1. 将系统提供的Instrumentation替换为自定义的VAInstrumentation，将主线程Handler的Callback也替换为VAInstrumentation（VAInstrumentation 实现了Handler.Callback接口）

protected void hookInstrumentationAndHandler() { try { // 获取当前进程的activityThread ActivityThread activityThread = ActivityThread.currentActivityThread(); // 获取当前进程的Instrumentation Instrumentation baseInstrumentation = activityThread.getInstrumentation(); // 创建自定义Instrumentation final VAInstrumentation instrumentation = createInstrumentation(baseInstrumentation); // 将当前进程原有的Instrumentation对象替换为自定义的 Reflector.with(activityThread).field("mInstrumentation").set(instrumentation); // 将当前进程原有的主线程Hander的callback替换为自定义的 Handler mainHandler = Reflector.with(activityThread).method("getHandler").call(); Reflector.with(mainHandler).field("mCallback").set(instrumentation); this.mInstrumentation = instrumentation; Log.d(TAG, "hookInstrumentationAndHandler succeed : " + mInstrumentation); } catch (Exception e) { Log.w(TAG, e); } }

public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token, Activity target, Intent intent, int requestCode) { // 对原始Intent进行处理 injectIntent(intent); return mBase.execStartActivity(who, contextThread, token, target, intent, requestCode); }

public void markIntentIfNeeded(Intent intent) { ... String targetPackageName = intent.getComponent().getPackageName(); String targetClassName = intent.getComponent().getClassName(); // 判断是否需要启动的是插件Apk的Activity if (!targetPackageName.equals(mContext.getPackageName()) && mPluginManager.getLoadedPlugin(targetPackageName) != null) { ... // 将原始Intent的目标Acitivy替换为预设的插桩Activity中的一个 dispatchStubActivity(intent); } }

case ActivityInfo.LAUNCH_SINGLE_TOP: { usedSingleTopStubActivity = usedSingleTopStubActivity % MAX_COUNT_SINGLETOP + 1; stubActivity = String.format(STUB_ACTIVITY_SINGLETOP, corePackage, usedSingleTopStubActivity); break; } case ActivityInfo.LAUNCH_SINGLE_TASK: { usedSingleTaskStubActivity = usedSingleTaskStubActivity % MAX_COUNT_SINGLETASK + 1; stubActivity = String.format(STUB_ACTIVITY_SINGLETASK, corePackage, usedSingleTaskStubActivity); break; } case ActivityInfo.LAUNCH_SINGLE_INSTANCE: { usedSingleInstanceStubActivity = usedSingleInstanceStubActivity % MAX_COUNT_SINGLEINSTANCE + 1; stubActivity = String.format(STUB_ACTIVITY_SINGLEINSTANCE, corePackage, usedSingleInstanceStubActivity); break; }

@Override public Activity newActivity(ClassLoader cl, String className, Intent intent) throws InstantiationException, IllegalAccessException, ClassNotFoundException { try { cl.loadClass(className); Log.i(TAG, String.format("newActivity[%s]", className)); } catch (ClassNotFoundException e) { ComponentName component = PluginUtil.getComponent(intent); String targetClassName = component.getClassName(); Log.i(TAG, String.format("newActivity[%s : %s/%s]", className, component.getPackageName(), targetClassName)); LoadedPlugin plugin = this.mPluginManager.getLoadedPlugin(component); // 使用在LoadedPlugin对象中创建的DexClassLoader进行类加载，该ClassLoader指向插件APK所在路径 Activity activity = mBase.newActivity(plugin.getClassLoader(), targetClassName, intent); activity.setIntent(intent); // 插件Activity实例创建后，将Resource替换为插件APK的资源 Reflector.QuietReflector.with(activity).field("mResources").set(plugin.getResources()); return newActivity(activity); }return newActivity(mBase.newActivity(cl, className, intent)); }

protected void injectActivity(Activity activity) { final Intent intent = activity.getIntent(); if (PluginUtil.isIntentFromPlugin(intent)) { Context base = activity.getBaseContext(); try { LoadedPlugin plugin = this.mPluginManager.getLoadedPlugin(intent); Reflector.with(base).field("mResources").set(plugin.getResources()); Reflector reflector = Reflector.with(activity); reflector.field("mBase").set(plugin.createPluginContext(activity.getBaseContext())); reflector.field("mApplication").set(plugin.getApplication()); // set screenOrientation ActivityInfo activityInfo = plugin.getActivityInfo(PluginUtil.getComponent(intent)); if (activityInfo.screenOrientation != ActivityInfo.SCREEN_ORIENTATION_UNSPECIFIED) { activity.setRequestedOrientation(activityInfo.screenOrientation); }// for native activity ComponentName component = PluginUtil.getComponent(intent); Intent wrapperIntent = new Intent(intent); wrapperIntent.setClassName(component.getPackageName(), component.getClassName()); wrapperIntent.setExtrasClassLoader(activity.getClassLoader()); activity.setIntent(wrapperIntent); } catch (Exception e) { Log.w(TAG, e); } } }

1. 使用动态代理代理宿主APP中所有关于Service的请求
2. 判断是否为插件APK中的Service，如果不是，则说明为宿主 APP中的，直接打开即可
3. 如果是插件APK中的Service，则判断是否为远端Service，如果是远端Service，则启动RemoteService，并在其StartCommand方法中根据所代理的生命周期方法进行处理
4. 如果是本地Service，则启动LocalService，并在其StartCommand方法中根据所代理的生命周期方法进行处理

protected void hookSystemServices() { try { Singleton defaultSingleton; // 获取IActivityManager对象 if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) { defaultSingleton = Reflector.on(ActivityManager.class).field("IActivityManagerSingleton").get(); } else { defaultSingleton = Reflector.on(ActivityManagerNative.class).field("gDefault").get(); } IActivityManager origin = defaultSingleton.get(); // 创建activityManager对象的动态代理 IActivityManager activityManager对象的动态代理 = (IActivityManager) Proxy.newProxyInstance(mContext.getClassLoader(), new Class[] { IActivityManager.class }, createActivityManagerProxy(origin)); // 使用动态代理替换之前的IActivityManager对象实例 Reflector.with(defaultSingleton).field("mInstance").set(activityManagerProxy); if (defaultSingleton.get() == activityManagerProxy) { this.mActivityManager = activityManagerProxy; Log.d(TAG, "hookSystemServices succeed : " + mActivityManager); } } catch (Exception e) { Log.w(TAG, e); } }

@Override public Object invoke(Object proxy, Method method, Object[] args) throws Throwable { if ("startService".equals(method.getName())) { try { return startService(proxy, method, args); } catch (Throwable e) { Log.e(TAG, "Start service error", e); } }

protected Object startService(Object proxy, Method method, Object[] args) throws Throwable { IApplicationThread appThread = (IApplicationThread) args[0]; Intent target = (Intent) args[1]; ResolveInfo resolveInfo = this.mPluginManager.resolveService(target, 0); if (null == resolveInfo || null == resolveInfo.serviceInfo) { //插件中没找到，说明是宿主APP自己的Service return method.invoke(this.mActivityManager, args); } // 启动插件APK中的Service return startDelegateServiceForTarget(target, resolveInfo.serviceInfo, null, RemoteService.EXTRA_COMMAND_START_SERVICE); }

virtualApk { packageId = 0x6f // the package id of Resources. targetHost = '../../VirtualAPK/app' // the path of application module in host project. applyHostMapping = true //optional, default value: true. }

def collect() {//1、First, collect all resources by parsing the R symbol file. parseResEntries(allRSymbolFile, allResources, allStyleables)//2、Then, collect host resources by parsing the host apk R symbol file, should be stripped. parseResEntries(hostRSymbolFile, hostResources, hostStyleables)//3、Compute the resources that should be retained in the plugin apk. filterPluginResources()//4、Reassign the resource ID. If the resource entry exists in host apk, the reassign ID //should be same with value in host apk; If the resource entry is owned by plugin project, //then we should recalculate the ID value. reassignPluginResourceId()//5、Collect all the resources in the retained AARs, to regenerate the R java file that uses the new resource ID vaContext.retainedAarLibs.each { gatherReservedAarResources(it) } }

private void reassignPluginResourceId() { // 对资源ID根据typeId进行排序 resourceIdList.sort { t1, t2 -> t1.typeId - t2.typeId }int lastType = 1 // 重写资源ID resourceIdList.each { if (it.typeId < 0) { return } def typeId = 0 def entryId = 0 typeId = lastType++ pluginResources.get(it.resType).each { it.setNewResourceId(virtualApk.packageId, typeId, entryId++) } } }

public void setNewResourceId(packageId, typeId, entryId) { newResourceId = packageId << 24 | typeId << 16 | entryId }

推荐阅读

• 

  脚膜能治脚气吗
• 

  突发脑溢血的一些急救方法
• 

  gpu|4799 元起，华为 MateBook D 系列笔记本今晚开售
• 

  mysql横向分表查询 mysql表垂直拆分
• 

  率士之滨攻略
• 

  好豆菜谱app功能分析
• 

  疫苗|18岁以下几时开打？打过两针，要不要加一针？……专家释疑
• 

  用if语句和迭代完成斐波那契数列
• 

  电脑的USB 3.0与2.4GHz的无线设备有干扰！
• 

  糯米粉可以做包子馒头吗
• 

  做跨境电商的好处 跨境商务电商有什么好处，跨境电商怎么做
• 

  mysql网络io mysql网络库的功能
• 

  PotPlayer设置进度条显示时间的操作步骤
• 

  壑怎么读 壑的成语
• 

  下载单机象棋
• 

  佳能EOS相机自动关机维修多少钱
• 

  开学礼物送什么给孩子
• 

  十大量化对冲基金 什么叫对冲基金
• 

  佳能相机如何拍得更清晰 佳能相机怎么拍清晰度
• 

  gina英文名的寓意 gina英文名的寓意什么

• Android|Android 插件化