1. 将系统提供的Instrumentation替换为自定义的VAInstrumentation，将主线程Handler的Callback也替换为VAInstrumentation（VAInstrumentation 实现了Handler.Callback接口）

protected void hookInstrumentationAndHandler() { try { // 获取当前进程的activityThread ActivityThread activityThread = ActivityThread.currentActivityThread(); // 获取当前进程的Instrumentation Instrumentation baseInstrumentation = activityThread.getInstrumentation(); // 创建自定义Instrumentation final VAInstrumentation instrumentation = createInstrumentation(baseInstrumentation); // 将当前进程原有的Instrumentation对象替换为自定义的 Reflector.with(activityThread).field("mInstrumentation").set(instrumentation); // 将当前进程原有的主线程Hander的callback替换为自定义的 Handler mainHandler = Reflector.with(activityThread).method("getHandler").call(); Reflector.with(mainHandler).field("mCallback").set(instrumentation); this.mInstrumentation = instrumentation; Log.d(TAG, "hookInstrumentationAndHandler succeed : " + mInstrumentation); } catch (Exception e) { Log.w(TAG, e); } }

public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token, Activity target, Intent intent, int requestCode) { // 对原始Intent进行处理 injectIntent(intent); return mBase.execStartActivity(who, contextThread, token, target, intent, requestCode); }

public void markIntentIfNeeded(Intent intent) { ... String targetPackageName = intent.getComponent().getPackageName(); String targetClassName = intent.getComponent().getClassName(); // 判断是否需要启动的是插件Apk的Activity if (!targetPackageName.equals(mContext.getPackageName()) && mPluginManager.getLoadedPlugin(targetPackageName) != null) { ... // 将原始Intent的目标Acitivy替换为预设的插桩Activity中的一个 dispatchStubActivity(intent); } }

case ActivityInfo.LAUNCH_SINGLE_TOP: { usedSingleTopStubActivity = usedSingleTopStubActivity % MAX_COUNT_SINGLETOP + 1; stubActivity = String.format(STUB_ACTIVITY_SINGLETOP, corePackage, usedSingleTopStubActivity); break; } case ActivityInfo.LAUNCH_SINGLE_TASK: { usedSingleTaskStubActivity = usedSingleTaskStubActivity % MAX_COUNT_SINGLETASK + 1; stubActivity = String.format(STUB_ACTIVITY_SINGLETASK, corePackage, usedSingleTaskStubActivity); break; } case ActivityInfo.LAUNCH_SINGLE_INSTANCE: { usedSingleInstanceStubActivity = usedSingleInstanceStubActivity % MAX_COUNT_SINGLEINSTANCE + 1; stubActivity = String.format(STUB_ACTIVITY_SINGLEINSTANCE, corePackage, usedSingleInstanceStubActivity); break; }

@Override public Activity newActivity(ClassLoader cl, String className, Intent intent) throws InstantiationException, IllegalAccessException, ClassNotFoundException { try { cl.loadClass(className); Log.i(TAG, String.format("newActivity[%s]", className)); } catch (ClassNotFoundException e) { ComponentName component = PluginUtil.getComponent(intent); String targetClassName = component.getClassName(); Log.i(TAG, String.format("newActivity[%s : %s/%s]", className, component.getPackageName(), targetClassName)); LoadedPlugin plugin = this.mPluginManager.getLoadedPlugin(component); // 使用在LoadedPlugin对象中创建的DexClassLoader进行类加载，该ClassLoader指向插件APK所在路径 Activity activity = mBase.newActivity(plugin.getClassLoader(), targetClassName, intent); activity.setIntent(intent); // 插件Activity实例创建后，将Resource替换为插件APK的资源 Reflector.QuietReflector.with(activity).field("mResources").set(plugin.getResources()); return newActivity(activity); }return newActivity(mBase.newActivity(cl, className, intent)); }

protected void injectActivity(Activity activity) { final Intent intent = activity.getIntent(); if (PluginUtil.isIntentFromPlugin(intent)) { Context base = activity.getBaseContext(); try { LoadedPlugin plugin = this.mPluginManager.getLoadedPlugin(intent); Reflector.with(base).field("mResources").set(plugin.getResources()); Reflector reflector = Reflector.with(activity); reflector.field("mBase").set(plugin.createPluginContext(activity.getBaseContext())); reflector.field("mApplication").set(plugin.getApplication()); // set screenOrientation ActivityInfo activityInfo = plugin.getActivityInfo(PluginUtil.getComponent(intent)); if (activityInfo.screenOrientation != ActivityInfo.SCREEN_ORIENTATION_UNSPECIFIED) { activity.setRequestedOrientation(activityInfo.screenOrientation); }// for native activity ComponentName component = PluginUtil.getComponent(intent); Intent wrapperIntent = new Intent(intent); wrapperIntent.setClassName(component.getPackageName(), component.getClassName()); wrapperIntent.setExtrasClassLoader(activity.getClassLoader()); activity.setIntent(wrapperIntent); } catch (Exception e) { Log.w(TAG, e); } } }

1. 使用动态代理代理宿主APP中所有关于Service的请求
2. 判断是否为插件APK中的Service，如果不是，则说明为宿主 APP中的，直接打开即可
3. 如果是插件APK中的Service，则判断是否为远端Service，如果是远端Service，则启动RemoteService，并在其StartCommand方法中根据所代理的生命周期方法进行处理
4. 如果是本地Service，则启动LocalService，并在其StartCommand方法中根据所代理的生命周期方法进行处理

protected void hookSystemServices() { try { Singleton defaultSingleton; // 获取IActivityManager对象 if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) { defaultSingleton = Reflector.on(ActivityManager.class).field("IActivityManagerSingleton").get(); } else { defaultSingleton = Reflector.on(ActivityManagerNative.class).field("gDefault").get(); } IActivityManager origin = defaultSingleton.get(); // 创建activityManager对象的动态代理 IActivityManager activityManager对象的动态代理 = (IActivityManager) Proxy.newProxyInstance(mContext.getClassLoader(), new Class[] { IActivityManager.class }, createActivityManagerProxy(origin)); // 使用动态代理替换之前的IActivityManager对象实例 Reflector.with(defaultSingleton).field("mInstance").set(activityManagerProxy); if (defaultSingleton.get() == activityManagerProxy) { this.mActivityManager = activityManagerProxy; Log.d(TAG, "hookSystemServices succeed : " + mActivityManager); } } catch (Exception e) { Log.w(TAG, e); } }

@Override public Object invoke(Object proxy, Method method, Object[] args) throws Throwable { if ("startService".equals(method.getName())) { try { return startService(proxy, method, args); } catch (Throwable e) { Log.e(TAG, "Start service error", e); } }

protected Object startService(Object proxy, Method method, Object[] args) throws Throwable { IApplicationThread appThread = (IApplicationThread) args[0]; Intent target = (Intent) args[1]; ResolveInfo resolveInfo = this.mPluginManager.resolveService(target, 0); if (null == resolveInfo || null == resolveInfo.serviceInfo) { //插件中没找到，说明是宿主APP自己的Service return method.invoke(this.mActivityManager, args); } // 启动插件APK中的Service return startDelegateServiceForTarget(target, resolveInfo.serviceInfo, null, RemoteService.EXTRA_COMMAND_START_SERVICE); }

virtualApk { packageId = 0x6f // the package id of Resources. targetHost = '../../VirtualAPK/app' // the path of application module in host project. applyHostMapping = true //optional, default value: true. }

def collect() {//1、First, collect all resources by parsing the R symbol file. parseResEntries(allRSymbolFile, allResources, allStyleables)//2、Then, collect host resources by parsing the host apk R symbol file, should be stripped. parseResEntries(hostRSymbolFile, hostResources, hostStyleables)//3、Compute the resources that should be retained in the plugin apk. filterPluginResources()//4、Reassign the resource ID. If the resource entry exists in host apk, the reassign ID //should be same with value in host apk; If the resource entry is owned by plugin project, //then we should recalculate the ID value. reassignPluginResourceId()//5、Collect all the resources in the retained AARs, to regenerate the R java file that uses the new resource ID vaContext.retainedAarLibs.each { gatherReservedAarResources(it) } }

private void reassignPluginResourceId() { // 对资源ID根据typeId进行排序 resourceIdList.sort { t1, t2 -> t1.typeId - t2.typeId }int lastType = 1 // 重写资源ID resourceIdList.each { if (it.typeId < 0) { return } def typeId = 0 def entryId = 0 typeId = lastType++ pluginResources.get(it.resType).each { it.setNewResourceId(virtualApk.packageId, typeId, entryId++) } } }

public void setNewResourceId(packageId, typeId, entryId) { newResourceId = packageId << 24 | typeId << 16 | entryId }

推荐阅读

• 

  博世热水器代码怎么样是什么故障,出现这故障是什么原因
• 

  vb.netdism的简单介绍
• 

  汕头好玩还是潮州好玩
• 

  清扬洗发水什么成份和功效
• 

  京东商城界面设计分析
• 

  武汉周黑鸭的做法 武汉黑鸭子
• 

  直播团单工具，主播团播有什么任务
• 

  温馨诚挚生日祝福语一句话
• 

  佳明导航仪
• 

  关于杜甫的古诗 杜甫的古诗有哪些
• 

  Spring|Spring 注解配置（2）——@Autowired
• 

  thinkphp手动记录日志，php如何记录日志
• 

  事实重婚罪公安局未立案 重婚罪公安不立案
• 

  小游戏制作平台，怎么制作微信的小游戏什么平台适合
• 

  油鱼的功效与作用
• 

  wosports S6使用说明
• 

  李银河新浪微博 李银河的博客
• 

  亮点|终于等来华为P50系列发布会 新品亮点价格全在这！
• 

  网络安全解决方案,校园网网络安全解决方案
• 

  this怎么读英语语音 this怎么读英语

• Android|Android 插件化