else if ("overridePendingTransition".equals(method.getName())){
        try {
            overridePendingTransition(method, args);
        } catch (Exception e){
            e.printStackTrace();
        }
    }

    try {
        // sometimes system binder has problems.
        return method.invoke(this.mActivityManager, args);
    } catch (Throwable th) {
        Throwable c = th.getCause();
        if (c != null && c instanceof DeadObjectException) {
            // retry connect to system binder
            IBinder ams = ServiceManager.getService(Context.ACTIVITY_SERVICE);
            if (ams != null) {
                IActivityManager am = ActivityManagerNative.asInterface(ams);
                mActivityManager = am;
            }
        }

        Throwable cause = th;
        do {
            if (cause instanceof RemoteException) {
                throw cause;
            }
        } while ((cause = cause.getCause()) != null);

        throw c != null ? c : th;
    }

}

这里针对startService,stopService,bindService,unbindService等操作进行拦截

step3  插件apk的load 过程 loadPlugin

 

public void loadPlugin(File apk) throws Exception {
    if (null == apk) {
        throw new IllegalArgumentException("error : apk is null.");
    }

    if (!apk.exists()) {
        throw new FileNotFoundException(apk.getAbsolutePath());
    }

    LoadedPlugin plugin = LoadedPlugin.create(this, this.mContext, apk);
    if (null != plugin) {
        this.mPlugins.put(plugin.getPackageName(), plugin);
        // try to invoke plugin's application
        plugin.invokeApplication();
    } else {
        throw  new RuntimeException("Can't load plugin which is invalid: " + apk.getAbsolutePath());
    }
}

创建并解析插件apk并封装为LoadedPlugin, 下面我们看一下LoadedPlugin

它的作用: 创建createClassloader(用来加载插件apk中的java类),初始化AssetsManager和Resources(用来控制资源访问),  复制so, 使用PackageParser解析并缓存插件apk中所用的Activity,Service,BroadcastReceiver,ContentProvider

 

private static ClassLoader createClassLoader(Context context, File apk, File libsDir, ClassLoader parent) {
    File dexOutputDir = context.getDir(Constants.OPTIMIZE_DIR, Context.MODE_PRIVATE);
    String dexOutputPath = dexOutputDir.getAbsolutePath();
    DexClassLoader loader = new DexClassLoader(apk.getAbsolutePath(), dexOutputPath, libsDir.getAbsolutePath(), parent);

    if (Constants.COMBINE_CLASSLOADER) {
        try {
            DexUtil.insertDex(loader);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    return loader;
}

private static AssetManager createAssetManager(Context context, File apk) {
    try {
        AssetManager am = AssetManager.class.newInstance();
        ReflectUtil.invoke(AssetManager.class, am, "addAssetPath", apk.getAbsolutePath());
        return am;
    } catch (Exception e) {
        e.printStackTrace();
        return null;
    }
}

@WorkerThread
private static Resources createResources(Context context, File apk) {
    if (Constants.COMBINE_RESOURCES) {
        Resources resources = ResourcesManager.createResources(context, apk.getAbsolutePath());
        ResourcesManager.hookResources(context, resources);
        return resources;
    } else {
        Resources hostResources = context.getResources();
        AssetManager assetManager = createAssetManager(context, apk);
        return new Resources(assetManager, hostResources.getDisplayMetrics(), hostResources.getConfiguration());
    }
}

 

下面我们来整体梳理启动插件Apk中Activity的流程

1 client端 的启动

 

Intent intent = new Intent();
intent.setClassName(this, "com.didi.virtualapk.demo.aidl.BookManagerActivity");
startActivity(intent);

2 从Activity的启动流程中可知，activity的具体启动是通过调用ActivityThread中的Instrumentation类型的mInstrumentation的execStartActivity, 之前PluginManager在prepare的是，已经通过hookInstrumentationAndHandler ,用VAInstrumentation 代替了父类的Instrumentation，即调用到VAInstrumentation的execStartActivity，代码如下：

 

public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    mPluginManager.getComponentsHandler().transformIntentToExplicitAsNeeded(intent);
    // null component is an implicitly intent
    if (intent.getComponent() != null) {
        Log.i(TAG, String.format("execStartActivity[%s : %s]", intent.getComponent().getPackageName(),
                intent.getComponent().getClassName()));
        // resolve intent with Stub Activity if needed
        this.mPluginManager.getComponentsHandler().markIntentIfNeeded(intent);
    }

    ActivityResult result = realExecStartActivity(who, contextThread, token, target,
                intent, requestCode, options);

    return result;

}

private ActivityResult realExecStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    ActivityResult result = null;
    try {
        Class[] parameterTypes = {Context.class, IBinder.class, IBinder.class, Activity.class, Intent.class,
        int.class, Bundle.class};
        result = (ActivityResult)ReflectUtil.invoke(Instrumentation.class, mBase,
                "execStartActivity", parameterTypes,
                who, contextThread, token, target, intent, requestCode, options);
    } catch (Exception e) {
        if (e.getCause() instanceof ActivityNotFoundException) {
            throw (ActivityNotFoundException) e.getCause();
        }
        e.printStackTrace();
    }

    return result;
}
 
 

execStartActivity中做了两件事：

1 transformIntentToExplicitAsNeed ，

2 markIntentIfNeed  如果是插件apk的activity, 进行标记，

 

public void markIntentIfNeeded(Intent intent) {
    if (intent.getComponent() == null) {
        return;
    }

    String targetPackageName = intent.getComponent().getPackageName();
    String targetClassName = intent.getComponent().getClassName();
    // search map and return specific launchmode stub activity
    if (!targetPackageName.equals(mContext.getPackageName()) && mPluginManager.getLoadedPlugin(targetPackageName) != null) {
        intent.putExtra(Constants.KEY_IS_PLUGIN, true);
        intent.putExtra(Constants.KEY_TARGET_PACKAGE, targetPackageName);
        intent.putExtra(Constants.KEY_TARGET_ACTIVITY, targetClassName);
        dispatchStubActivity(intent);
    }
}

private void dispatchStubActivity(Intent intent) {
    ComponentName component = intent.getComponent();
    String targetClassName = intent.getComponent().getClassName();
    LoadedPlugin loadedPlugin = mPluginManager.getLoadedPlugin(intent);
    ActivityInfo info = loadedPlugin.getActivityInfo(component);
    if (info == null) {
        throw new RuntimeException("can not find " + component);
    }
    int launchMode = info.launchMode;
    Resources.Theme themeObj = loadedPlugin.getResources().newTheme();
    themeObj.applyStyle(info.theme, true);
    String stubActivity = mStubActivityInfo.getStubActivity(targetClassName, launchMode, themeObj);
    Log.i(TAG, String.format("dispatchStubActivity,[%s -> %s]", targetClassName, stubActivity));
    intent.setClassName(mContext, stubActivity);
}

第一步，将targetActivity作为参数封装到intent中， 然后根据launchMode 启动stubActivity,

根据activity启动流程，通过调用activityThread中的performlaunchActivity 去通过调用Instrumentation.newActivity()初始化Activity实例，用于我们已经hook了Instrumentation,所以会调用到VAInstrumentation的的newActivity，代码如下：

 

@Override
public Activity newActivity(ClassLoader cl, String className, Intent intent) throws InstantiationException, IllegalAccessException, ClassNotFoundException {
    try {
     cl.loadClass(className);
    } catch (ClassNotFoundException e) {
        LoadedPlugin plugin = this.mPluginManager.getLoadedPlugin(intent);
        String targetClassName = PluginUtil.getTargetActivity(intent);

        Log.i(TAG, String.format("newActivity[%s : %s]", className, targetClassName));

        if (targetClassName != null) {
            Activity activity = mBase.newActivity(plugin.getClassLoader(), targetClassName, intent);
            activity.setIntent(intent);

            try {
                // for 4.1+
                ReflectUtil.setField(ContextThemeWrapper.class, activity, "mResources", plugin.getResources());
            } catch (Exception ignored) {
                // ignored.
            }

            return activity;
        }
    }

    return mBase.newActivity(cl, className, intent);
}

当启动插件apk 中的activity时，由于我们用了stubActivity代理，所以这个类是不存在的，上面的loadclass会出现异常，然后通过插件的classloader去实例化targetActivity，此时activity已经启动成功。

 

不同于Activity（受launch mode影响，以及 theme等相关,另外activity生命周期的复杂性，所以需要hook Instrumention 以及 manifest占坑的方式来实现 欺骗系统的过程），

Service 插件化：由于Service 的性质决定了 需要在manifest注册，但是不像Activity那样收到launch mode 影响，所以可用 代理方式

在VirtualApk中，使用LocalService来代理同进程内Service,RemoteService来非同进程Service  ，这两个Service 只存在 是否和 主 Dex 在同进程的区别，所以RemoteService 需要额外去执行插件的加载，而LocalService则不需要

ActivityManagerProxy

protected Object startService(Object proxy, Method method, Object[] args) throws Throwable {
    IApplicationThread appThread = (IApplicationThread) args[0];
    Intent target = (Intent) args[1];
    ResolveInfo resolveInfo = this.mPluginManager.resolveService(target, 0);
    if (null == resolveInfo || null == resolveInfo.serviceInfo) {
        // is host service
        return method.invoke(this.mActivityManager, args);
    }

    return startDelegateServiceForTarget(target, resolveInfo.serviceInfo, null, RemoteService.EXTRA_COMMAND_START_SERVICE);
}

 

protected ComponentName startDelegateServiceForTarget(Intent target, ServiceInfo serviceInfo, Bundle extras, int command) {
    Intent wrapperIntent = wrapperTargetIntent(target, serviceInfo, extras, command);
    return mPluginManager.getHostContext().startService(wrapperIntent);
}

protected Intent wrapperTargetIntent(Intent target, ServiceInfo serviceInfo, Bundle extras, int command) {
    // fill in service with ComponentName
    target.setComponent(new ComponentName(serviceInfo.packageName, serviceInfo.name));
    String pluginLocation = mPluginManager.getLoadedPlugin(target.getComponent()).getLocation();

    // start delegate service to run plugin service inside
    boolean local = PluginUtil.isLocalService(serviceInfo);
    Class<? extends Service> delegate = local ? LocalService.class : RemoteService.class;
    Intent intent = new Intent();
    intent.setClass(mPluginManager.getHostContext(), delegate);
    intent.putExtra(RemoteService.EXTRA_TARGET, target);
    intent.putExtra(RemoteService.EXTRA_COMMAND, command);
    intent.putExtra(RemoteService.EXTRA_PLUGIN_LOCATION, pluginLocation);
    if (extras != null) {
        intent.putExtras(extras);
    }

    return intent;
}

上述代码做到了欺骗系统，通过代理Service来启动targetService,

public class RemoteService extends LocalService {
    
    private static final String TAG = Constants.TAG_PREFIX + "RemoteService";

    @Override
    public IBinder onBind(Intent intent) {
        return null;
    }

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        if (intent == null) {
            return super.onStartCommand(intent, flags, startId);
        }

        Intent target = intent.getParcelableExtra(EXTRA_TARGET);
        if (target != null) {
            String pluginLocation = intent.getStringExtra(EXTRA_PLUGIN_LOCATION);
            ComponentName component = target.getComponent();
           //在单独的进程中，需要第一次的时候，需要重新加载插件
            LoadedPlugin plugin = PluginManager.getInstance(this).getLoadedPlugin(component);
            if (plugin == null && pluginLocation != null) {
                try {
                    PluginManager.getInstance(this).loadPlugin(new File(pluginLocation));
                } catch (Exception e) {
                    Log.w(TAG, e);
                }
            }
        }

        return super.onStartCommand(intent, flags, startId);
    }

}

LocalService: 所有的代理都是在onStartCommand中 处理，针对targetService: targetService的初始化，onCreate,onStartCommond,onBind,onUnbind,onDestroy的调用

 

ublic class LocalService extends Service {
    private static final String TAG = Constants.TAG_PREFIX + "LocalService";

    /**
     * The target service, usually it's a plugin service intent
     */
    public static final String EXTRA_TARGET = "target";
    public static final String EXTRA_COMMAND = "command";
    public static final String EXTRA_PLUGIN_LOCATION = "plugin_location";

    public static final int EXTRA_COMMAND_START_SERVICE = 1;
    public static final int EXTRA_COMMAND_STOP_SERVICE = 2;
    public static final int EXTRA_COMMAND_BIND_SERVICE = 3;
    public static final int EXTRA_COMMAND_UNBIND_SERVICE = 4;


    private PluginManager mPluginManager;

    @Override
    public IBinder onBind(Intent intent) {
        return new Binder();
    }

    @Override
    public void onCreate() {
        super.onCreate();
        mPluginManager = PluginManager.getInstance(this);
    }

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        if (null == intent || !intent.hasExtra(EXTRA_TARGET) || !intent.hasExtra(EXTRA_COMMAND)) {
            return START_STICKY;
        }

        Intent target = intent.getParcelableExtra(EXTRA_TARGET);
        int command = intent.getIntExtra(EXTRA_COMMAND, 0);
        if (null == target || command <= 0) {
            return START_STICKY;
        }

        ComponentName component = target.getComponent();
        LoadedPlugin plugin = mPluginManager.getLoadedPlugin(component);
        
        if (plugin == null) {
            Log.w(TAG, "Error target: " + target.toURI());
            return START_STICKY;
        }
        // ClassNotFoundException when unmarshalling in Android 5.1
        target.setExtrasClassLoader(plugin.getClassLoader());
        switch (command) {
            case EXTRA_COMMAND_START_SERVICE: {
                ActivityThread mainThread = ActivityThread.currentActivityThread();
                IApplicationThread appThread = mainThread.getApplicationThread();
                Service service;

                if (this.mPluginManager.getComponentsHandler().isServiceAvailable(component)) {
                    service = this.mPluginManager.getComponentsHandler().getService(component);
                } else {
                    try {
                        service = (Service) plugin.getClassLoader().loadClass(component.getClassName()).newInstance();

                        Application app = plugin.getApplication();
                        IBinder token = appThread.asBinder();
                        Method attach = service.getClass().getMethod("attach", Context.class, ActivityThread.class, String.class, IBinder.class, Application.class, Object.class);
                        IActivityManager am = mPluginManager.getActivityManager();

                        attach.invoke(service, plugin.getPluginContext(), mainThread, component.getClassName(), token, app, am);
                        service.onCreate();
                        this.mPluginManager.getComponentsHandler().rememberService(component, service);
                    } catch (Throwable t) {
                        return START_STICKY;
                    }
                }

                service.onStartCommand(target, 0, this.mPluginManager.getComponentsHandler().getServiceCounter(service).getAndIncrement());
                break;
            }
            case EXTRA_COMMAND_BIND_SERVICE: {
                ActivityThread mainThread = ActivityThread.currentActivityThread();
                IApplicationThread appThread = mainThread.getApplicationThread();
                Service service = null;

                if (this.mPluginManager.getComponentsHandler().isServiceAvailable(component)) {
                    service = this.mPluginManager.getComponentsHandler().getService(component);
                } else {
                    try {
                        service = (Service) plugin.getClassLoader().loadClass(component.getClassName()).newInstance();

                        Application app = plugin.getApplication();
                        IBinder token = appThread.asBinder();
                        Method attach = service.getClass().getMethod("attach", Context.class, ActivityThread.class, String.class, IBinder.class, Application.class, Object.class);
                        IActivityManager am = mPluginManager.getActivityManager();

                        attach.invoke(service, plugin.getPluginContext(), mainThread, component.getClassName(), token, app, am);
                        service.onCreate();
                        this.mPluginManager.getComponentsHandler().rememberService(component, service);
                    } catch (Throwable t) {
                        Log.w(TAG, t);
                    }
                }
                try {
                    IBinder binder = service.onBind(target);
                    IBinder serviceConnection = PluginUtil.getBinder(intent.getExtras(), "sc");
                    IServiceConnection iServiceConnection = IServiceConnection.Stub.asInterface(serviceConnection);
                    if (Build.VERSION.SDK_INT >= 26) {
                        iServiceConnection.connected(component, binder, false);
                    } else {
                        Reflector.QuietReflector.with(iServiceConnection).method("connected", ComponentName.class, IBinder.class).call(component, binder);
                    }
                } catch (Exception e) {
                    Log.w(TAG, e);
                }
                break;
            }
            case EXTRA_COMMAND_STOP_SERVICE: {
                Service service = this.mPluginManager.getComponentsHandler().forgetService(component);
                if (null != service) {
                    try {
                        service.onDestroy();
                    } catch (Exception e) {
                        Log.e(TAG, "Unable to stop service " + service + ": " + e.toString());
                    }
                } else {
                    Log.i(TAG, component + " not found");
                }
                break;
            }
            case EXTRA_COMMAND_UNBIND_SERVICE: {
                Service service = this.mPluginManager.getComponentsHandler().forgetService(component);
                if (null != service) {
                    try {
                        service.onUnbind(target);
                        service.onDestroy();
                    } catch (Exception e) {
                        Log.e(TAG, "Unable to unbind service " + service + ": " + e.toString());
                    }
                } else {
                    Log.i(TAG, component + " not found");
                }
                break;
            }
        }

        return START_STICKY;
    }

}

ContentProvider:

ActivityThread中保存了所有的Provider, 通过反射，hook IContentProvider,

protected void hookIContentProviderAsNeeded() {
    Uri uri = Uri.parse(RemoteContentProvider.getUri(mContext));
    mContext.getContentResolver().call(uri, "wakeup", null, null);
    try {
        Field authority = null;
        Field provider = null;
        ActivityThread activityThread = ActivityThread.currentActivityThread();
        Map providerMap = Reflector.with(activityThread).field("mProviderMap").get();
        Iterator iter = providerMap.entrySet().iterator();
        while (iter.hasNext()) {
            Map.Entry entry = (Map.Entry) iter.next();
            Object key = entry.getKey();
            Object val = entry.getValue();
            String auth;
            if (key instanceof String) {
                auth = (String) key;
            } else {
                if (authority == null) {
                    authority = key.getClass().getDeclaredField("authority");
                    authority.setAccessible(true);
                }
                auth = (String) authority.get(key);
            }
            if (auth.equals(RemoteContentProvider.getAuthority(mContext))) {
                if (provider == null) {
                    provider = val.getClass().getDeclaredField("mProvider");
                    provider.setAccessible(true);
                }
                IContentProvider rawProvider = (IContentProvider) provider.get(val);
                IContentProvider proxy = IContentProviderProxy.newInstance(mContext, rawProvider);
                mIContentProvider = proxy;
                Log.d(TAG, "hookIContentProvider succeed : " + mIContentProvider);
                break;
            }
        }
    } catch (Exception e) {
        Log.w(TAG, e);
    }
}
/**
 * Created by renyugang on 16/12/8.
 */

public class IContentProviderProxy implements InvocationHandler {
    private static final String TAG = Constants.TAG_PREFIX + "IContentProviderProxy";

    private IContentProvider mBase;
    private Context mContext;

    private IContentProviderProxy(Context context, IContentProvider iContentProvider) {
        mBase = iContentProvider;
        mContext = context;
    }

    public static IContentProvider newInstance(Context context, IContentProvider iContentProvider) {
        return (IContentProvider) Proxy.newProxyInstance(iContentProvider.getClass().getClassLoader(),
                new Class[] { IContentProvider.class }, new IContentProviderProxy(context, iContentProvider));
    }

    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        Log.v(TAG, method.toGenericString() + " : " + Arrays.toString(args));
        wrapperUri(method, args);

        try {
            return method.invoke(mBase, args);
        } catch (InvocationTargetException e) {
            throw e.getTargetException();
        }
    }

    private void wrapperUri(Method method, Object[] args) {
        Uri uri = null;
        int index = 0;
        if (args != null) {
            for (int i = 0; i < args.length; i++) {
                if (args[i] instanceof Uri) {
                    uri = (Uri) args[i];
                    index = i;
                    break;
                }
            }
        }

        Bundle bundleInCallMethod = null;
        if (method.getName().equals("call")) {
            bundleInCallMethod = getBundleParameter(args);
            if (bundleInCallMethod != null) {
                String uriString = bundleInCallMethod.getString(RemoteContentProvider.KEY_WRAPPER_URI);
                if (uriString != null) {
                    uri = Uri.parse(uriString);
                }
            }
        }

        if (uri == null) {
            return;
        }

        PluginManager pluginManager = PluginManager.getInstance(mContext);
        ProviderInfo info = pluginManager.resolveContentProvider(uri.getAuthority(), 0);
        if (info != null) {
            String pkg = info.packageName;
            LoadedPlugin plugin = pluginManager.getLoadedPlugin(pkg);
            Uri wrapperUri = PluginContentResolver.wrapperUri(plugin, uri);
            if (method.getName().equals("call")) {
                bundleInCallMethod.putString(RemoteContentProvider.KEY_WRAPPER_URI, wrapperUri.toString());
            } else {
                args[index] = wrapperUri;
            }
        }
    }

    private Bundle getBundleParameter(Object[] args) {
        Bundle bundle = null;
        if (args != null) {
            for (int i = 0; i < args.length; i++) {
                if (args[i] instanceof Bundle) {
                    bundle = (Bundle) args[i];
                    break;
                }
            }
        }

        return bundle;
    }

}

PluginContentResolver 负责Uri的pluginUri 转换为 代理proxyUri

 context.getContentResolve().query(uri,....) 流程如下：

ContextImpl.java                               1  getContentResolver()---query() --> acquireUnstableProvider() ---> 

ApplicationContentResolver.java       2 acquireUnstableProvider --> 

@Override
protected IContentProvider acquireUnstableProvider(Context c, String auth) {
    return mMainThread.acquireProvider(c,
            ContentProvider.getAuthorityWithoutUserId(auth),
            resolveUserIdFromAuthority(auth), false);
}

ActivityThread.java   （app中所有的ContentProvider在app冷启动时，被安装（优先于application的onCreate()，然后保存在mProviderMap 中）,如果本地app没有要查询的authority,则通过ActivityManagerService 去查询

public final IContentProvider acquireProvider(
        Context c, String auth, int userId, boolean stable) {
    final IContentProvider provider = acquireExistingProvider(c, auth, userId, stable);
    if (provider != null) {
        return provider;
    }

    // There is a possible race here.  Another thread may try to acquire
    // the same provider at the same time.  When this happens, we want to ensure
    // that the first one wins.
    // Note that we cannot hold the lock while acquiring and installing the
    // provider since it might take a long time to run and it could also potentially
    // be re-entrant in the case where the provider is in the same process.
    ContentProviderHolder holder = null;
    try {
        synchronized (getGetProviderLock(auth, userId)) {
            holder = ActivityManager.getService().getContentProvider(
                    getApplicationThread(), auth, userId, stable);
        }
    } catch (RemoteException ex) {
        throw ex.rethrowFromSystemServer();
    }
    if (holder == null) {
        Slog.e(TAG, "Failed to find provider info for " + auth);
        return null;
    }

    // Install provider will increment the reference count for us, and break
    // any ties in the race.
    holder = installProvider(c, holder, holder.info,
            true /*noisy*/, holder.noReleaseNeeded, stable);
    return holder.provider;
}

最终通过 RemoteProvider 实现代理

如果插件访问插件的ContentProvider，会用到 PluginContentResolver ，此时不会调用RemoteContentProvider,， ； 如果插件访问宿主的ContentProvider，使用的是原生的ContentResover，此时不会调用RemoteContentProvider, 只有宿主访问插件的ContentProvider时，才会调用ContentProvider。

 

BroadcastReceiver: 插件中静态注册的receiver都是通过applicaiton 的 context 来进行动态注册实现的 ，动态广播不需要插件化

 

宿主与插件，插件与插件，宿主与宿主 之间的通讯都是通过PluginManger.java 中的下面两个方法实现

  /**
     * hookSystemServices, but need to compatible with Android O in future.
     */
    protected void hookSystemServices() {
        try {
            Singleton<IActivityManager> defaultSingleton;
    
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
                defaultSingleton = Reflector.on(ActivityManager.class).field("IActivityManagerSingleton").get();
            } else {
                defaultSingleton = Reflector.on(ActivityManagerNative.class).field("gDefault").get();
            }
            IActivityManager origin = defaultSingleton.get();
            IActivityManager activityManagerProxy = (IActivityManager) Proxy.newProxyInstance(mContext.getClassLoader(), new Class[] { IActivityManager.class },
                createActivityManagerProxy(origin));

            // Hook IActivityManager from ActivityManagerNative
            Reflector.with(defaultSingleton).field("mInstance").set(activityManagerProxy);

            if (defaultSingleton.get() == activityManagerProxy) {
                this.mActivityManager = activityManagerProxy;
                Log.d(TAG, "hookSystemServices succeed : " + mActivityManager);
            }
        } catch (Exception e) {
            Log.w(TAG, e);
        }
    }
    
    protected void hookInstrumentationAndHandler() {
        try {
            ActivityThread activityThread = ActivityThread.currentActivityThread();
            Instrumentation baseInstrumentation = activityThread.getInstrumentation();
//            if (baseInstrumentation.getClass().getName().contains("lbe")) {
//                // reject executing in paralell space, for example, lbe.
//                System.exit(0);
//            }
    
            final VAInstrumentation instrumentation = createInstrumentation(baseInstrumentation);
            
            Reflector.with(activityThread).field("mInstrumentation").set(instrumentation);
            Handler mainHandler = Reflector.with(activityThread).method("getHandler").call();
            Reflector.with(mainHandler).field("mCallback").set(instrumentation);
            this.mInstrumentation = instrumentation;
            Log.d(TAG, "hookInstrumentationAndHandler succeed : " + mInstrumentation);
        } catch (Exception e) {
            Log.w(TAG, e);
        }
    }

插件application的Context 都是PluginContext  , PluginContext.getContentResolver()得到的是 PluginContentResolver

VirtualApk支持宿主和插件中类的互相访问，无法做到插件和插件中类的访问

 

 

LoadedPlugin

 

protected ClassLoader createClassLoader(Context context, File apk, File libsDir, ClassLoader parent) throws Exception {
    File dexOutputDir = getDir(context, Constants.OPTIMIZE_DIR);
    String dexOutputPath = dexOutputDir.getAbsolutePath();
    DexClassLoader loader = new DexClassLoader(apk.getAbsolutePath(), dexOutputPath, libsDir.getAbsolutePath(), parent); // 将宿主的pathClassLoader设为插件dexClassLoader的parent,利用双亲委派机制实现插件和宿主之间类的互相访问

    if (Constants.COMBINE_CLASSLOADER) {
        DexUtil.insertDex(loader, parent, libsDir);
    }

    return loader;
}

 

量变->质变
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
专栏目录
滴滴重磅开源跨平台统一MVVM框架Chameleon
weixin_34174322的博客
01-29 203
近日，滴滴在GitHub上开源了跨端解决方案 Chameleon，简写CML，中文名卡梅龙；中文意思变色龙，意味着就像变色龙一样能适应不同环境的跨端整体解决方案，具有易用、开发快、高性能等特点。下文将详细介绍Chameleon项目的研发背景和性能特点。背景研发同学在端内既追求h5的灵活性，也要追求性能趋近于原生。 面对入口扩张，主端、独立端、微信小程序、支付宝小程序、百度小程序、Android厂商...
插件化——反射实践
qq_38164867的博客
08-08 249
插件化：当项目需求很大时，可以拆分某些独立的业务出来单独编译成一个APK,再通过主APK去调用它，这样如果插件APK需要添加一些新的功能，可以在不修改原有的应用程序情况下，将新添加的功能植入到插件中，这就是所谓的插件化。插件化能大大的降低模块间的耦合性，有利于各模块的独立维护，加快项目的维护更新。 插件化的实现方式目前了解的方式有两种： 1：插桩式——反射 2：hook方式——动态代理 先就第一种...
滴滴插件VirtualApk学习一　编译
读书未遍、未敢妄下雌黄
11-10 769
一 代码代码下载git clone 　https://github.com/didi/VirtualAPK代码结构： VirtualAPk AndroidStub 插桩文件，配合编译 app　　示例demo主工程 CoreLibrary　核心库 PluginDemo　示例demo插件 virtualapk-gradle-plugin　gradle插件 二 编译 目前版本的代码只支持2.14.1版本
深入理解 Android 中的各种 Context
weixin_33978016的博客
12-23 208
前言 网上关于 Context 的文章也已经有不少了，比如值得参考的有： Android Context完全解析，你所不知道的Context的各种细节 Android Context 到底是什么？ 但看了一下，发现还有值得讨论的地方，比如这个等式： Context个数 = Service 个数 + Activity 个数 + 1 老实说，我不明白这个等式有什么意义，而且还是错的。首先多进程情况下，...
Context 笔记
qianyedoufulao的博客
05-25 6713
fffdff
VirtualAPKDemo:VirtualAPK插件化
04-29
滴滴插件化 如果碰到其他问题，可查看官方的 plugin 的 apk 必须是 assemblePlugin 生成的! 具体步骤： adb push 将 plugin.apk 推送到手机sdcard（测试用，实际项目可以是从网络下载到指定目录） app 中加载 plugin...
Android-滴滴VirtualApk
12-10
滴滴VirtualApk的集成测试； 插件源码：https://github.com/didi/VirtualAPK
良心DEMO_滴滴开源框架VirtualApk的Demo
12-07
公司项目是一套系统管理软件,它里面包括了五款软件,用户可以选择付费选择购买这其中的任一款软件,需求是说为了用户体验好,不让用户购买一款软件就要在桌面上安装一个软件(一共五款,想想用户界面会不会特别乱).
Node.js-VirtualAPK滴滴开源的一个强大轻量级的Android插件框架
08-12
VirtualAPK 滴滴开源的一个强大轻量级的Android插件框架
Node.js-简单使用下滴滴VirtualAPK
08-12
简单使用下滴滴VirtualAPK
getResources()方法
weixin_34064653的博客
06-21 662
今天做一个Android文件管理器。它使用了很多当地的用途getResources。 Drawable currentIcon = null;        ………………        currentIcon = getResources().getDrawable(R.drawable.folder);        ………………        currentIco...
android api 22 later,Android getResources().getDrawable()不贊成的API 22。
weixin_29061181的博客
05-28 290
With new android API 22 getResources().getDrawable() is now deprecated. Now the best approach is to use only getDrawable().使用新的android API 22 getResources(). getdrawable()現在已被棄用。現在最好的方法是只使用getDrawable...
滴滴开源Android插件化框架VirtualAPK原理分析
热门推荐
LeBron_Six的专栏
07-08 2万+
概述 Activity 支持 Hook ActivityManagerService Hook Instrumentation 启动插件Activity Service 支持 ContentProvider 支持 Receiver 支持 小结概述滴滴出行公司的首个对外开源项目 - VirtualAPK。地址：https://github.com/didi/VirtualAPK滴滴自行研发了这款插件化
滴滴插件化方案 VirtualApk 完全解析（一） 初识基本用法
weixin_34266504的博客
08-01 492
转载请注明出处：https://juejin.im/post/5b61076851882519f6478156 本文出自 容华谢后的博客 1.介绍 VirtualApk GitHub地址 VirtualAPK是滴滴在2017年6月开源的一款插件化框架，支持Android四大组件，以及几乎所有的Android特性，通过Gradle来构建插件，集成与构建十分便捷，目前已经应用在 滴滴出行 App上...
滴滴插件化方案——VirtualApk 实践
theScoreONE的博客
01-24 527
1、原本build.gradle中将3.2.0版本时，跳转插件包的Activity报在清单文件中没注册， 改为3.1.0版本classpath 'com.android.tools.build:gradle:3.1.0' 3、插件包不能动态申请权限，可以在宿主中申请完全部的权限 4、layout布局文件名不要和宿主的一样 5、overridePendingTransition(in...
VirtualHook使用
chencangui的专栏
11-30 1114
背景 想要逆向分析其他应用，除了需要有smali语法功底外，一套好用的良好的逆向装备也是必不可少的，并且当我们想要更加深入去了解一款app的实现的时候，可能还需要用到调试、替换(修改原有的逻辑)，解决方案有很多种，这里推荐使用apktool + jadx + virtualhook，apktool解决资源文件的问题，jadx解决反编译查看代码的问题，virtualhook解决热替换的要求。 环...
Tinker热修复
林哥的博客
09-16 2430
Sophix,Tinker简介： https://www.cnblogs.com/ldq2016/p/10449433.html Tinker： 安装过程https://blog.csdn.net/qq_22393017/article/details/82110343 Tinker和QQ空间方案最大的不同是，Tinker 下发新旧DEX的差异包，然后将差异包和旧包合成新dex之后进行d...
滴滴插件化方案 VirtualApk 源码解析
weixin_34293902的博客
07-11 215
本文已在我的公众号hongyangAndroid原创首发,文章合集。转载请标明出处. 一、概述 之前一直没有写过插件化相关的博客，刚好最近滴滴和360分别开源了自家的插件化方案，赶紧学习下，写两篇博客，第一篇是滴滴的方案： github.com/didi/Virtua… 那么其中的难点很明显是对四大组件支持，因为大家都清楚，四大组件都是需要在AndroidManifest中注册的，而插件a...
滴滴插件化项目VirtualAPK开源
weixin_34259159的博客
06-29 255
在Android插件化技术日新月异的今天，开发并落地一款插件化框架到底是简单还是困难，这个问题不同人会有不同的答案。但是我相信，完成一个插件化框架的demo并不是多难的事，但是要开发一款完善的插件化框架却不是一件容易的事，尤其在国内，各大Rom厂商都对Android系统做了一定程度的定制，这进一步加剧了Android本身的碎片化问题。\\我们在2016年开始研究这方面的技术，经过半年的开发、测试、...
Android插件化主流框架
最新发布
04-29
2. **VirtualApk**：VirtualApk是滴滴出行开源的一款插件化框架。它通过Hook技术实现了资源和类的动态加载，支持插件与宿主之间的组件调用和数据传递，同时还提供了插件独立运行的能力。 3. **DynamicAPK**：...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值