NDK--app卸载监听

当我们app被卸载，一些流氓软件还能够在后台做操作，对于root过的手机，甚至可以重新安装回来，今天介绍一种在没有root过的手机中监听自身app被卸载的方法。

核心思路：当app被卸载，相应的进程也被中断，无论是广播还是线程，都将不复存在。但我们可以开启一个进程，不断监听文件夹变化。当app被安装时，会在/data/data/目录下新建相应包名的文件夹，而java中有一个工具类：FileObserver，可以监听文件和文件夹的变化，我们利用在native层调用FileObserver的方法

首先查看FileObserver的源码发现，它内部就是一个线程

static {
        s_observerThread = new ObserverThread();
        s_observerThread.start();
    }


private static class ObserverThread extends Thread {
        private HashMap<Integer, WeakReference> m_observers = new HashMap<Integer, WeakReference>();
        private int m_fd;

        public ObserverThread() {
            super("FileObserver");
            m_fd = init();
        }

        public void run() {
            observe(m_fd);
        }

        public int[] startWatching(List<File> files,
                @NotifyEventType int mask, FileObserver observer) {
            final int count = files.size();
            final String[] paths = new String[count];
            for (int i = 0; i < count; ++i) {
                paths[i] = files.get(i).getAbsolutePath();
            }
            final int[] wfds = new int[count];
            Arrays.fill(wfds, -1);

            startWatching(m_fd, paths, mask, wfds);

            final WeakReference<FileObserver> fileObserverWeakReference =
                    new WeakReference<>(observer);
            synchronized (m_observers) {
                for (int wfd : wfds) {
                    if (wfd >= 0) {
                        m_observers.put(wfd, fileObserverWeakReference);
                    }
                }
            }

            return wfds;
        }

        public void stopWatching(int[] descriptors) {
            stopWatching(m_fd, descriptors);
        }

        @UnsupportedAppUsage
        public void onEvent(int wfd, @NotifyEventType int mask, String path) {
            // look up our observer, fixing up the map if necessary...
            FileObserver observer = null;

            synchronized (m_observers) {
                WeakReference weak = m_observers.get(wfd);
                if (weak != null) {  // can happen with lots of events from a dead wfd
                    observer = (FileObserver) weak.get();
                    if (observer == null) {
                        m_observers.remove(wfd);
                    }
                }
            }

            // ...then call out to the observer without the sync lock held
            if (observer != null) {
                try {
                    observer.onEvent(mask, path);
                } catch (Throwable throwable) {
                    Log.wtf(LOG_TAG, "Unhandled exception in FileObserver " + observer, throwable);
                }
            }
        }

        private native int init();
        private native void observe(int fd);
        private native void startWatching(int fd, String[] paths,
                @NotifyEventType int mask, int[] wfds);
        private native void stopWatching(int fd, int[] wfds);
    }

内部类ObserverThread 继承至 Thread，并在构造函数中调用native方法：init()获取文件句柄，在run方法中，调用observe方法，然后需要调用startWatching方法开启监听，而startWatching方法最终调用的还是native层代码。查看系统源码发现native方法是在\frameworks\base\core\jni目录下的android_util_FileObserver.cpp文件中实现的

/* //device/libs/android_runtime/android_util_FileObserver.cpp
**
** Copyright 2006, The Android Open Source Project
**
** Licensed under the Apache License, Version 2.0 (the "License"); 
** you may not use this file except in compliance with the License. 
** You may obtain a copy of the License at 
**
**     http://www.apache.org/licenses/LICENSE-2.0 
**
** Unless required by applicable law or agreed to in writing, software 
** distributed under the License is distributed on an "AS IS" BASIS, 
** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
** See the License for the specific language governing permissions and 
** limitations under the License.
*/

#include "JNIHelp.h"
#include "jni.h"
#include "utils/Log.h"
#include "utils/misc.h"
#include "core_jni_helpers.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <errno.h>

#if defined(__linux__)
#include <sys/inotify.h>
#endif

namespace android {

static jmethodID method_onEvent;

static jint android_os_fileobserver_init(JNIEnv* env, jobject object)
{
#if defined(__linux__)
    return (jint)inotify_init();
#else
    return -1;
#endif
}

static void android_os_fileobserver_observe(JNIEnv* env, jobject object, jint fd)
{
#if defined(__linux__)

    char event_buf[512];
    struct inotify_event* event;

    while (1)
    {
        int event_pos = 0;
        int num_bytes = read(fd, event_buf, sizeof(event_buf));

        if (num_bytes < (int)sizeof(*event))
        {
            if (errno == EINTR)
                continue;

            ALOGE("***** ERROR! android_os_fileobserver_observe() got a short event!");
            return;
        }

        while (num_bytes >= (int)sizeof(*event))
        {
            int event_size;
            event = (struct inotify_event *)(event_buf + event_pos);

            jstring path = NULL;

            if (event->len > 0)
            {
                path = env->NewStringUTF(event->name);
            }

            env->CallVoidMethod(object, method_onEvent, event->wd, event->mask, path);
            if (env->ExceptionCheck()) {
                env->ExceptionDescribe();
                env->ExceptionClear();
            }
            if (path != NULL)
            {
                env->DeleteLocalRef(path);
            }

            event_size = sizeof(*event) + event->len;
            num_bytes -= event_size;
            event_pos += event_size;
        }
    }

#endif
}

static jint android_os_fileobserver_startWatching(JNIEnv* env, jobject object, jint fd, jstring pathString, jint mask)
{
    int res = -1;

#if defined(__linux__)

    if (fd >= 0)
    {
        const char* path = env->GetStringUTFChars(pathString, NULL);

        res = inotify_add_watch(fd, path, mask);

        env->ReleaseStringUTFChars(pathString, path);
    }

#endif

    return res;
}

static void android_os_fileobserver_stopWatching(JNIEnv* env, jobject object, jint fd, jint wfd)
{
#if defined(__linux__)

    inotify_rm_watch((int)fd, (uint32_t)wfd);

#endif
}

static JNINativeMethod sMethods[] = {
     /* name, signature, funcPtr */
    { "init", "()I", (void*)android_os_fileobserver_init },
    { "observe", "(I)V", (void*)android_os_fileobserver_observe },
    { "startWatching", "(ILjava/lang/String;I)I", (void*)android_os_fileobserver_startWatching },
    { "stopWatching", "(II)V", (void*)android_os_fileobserver_stopWatching }

};

int register_android_os_FileObserver(JNIEnv* env)
{
    jclass clazz = FindClassOrDie(env, "android/os/FileObserver$ObserverThread");

    method_onEvent = GetMethodIDOrDie(env, clazz, "onEvent", "(IILjava/lang/String;)V");

    return RegisterMethodsOrDie(env, "android/os/FileObserver$ObserverThread", sMethods,
                                NELEM(sMethods));
}

} /* namespace android */

其中android_os_fileobserver_init方法对应JAVA中init方法。android_os_fileobserver_observe方法对应JAVA中observe方法，而该方法最关键的就是调用了read(fd, event_buf, sizeof(event_buf));read是一个阻塞函数，直到文件发生变化，而observe方法最终会回调java中的onEvent回调函数。android_os_fileobserver_startWatching方法对应JAVA中的开启监听方法startWatching

基于底层c++代码，我们可以开启另一个进程，不断的监听data/data/{包名}的文件夹的变化，如果文件夹被删除，则说明用户卸载了app。linux下可以使用fork函数，fork函数用于产生一个新的进程，函数返回值pid_t是一个整数，在父进程中，返回值是子进程编号，在子进程中，返回值是0。

有了以上思路，开始编写native方法

package com.aruba.uninstallapplication;

/**
 * Created by aruba on 2020/5/18.
 */
public class UninstallUtil {
    //开启
    public native void startUninstallWatch(String path, int sdk);
}

#include <jni.h>
#include <string>
#include <android/log.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <errno.h>
#include <sys/inotify.h>
#include <unistd.h>

#define LOG_TAG "aruba"
#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, __VA_ARGS__)

extern "C"
JNIEXPORT void JNICALL
Java_com_aruba_uninstallapplication_UninstallUtil_startUninstallWatch(JNIEnv *env, jobject instance,
                                                                      jstring path_, jint sdk) {
    const char *path = env->GetStringUTFChars(path_, 0);

    pid_t pid = fork();
    if (pid > 0) {//父进程
        LOGD("父进程");
    }else {//子进程
        //文件句柄
        int m_fd = inotify_init();
        //IN_ACCESS，即文件被访问
        //IN_MODIFY，文件被 write
        //IN_ATTRIB，文件属性被修改，如 chmod、chown、touch 等
        //IN_CLOSE_WRITE，可写文件被 close
        //IN_CLOSE_NOWRITE，不可写文件被 close
        //IN_OPEN，文件被 open
        //IN_MOVED_FROM，文件被移走,如 mv
        //IN_MOVED_TO，文件被移来，如 mv、cp
        //IN_CREATE，创建新文件
        //IN_DELETE，文件被删除，如 rm
        //IN_DELETE_SELF，自删除，即一个可执行文件在执行时删除自己
        //IN_MOVE_SELF，自移动，即一个可执行文件在执行时移动自己
        //IN_UNMOUNT，宿主文件系统被 umount
        //IN_CLOSE，文件被关闭，等同于(IN_CLOSE_WRITE | IN_CLOSE_NOWRITE)
        //IN_MOVE，文件被移动，等同于(IN_MOVED_FROM | IN_MOVED_TO)
        //注：上面所说的文件也包括目录。
        //开始监听
        int res = inotify_add_watch(m_fd, path, IN_DELETE_SELF);

        //阻塞，是否被删除
        char event_buf[512];
        struct inotify_event* event;
        int num_bytes = read(m_fd, event_buf, sizeof(event_buf));

        //被删除了，移除监听
        inotify_rm_watch(m_fd, (uint32_t) res);

        //使用am命令跳转浏览器
        if (sdk < 17) {
            execlp("am", "am", "start", "-a", "android.intent.action.VIEW", "-d",
                   "http://www.baidu.com", NULL);
        } else {//17以后，新增多用户的操作
            execlp("am", "am", "start", "--user", "0", "-a", "android.intent.action.VIEW", "-d",
                   "http://www.baidu.com", NULL);
        }
    }

    env->ReleaseStringUTFChars(path_, path);
}

卸载监听.gif

经测试，安卓7.0以后无法使用，可以fork进程，但am命令无法调用

项目地址：https://gitee.com/aruba/UninstallApplication.git