插件化

Hook IActivityManager方案实现

private static final Singleton<IActivityManager> gDefault = new Singleton<IActivityManager>() {
    protected IActivityManager create() {
        IBinder b = ServiceManager.getService("activity
        IActivityManager am = asInterface(
        return am;
    }
};

• 注册Activity进行占坑
• 使用占坑Activity通过AMS验证
• 还原插件Activity

Hook Instrumentation方案实现

https://blog.csdn.net/itachi85/article/details/80574390?utm_medium=distribute.pc_relevant.none-task-blog-title-2&spm=1001.2101.3001.4242

Hook

Hook点的选择,尽量是静态变量,单例,并且是public的对象和方法