1. 将系统提供的Instrumentation替换为自定义的VAInstrumentation，将主线程Handler的Callback也替换为VAInstrumentation（VAInstrumentation 实现了Handler.Callback接口）

protected void hookInstrumentationAndHandler() { try { // 获取当前进程的activityThread ActivityThread activityThread = ActivityThread.currentActivityThread(); // 获取当前进程的Instrumentation Instrumentation baseInstrumentation = activityThread.getInstrumentation(); // 创建自定义Instrumentation final VAInstrumentation instrumentation = createInstrumentation(baseInstrumentation); // 将当前进程原有的Instrumentation对象替换为自定义的 Reflector.with(activityThread).field("mInstrumentation").set(instrumentation); // 将当前进程原有的主线程Hander的callback替换为自定义的 Handler mainHandler = Reflector.with(activityThread).method("getHandler").call(); Reflector.with(mainHandler).field("mCallback").set(instrumentation); this.mInstrumentation = instrumentation; Log.d(TAG, "hookInstrumentationAndHandler succeed : " + mInstrumentation); } catch (Exception e) { Log.w(TAG, e); } }

public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token, Activity target, Intent intent, int requestCode) { // 对原始Intent进行处理 injectIntent(intent); return mBase.execStartActivity(who, contextThread, token, target, intent, requestCode); }

public void markIntentIfNeeded(Intent intent) { ... String targetPackageName = intent.getComponent().getPackageName(); String targetClassName = intent.getComponent().getClassName(); // 判断是否需要启动的是插件Apk的Activity if (!targetPackageName.equals(mContext.getPackageName()) && mPluginManager.getLoadedPlugin(targetPackageName) != null) { ... // 将原始Intent的目标Acitivy替换为预设的插桩Activity中的一个 dispatchStubActivity(intent); } }

case ActivityInfo.LAUNCH_SINGLE_TOP: { usedSingleTopStubActivity = usedSingleTopStubActivity % MAX_COUNT_SINGLETOP + 1; stubActivity = String.format(STUB_ACTIVITY_SINGLETOP, corePackage, usedSingleTopStubActivity); break; } case ActivityInfo.LAUNCH_SINGLE_TASK: { usedSingleTaskStubActivity = usedSingleTaskStubActivity % MAX_COUNT_SINGLETASK + 1; stubActivity = String.format(STUB_ACTIVITY_SINGLETASK, corePackage, usedSingleTaskStubActivity); break; } case ActivityInfo.LAUNCH_SINGLE_INSTANCE: { usedSingleInstanceStubActivity = usedSingleInstanceStubActivity % MAX_COUNT_SINGLEINSTANCE + 1; stubActivity = String.format(STUB_ACTIVITY_SINGLEINSTANCE, corePackage, usedSingleInstanceStubActivity); break; }

@Override public Activity newActivity(ClassLoader cl, String className, Intent intent) throws InstantiationException, IllegalAccessException, ClassNotFoundException { try { cl.loadClass(className); Log.i(TAG, String.format("newActivity[%s]", className)); } catch (ClassNotFoundException e) { ComponentName component = PluginUtil.getComponent(intent); String targetClassName = component.getClassName(); Log.i(TAG, String.format("newActivity[%s : %s/%s]", className, component.getPackageName(), targetClassName)); LoadedPlugin plugin = this.mPluginManager.getLoadedPlugin(component); // 使用在LoadedPlugin对象中创建的DexClassLoader进行类加载，该ClassLoader指向插件APK所在路径 Activity activity = mBase.newActivity(plugin.getClassLoader(), targetClassName, intent); activity.setIntent(intent); // 插件Activity实例创建后，将Resource替换为插件APK的资源 Reflector.QuietReflector.with(activity).field("mResources").set(plugin.getResources()); return newActivity(activity); }return newActivity(mBase.newActivity(cl, className, intent)); }

protected void injectActivity(Activity activity) { final Intent intent = activity.getIntent(); if (PluginUtil.isIntentFromPlugin(intent)) { Context base = activity.getBaseContext(); try { LoadedPlugin plugin = this.mPluginManager.getLoadedPlugin(intent); Reflector.with(base).field("mResources").set(plugin.getResources()); Reflector reflector = Reflector.with(activity); reflector.field("mBase").set(plugin.createPluginContext(activity.getBaseContext())); reflector.field("mApplication").set(plugin.getApplication()); // set screenOrientation ActivityInfo activityInfo = plugin.getActivityInfo(PluginUtil.getComponent(intent)); if (activityInfo.screenOrientation != ActivityInfo.SCREEN_ORIENTATION_UNSPECIFIED) { activity.setRequestedOrientation(activityInfo.screenOrientation); }// for native activity ComponentName component = PluginUtil.getComponent(intent); Intent wrapperIntent = new Intent(intent); wrapperIntent.setClassName(component.getPackageName(), component.getClassName()); wrapperIntent.setExtrasClassLoader(activity.getClassLoader()); activity.setIntent(wrapperIntent); } catch (Exception e) { Log.w(TAG, e); } } }

1. 使用动态代理代理宿主APP中所有关于Service的请求
2. 判断是否为插件APK中的Service，如果不是，则说明为宿主 APP中的，直接打开即可
3. 如果是插件APK中的Service，则判断是否为远端Service，如果是远端Service，则启动RemoteService，并在其StartCommand方法中根据所代理的生命周期方法进行处理
4. 如果是本地Service，则启动LocalService，并在其StartCommand方法中根据所代理的生命周期方法进行处理

protected void hookSystemServices() { try { Singleton defaultSingleton; // 获取IActivityManager对象 if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) { defaultSingleton = Reflector.on(ActivityManager.class).field("IActivityManagerSingleton").get(); } else { defaultSingleton = Reflector.on(ActivityManagerNative.class).field("gDefault").get(); } IActivityManager origin = defaultSingleton.get(); // 创建activityManager对象的动态代理 IActivityManager activityManager对象的动态代理 = (IActivityManager) Proxy.newProxyInstance(mContext.getClassLoader(), new Class[] { IActivityManager.class }, createActivityManagerProxy(origin)); // 使用动态代理替换之前的IActivityManager对象实例 Reflector.with(defaultSingleton).field("mInstance").set(activityManagerProxy); if (defaultSingleton.get() == activityManagerProxy) { this.mActivityManager = activityManagerProxy; Log.d(TAG, "hookSystemServices succeed : " + mActivityManager); } } catch (Exception e) { Log.w(TAG, e); } }

@Override public Object invoke(Object proxy, Method method, Object[] args) throws Throwable { if ("startService".equals(method.getName())) { try { return startService(proxy, method, args); } catch (Throwable e) { Log.e(TAG, "Start service error", e); } }

protected Object startService(Object proxy, Method method, Object[] args) throws Throwable { IApplicationThread appThread = (IApplicationThread) args[0]; Intent target = (Intent) args[1]; ResolveInfo resolveInfo = this.mPluginManager.resolveService(target, 0); if (null == resolveInfo || null == resolveInfo.serviceInfo) { //插件中没找到，说明是宿主APP自己的Service return method.invoke(this.mActivityManager, args); } // 启动插件APK中的Service return startDelegateServiceForTarget(target, resolveInfo.serviceInfo, null, RemoteService.EXTRA_COMMAND_START_SERVICE); }

virtualApk { packageId = 0x6f // the package id of Resources. targetHost = '../../VirtualAPK/app' // the path of application module in host project. applyHostMapping = true //optional, default value: true. }

def collect() {//1、First, collect all resources by parsing the R symbol file. parseResEntries(allRSymbolFile, allResources, allStyleables)//2、Then, collect host resources by parsing the host apk R symbol file, should be stripped. parseResEntries(hostRSymbolFile, hostResources, hostStyleables)//3、Compute the resources that should be retained in the plugin apk. filterPluginResources()//4、Reassign the resource ID. If the resource entry exists in host apk, the reassign ID //should be same with value in host apk; If the resource entry is owned by plugin project, //then we should recalculate the ID value. reassignPluginResourceId()//5、Collect all the resources in the retained AARs, to regenerate the R java file that uses the new resource ID vaContext.retainedAarLibs.each { gatherReservedAarResources(it) } }

private void reassignPluginResourceId() { // 对资源ID根据typeId进行排序 resourceIdList.sort { t1, t2 -> t1.typeId - t2.typeId }int lastType = 1 // 重写资源ID resourceIdList.each { if (it.typeId < 0) { return } def typeId = 0 def entryId = 0 typeId = lastType++ pluginResources.get(it.resType).each { it.setNewResourceId(virtualApk.packageId, typeId, entryId++) } } }

public void setNewResourceId(packageId, typeId, entryId) { newResourceId = packageId << 24 | typeId << 16 | entryId }

推荐阅读

• 

  电子烟的好处
• 

  做什么行业会利润高又赚钱？
• 

  乳胶内衣怎么清洗晾晒
• 

  梦见买枕巾是什么意思 梦见枕巾是怎么回事
• 

  涉嫌非法种植毒品原植物法定刑罚内容是多少
• 

  自己读书感悟的名言
• 

  投稿|何时起数码玩家已不再期待Android新版本？
• 

  支付宝基金过年期间休市吗
• 

  犯七是什么意思,有什么讲究 犯七是什么意思
• 

  如何选购新鲜白萝卜
• 

  米兔|小米新品儿童手表发售，米兔儿童电话手表5C入手体验
• 

  秦书记 青岛高速公路 青岛高速公路最新消息今天
• 

  法院对串通投标罪规定定罪量刑标准是怎样
• 

  嵌怎么读 嵌字是什么意思
• 

  苹果11网络特别差是什么原因
• 

  贵阳市少年儿童图书馆春节活动一览
• 

  solidworks2012热分析
• 

  2023年南四湖禁渔/禁采时间 南四湖鱼馆怎么样
• 

  奥迪车质量怎么样? 奥迪车质量怎么样
• 

  2021送同事元宵节祝福语

• Android|Android 插件化