**
**/
package com.morgoo.droidplugin.core;
import android.content.Context;
import android.os.Environment;
import java.io.File;
import java.util.ArrayList;
import java.util.List;
/**
* 插件目录结构
* 基本目录： /data/data/com.HOST.PACKAGE/Plugin
* 单个插件的基本目录： /data/data/com.HOST.PACKAGE/Plugin
* source_dir： /data/data/com.HOST.PACKAGE/Plugin/PLUGIN.PKG/apk/apk-1.apk
* 数据目录： /data/data/com.HOST.PACKAGE/Plugin/PLUGIN.PKG/data/PLUGIN.PKG
* dex缓存目录： /data/data/com.HOST.PACKAGE/Plugin/PLUGIN.PKG/dalvik-cache/
*
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/2/5.
*/
public class PluginDirHelper {
private static File sBaseDir = null;
private static void init(Context context) {
if (sBaseDir == null) {
sBaseDir = new File(context.getCacheDir().getParentFile(), "Plugin");
enforceDirExists(sBaseDir);
}
}
private static String enforceDirExists(File file) {
if (!file.exists()) {
file.mkdirs();
}
return file.getPath();
}
public static String makePluginBaseDir(Context context, String pluginInfoPackageName) {
init(context);
return enforceDirExists(new File(sBaseDir, pluginInfoPackageName));
}
public static String getBaseDir(Context context) {
init(context);
return enforceDirExists(sBaseDir);
}
public static String getPluginDataDir(Context context, String pluginInfoPackageName) {
return enforceDirExists(new File(makePluginBaseDir(context, pluginInfoPackageName), "data/" + pluginInfoPackageName));
}
public static String getPluginSignatureDir(Context context, String pluginInfoPackageName) {
return enforceDirExists(new File(makePluginBaseDir(context, pluginInfoPackageName), "Signature/"));
}
public static String getPluginSignatureFile(Context context, String pluginInfoPackageName, int index) {
return new File(getPluginSignatureDir(context, pluginInfoPackageName), String.format("Signature_%s.key", index)).getPath();
}
public static List getPluginSignatureFiles(Context context, String pluginInfoPackageName) {
ArrayList files = new ArrayList();
String dir = getPluginSignatureDir(context, pluginInfoPackageName);
File d = new File(dir);
File[] fs = d.listFiles();
if (fs != null && fs.length > 0) {
for (File f : fs) {
files.add(f.getPath());
}
}
return files;
}
public static String getPluginApkDir(Context context, String pluginInfoPackageName) {
return enforceDirExists(new File(makePluginBaseDir(context, pluginInfoPackageName), "apk"));
}
public static String getPluginApkFile(Context context, String pluginInfoPackageName) {
return new File(getPluginApkDir(context, pluginInfoPackageName), "base-1.apk").getPath();
}
public static String getPluginDalvikCacheDir(Context context, String pluginInfoPackageName) {
return enforceDirExists(new File(makePluginBaseDir(context, pluginInfoPackageName), "dalvik-cache"));
}
public static String getPluginNativeLibraryDir(Context context, String pluginInfoPackageName) {
return enforceDirExists(new File(makePluginBaseDir(context, pluginInfoPackageName), "lib"));
}
public static String getPluginDalvikCacheFile(Context context, String pluginInfoPackageName) {
String dalvikCacheDir = getPluginDalvikCacheDir(context, pluginInfoPackageName);
String pluginApkFile = getPluginApkFile(context, pluginInfoPackageName);
String apkName = new File(pluginApkFile).getName();
String dexName = apkName.replace(File.separator, "@");
if (dexName.startsWith("@")) {
dexName = dexName.substring(1);
}
return new File(dalvikCacheDir, dexName + "@classes.dex").getPath();
}
public static String getContextDataDir(Context context) {
String dataDir = new File(Environment.getDataDirectory(), "data/").getPath();
return new File(dataDir, context.getPackageName()).getPath();
}
public static void cleanOptimizedDirectory(String optimizedDirectory) {
try {
File dir = new File(optimizedDirectory);
if (dir.exists() && dir.isDirectory()) {
File[] files = dir.listFiles();
if (files != null && files.length > 0) {
for (File f : files) {
f.delete();
}
}
}
if (dir.exists() && dir.isFile()) {
dir.delete();
dir.mkdirs();
}
} catch (Throwable e) {
}
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/core/PluginProcessManager.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.core;
import android.app.ActivityManager;
import android.app.ActivityManager.RunningAppProcessInfo;
import android.app.Application;
import android.content.BroadcastReceiver;
import android.content.ContentResolver;
import android.content.Context;
import android.content.ContextWrapper;
import android.content.IntentFilter;
import android.content.pm.ActivityInfo;
import android.content.pm.ApplicationInfo;
import android.content.pm.ComponentInfo;
import android.content.pm.PackageInfo;
import android.content.pm.PackageManager;
import android.content.pm.ProviderInfo;
import android.content.pm.ServiceInfo;
import android.os.Build.VERSION;
import android.os.Build.VERSION_CODES;
import android.os.Handler;
import android.os.Looper;
import android.text.TextUtils;
import com.morgoo.droidplugin.hook.HookFactory;
import com.morgoo.droidplugin.pm.PluginManager;
import com.morgoo.droidplugin.reflect.FieldUtils;
import com.morgoo.droidplugin.reflect.MethodUtils;
import com.morgoo.droidplugin.stub.ActivityStub;
import com.morgoo.droidplugin.stub.ServiceStub;
import com.morgoo.helper.compat.ActivityThreadCompat;
import com.morgoo.helper.compat.CompatibilityInfoCompat;
import com.morgoo.helper.Log;
import com.morgoo.helper.compat.ProcessCompat;
import java.io.IOException;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.WeakHashMap;
import java.util.concurrent.atomic.AtomicBoolean;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/2/4.
*/
public class PluginProcessManager {
private static final String TAG = "PluginProcessManager";
private static String sCurrentProcessName;
private static Object sGetCurrentProcessNameLock = new Object();
private static Map sPluginClassLoaderCache = new WeakHashMap(1);
private static Map sPluginLoadedApkCache = new WeakHashMap(1);
public static String getCurrentProcessName(Context context) {
if (context == null)
return sCurrentProcessName;
synchronized (sGetCurrentProcessNameLock) {
if (sCurrentProcessName == null) {
ActivityManager activityManager = (ActivityManager) context.getSystemService(Context.ACTIVITY_SERVICE);
List infos = activityManager.getRunningAppProcesses();
if (infos == null)
return null;
for (RunningAppProcessInfo info : infos) {
if (info.pid == android.os.Process.myPid()) {
sCurrentProcessName = info.processName;
return sCurrentProcessName;
}
}
}
}
return sCurrentProcessName;
}
private static List sProcessList = new ArrayList<>();
private static void initProcessList(Context context) {
try {
if (sProcessList.size() > 0) {
return;
}
sProcessList.add(context.getPackageName());
PackageManager pm = context.getPackageManager();
PackageInfo packageInfo = pm.getPackageInfo(context.getPackageName(), PackageManager.GET_RECEIVERS | PackageManager.GET_ACTIVITIES | PackageManager.GET_PROVIDERS | PackageManager.GET_SERVICES);
if (packageInfo.receivers != null) {
for (ActivityInfo info : packageInfo.receivers) {
if (!sProcessList.contains(info.processName)) {
sProcessList.add(info.processName);
}
}
}
if (packageInfo.providers != null) {
for (ProviderInfo info : packageInfo.providers) {
if (!sProcessList.contains(info.processName) && info.processName != null && info.authority != null && info.authority.indexOf(PluginManager.STUB_AUTHORITY_NAME) < 0) {
sProcessList.add(info.processName);
}
}
}
if (packageInfo.services != null) {
for (ServiceInfo info : packageInfo.services) {
if (!sProcessList.contains(info.processName) && info.processName != null && info.name != null && info.name.indexOf(ServiceStub.class.getSimpleName()) < 0) {
sProcessList.add(info.processName);
}
}
}
if (packageInfo.activities != null) {
for (ActivityInfo info : packageInfo.activities) {
if (!sProcessList.contains(info.processName) && info.processName != null && info.name != null && info.name.indexOf(ActivityStub.class.getSimpleName()) < 0) {
sProcessList.add(info.processName);
}
}
}
} catch (PackageManager.NameNotFoundException e) {
}
}
public static final boolean isPluginProcess(Context context) {
String currentProcessName = getCurrentProcessName(context);
if (TextUtils.equals(currentProcessName, context.getPackageName()))
return false;
initProcessList(context);
return !sProcessList.contains(currentProcessName);
}
public static ClassLoader getPluginClassLoader(String pkg) throws IllegalAccessException, NoSuchMethodException, ClassNotFoundException, InvocationTargetException {
ClassLoader classLoader = sPluginClassLoaderCache.get(pkg);
if (classLoader == null) {
Application app = getPluginContext(pkg);
if (app != null) {
sPluginClassLoaderCache.put(app.getPackageName(), app.getClassLoader());
}
}
return sPluginClassLoaderCache.get(pkg);
}
public static void preLoadApk(Context hostContext, ComponentInfo pluginInfo) throws IOException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, PackageManager.NameNotFoundException, ClassNotFoundException {
if (pluginInfo == null && hostContext == null) {
return;
}
if (pluginInfo != null && getPluginContext(pluginInfo.packageName) != null) {
return;
}
/*添加插件的LoadedApk对象到ActivityThread.mPackages*/
boolean found = false;
synchronized (sPluginLoadedApkCache) {
Object object = ActivityThreadCompat.currentActivityThread();
if (object != null) {
Object mPackagesObj = FieldUtils.readField(object, "mPackages");
Object containsKeyObj = MethodUtils.invokeMethod(mPackagesObj, "containsKey", pluginInfo.packageName);
if (containsKeyObj instanceof Boolean && !(Boolean) containsKeyObj) {
final Object loadedApk;
if (VERSION.SDK_INT >= VERSION_CODES.HONEYCOMB) {
loadedApk = MethodUtils.invokeMethod(object, "getPackageInfoNoCheck", pluginInfo.applicationInfo, CompatibilityInfoCompat.DEFAULT_COMPATIBILITY_INFO());
} else {
loadedApk = MethodUtils.invokeMethod(object, "getPackageInfoNoCheck", pluginInfo.applicationInfo);
}
sPluginLoadedApkCache.put(pluginInfo.packageName, loadedApk);
/*添加ClassLoader LoadedApk.mClassLoader*/
String optimizedDirectory = PluginDirHelper.getPluginDalvikCacheDir(hostContext, pluginInfo.packageName);
String libraryPath = PluginDirHelper.getPluginNativeLibraryDir(hostContext, pluginInfo.packageName);
String apk = pluginInfo.applicationInfo.publicSourceDir;
if (TextUtils.isEmpty(apk)) {
pluginInfo.applicationInfo.publicSourceDir = PluginDirHelper.getPluginApkFile(hostContext, pluginInfo.packageName);
apk = pluginInfo.applicationInfo.publicSourceDir;
}
if (apk != null) {
ClassLoader classloader = null;
try {
classloader = new PluginClassLoader(apk, optimizedDirectory, libraryPath, hostContext.getClassLoader().getParent());
} catch (Exception e) {
}
if(classloader==null){
PluginDirHelper.cleanOptimizedDirectory(optimizedDirectory);
classloader = new PluginClassLoader(apk, optimizedDirectory, libraryPath, hostContext.getClassLoader().getParent());
}
synchronized (loadedApk) {
FieldUtils.writeDeclaredField(loadedApk, "mClassLoader", classloader);
}
sPluginClassLoaderCache.put(pluginInfo.packageName, classloader);
Thread.currentThread().setContextClassLoader(classloader);
found = true;
}
ProcessCompat.setArgV0(pluginInfo.processName);
}
}
}
if (found) {
PluginProcessManager.preMakeApplication(hostContext, pluginInfo);
}
}
private static AtomicBoolean mExec = new AtomicBoolean(false);
private static Handler sHandle = new Handler(Looper.getMainLooper());
private static void preMakeApplication(Context hostContext, ComponentInfo pluginInfo) {
try {
final Object loadedApk = sPluginLoadedApkCache.get(pluginInfo.packageName);
if (loadedApk != null) {
Object mApplication = FieldUtils.readField(loadedApk, "mApplication");
if (mApplication != null) {
return;
}
if (Looper.getMainLooper() != Looper.myLooper()) {
final Object lock = new Object();
mExec.set(false);
sHandle.post(new Runnable() {
@Override
public void run() {
try {
MethodUtils.invokeMethod(loadedApk, "makeApplication", false, ActivityThreadCompat.getInstrumentation());
} catch (Exception e) {
Log.e(TAG, "preMakeApplication FAIL", e);
} finally {
mExec.set(true);
synchronized (lock) {
lock.notifyAll();
}
}
}
});
if (!mExec.get()) {
synchronized (lock) {
try {
lock.wait();
} catch (InterruptedException e) {
}
}
}
} else {
MethodUtils.invokeMethod(loadedApk, "makeApplication", false, ActivityThreadCompat.getInstrumentation());
}
}
} catch (Exception e) {
Log.e(TAG, "preMakeApplication FAIL", e);
}
}
public static void registerStaticReceiver(Context context, ApplicationInfo pluginApplicationInfo, ClassLoader cl) throws Exception {
List infos = PluginManager.getInstance().getReceivers(pluginApplicationInfo.packageName, 0);
if (infos != null && infos.size() > 0) {
CharSequence myPname = null;
try {
myPname = PluginManager.getInstance().getProcessNameByPid(android.os.Process.myPid());
} catch (Exception e) {
}
for (ActivityInfo info : infos) {
if (TextUtils.equals(info.processName, myPname)) {
try {
List filters = PluginManager.getInstance().getReceiverIntentFilter(info);
for (IntentFilter filter : filters) {
BroadcastReceiver receiver = (BroadcastReceiver) cl.loadClass(info.name).newInstance();
context.registerReceiver(receiver, filter);
}
} catch (Exception e) {
Log.e(TAG, "registerStaticReceiver error=%s", e, info.name);
}
}
}
}
}
public static void setHookEnable(boolean enable) {
HookFactory.getInstance().setHookEnable(enable);
}
public static void setHookEnable(boolean enable, boolean reinstallHook) {
HookFactory.getInstance().setHookEnable(enable, reinstallHook);
}
public static void installHook(Context hostContext) throws Throwable {
HookFactory.getInstance().installHook(hostContext, null);
}
private static HashMap sApplicationsCache = new HashMap(2);
public static Application getPluginContext(String packageName) throws IllegalAccessException, NoSuchMethodException, InvocationTargetException, ClassNotFoundException {
if (!sApplicationsCache.containsKey(packageName)) {
Object at = ActivityThreadCompat.currentActivityThread();
Object mAllApplications = FieldUtils.readField(at, "mAllApplications");
if (mAllApplications instanceof List) {
List apps = (List) mAllApplications;
for (Object o : apps) {
if (o instanceof Application) {
Application app = (Application) o;
if (!sApplicationsCache.containsKey(app.getPackageName())) {
sApplicationsCache.put(app.getPackageName(), app);
}
}
}
}
}
return sApplicationsCache.get(packageName);
}
private static Context getBaseContext(Context c) {
if (c instanceof ContextWrapper) {
return ((ContextWrapper) c).getBaseContext();
}
return c;
}
private static WeakHashMap mFakedContext = new WeakHashMap(1);
private static Object mServiceCache = null;
private static List sSkipService = new ArrayList();
static {
sSkipService.add(Context.LAYOUT_INFLATER_SERVICE);
sSkipService.add(Context.NOTIFICATION_SERVICE);
sSkipService.add("storage");
sSkipService.add("accessibility");
sSkipService.add("audio");
sSkipService.add("clipboard");
sSkipService.add("media_router");
sSkipService.add("wifi");
sSkipService.add("captioning");
sSkipService.add("account");
sSkipService.add("activity");
//fake这个wifiscanner服务可能会导致部分手机重启。例如三星，华为
sSkipService.add("wifiscanner");
sSkipService.add("rttmanager");
sSkipService.add("tv_input");
sSkipService.add("jobscheduler");
sSkipService.add("sensorhub");
//NSDManager init初始化anr的问题
sSkipService.add("servicediscovery");
// sSkipService.add("usagestats");
}
private static void fakeSystemServiceInner(Context hostContext, Context targetContext) {
try {
Context baseContext = getBaseContext(targetContext);
if (mFakedContext.containsValue(baseContext)) {
return;
} else if (mServiceCache != null) {
FieldUtils.writeField(baseContext, "mServiceCache", mServiceCache);
//for context ContentResolver
ContentResolver cr = baseContext.getContentResolver();
if (cr != null) {
Object crctx = FieldUtils.readField(cr, "mContext");
if (crctx != null) {
FieldUtils.writeField(crctx, "mServiceCache", mServiceCache);
}
}
if (!mFakedContext.containsValue(baseContext)) {
mFakedContext.put(baseContext.hashCode(), baseContext);
}
return;
}
Object SYSTEM_SERVICE_MAP = null;
try {
SYSTEM_SERVICE_MAP = FieldUtils.readStaticField(baseContext.getClass(), "SYSTEM_SERVICE_MAP");
} catch (Exception e) {
Log.w(TAG, "readStaticField(SYSTEM_SERVICE_MAP) from %s fail", e, baseContext.getClass());
}
if (SYSTEM_SERVICE_MAP == null) {
try {
SYSTEM_SERVICE_MAP = FieldUtils.readStaticField(Class.forName("android.app.SystemServiceRegistry"), "SYSTEM_SERVICE_FETCHERS");
} catch (Exception e) {
Log.e(TAG, "readStaticField(SYSTEM_SERVICE_FETCHERS) from android.app.SystemServiceRegistry fail", e);
}
}
if (SYSTEM_SERVICE_MAP != null && (SYSTEM_SERVICE_MAP instanceof Map)) {
//如没有，则创建一个新的。
Map sSYSTEM_SERVICE_MAP = (Map) SYSTEM_SERVICE_MAP;
Context originContext = getBaseContext(hostContext);
Object mServiceCache = FieldUtils.readField(originContext, "mServiceCache");
if (mServiceCache instanceof List) {
((List) mServiceCache).clear();
}
for (Object key : sSYSTEM_SERVICE_MAP.keySet()) {
if (sSkipService.contains(key)) {
continue;
}
Object serviceFetcher = sSYSTEM_SERVICE_MAP.get(key);
try {
Method getService = serviceFetcher.getClass().getMethod("getService", baseContext.getClass());
getService.invoke(serviceFetcher, originContext);
} catch (InvocationTargetException e) {
Throwable cause = e.getCause();
if (cause != null) {
Log.w(TAG, "Fake system service faile", e);
} else {
Log.w(TAG, "Fake system service faile", e);
}
} catch (Exception e) {
Log.w(TAG, "Fake system service faile", e);
}
}
mServiceCache = FieldUtils.readField(originContext, "mServiceCache");
FieldUtils.writeField(baseContext, "mServiceCache", mServiceCache);
//for context ContentResolver
ContentResolver cr = baseContext.getContentResolver();
if (cr != null) {
Object crctx = FieldUtils.readField(cr, "mContext");
if (crctx != null) {
FieldUtils.writeField(crctx, "mServiceCache", mServiceCache);
}
}
}
if (!mFakedContext.containsValue(baseContext)) {
mFakedContext.put(baseContext.hashCode(), baseContext);
}
} catch (Exception e) {
Log.e(TAG, "fakeSystemServiceOldAPI", e);
}
}
//这里为了解决某些插件调用系统服务时，系统服务必须要求要以host包名的身份去调用的问题。
public static void fakeSystemService(Context hostContext, Context targetContext) {
if (VERSION.SDK_INT >= VERSION_CODES.ICE_CREAM_SANDWICH_MR1 && !TextUtils.equals(hostContext.getPackageName(), targetContext.getPackageName())) {
long b = System.currentTimeMillis();
fakeSystemServiceInner(hostContext, targetContext);
Log.i(TAG, "Fake SystemService for originContext=%s context=%s,cost %s ms", targetContext.getPackageName(), targetContext.getPackageName(), (System.currentTimeMillis() - b));
}
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/BaseHookHandle.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook;
import android.content.Context;
import com.morgoo.helper.Log;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.util.HashMap;
import java.util.Map;
import java.util.Set;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/2/28.
*/
public abstract class BaseHookHandle {
protected Context mHostContext;
protected Map sHookedMethodHandlers = new HashMap(5);
public BaseHookHandle(Context hostContext) {
mHostContext = hostContext;
init();
}
protected abstract void init();
public Set getHookedMethodNames(){
return sHookedMethodHandlers.keySet();
}
public HookedMethodHandler getHookedMethodHandler(Method method) {
if (method != null) {
return sHookedMethodHandlers.get(method.getName());
} else {
return null;
}
}
protected Class getHookedClass() throws ClassNotFoundException {
return null;
}
protected HookedMethodHandler newBaseHandler() throws ClassNotFoundException {
return null;
}
protected void addAllMethodFromHookedClass(){
try {
Class clazz = getHookedClass();
if(clazz!=null){
Method[] methods = clazz.getDeclaredMethods();
if(methods!=null && methods.length>0){
for (Method method : methods) {
if(Modifier.isPublic(method.getModifiers()) && !sHookedMethodHandlers.containsKey(method.getName())){
sHookedMethodHandlers.put(method.getName(),newBaseHandler());
}
}
}
}
} catch (ClassNotFoundException e) {
Log.w(getClass().getSimpleName(),"init addAllMethodFromHookedClass error",e);
}
};
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/Hook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook;
import android.content.Context;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/3/2.
*/
public abstract class Hook {
private boolean mEnable = false;
protected Context mHostContext;
protected BaseHookHandle mHookHandles;
public void setEnable(boolean enable, boolean reInstallHook) {
this.mEnable = enable;
}
public final void setEnable(boolean enable) {
setEnable(enable, false);
}
public boolean isEnable() {
return mEnable;
}
protected Hook(Context hostContext) {
mHostContext = hostContext;
mHookHandles = createHookHandle();
}
protected abstract BaseHookHandle createHookHandle();
protected abstract void onInstall(ClassLoader classLoader) throws Throwable;
protected void onUnInstall(ClassLoader classLoader) throws Throwable {
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/HookFactory.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook;
import android.app.Application;
import android.content.Context;
import android.os.Build;
import android.os.Build.VERSION;
import android.os.Build.VERSION_CODES;
import com.morgoo.droidplugin.hook.binder.IAppOpsServiceBinderHook;
import com.morgoo.droidplugin.hook.binder.IAudioServiceBinderHook;
import com.morgoo.droidplugin.hook.binder.IClipboardBinderHook;
import com.morgoo.droidplugin.hook.binder.IContentServiceBinderHook;
import com.morgoo.droidplugin.hook.binder.IDisplayManagerBinderHook;
import com.morgoo.droidplugin.hook.binder.IGraphicsStatsBinderHook;
import com.morgoo.droidplugin.hook.binder.IInputMethodManagerBinderHook;
import com.morgoo.droidplugin.hook.binder.ILocationManagerBinderHook;
import com.morgoo.droidplugin.hook.binder.IMediaRouterServiceBinderHook;
import com.morgoo.droidplugin.hook.binder.IMmsBinderHook;
import com.morgoo.droidplugin.hook.binder.IMountServiceBinderHook;
import com.morgoo.droidplugin.hook.binder.INotificationManagerBinderHook;
import com.morgoo.droidplugin.hook.binder.IPhoneSubInfoBinderHook;
import com.morgoo.droidplugin.hook.binder.ISearchManagerBinderHook;
import com.morgoo.droidplugin.hook.binder.ISessionManagerBinderHook;
import com.morgoo.droidplugin.hook.binder.ISmsBinderHook;
import com.morgoo.droidplugin.hook.binder.ISubBinderHook;
import com.morgoo.droidplugin.hook.binder.ITelephonyBinderHook;
import com.morgoo.droidplugin.hook.binder.ITelephonyRegistryBinderHook;
import com.morgoo.droidplugin.hook.binder.IWifiManagerBinderHook;
import com.morgoo.droidplugin.hook.binder.IWindowManagerBinderHook;
import com.morgoo.droidplugin.hook.proxy.IActivityManagerHook;
import com.morgoo.droidplugin.hook.proxy.IPackageManagerHook;
import com.morgoo.droidplugin.hook.proxy.InstrumentationHook;
import com.morgoo.droidplugin.hook.proxy.LibCoreHook;
import com.morgoo.droidplugin.hook.proxy.PluginCallbackHook;
import com.morgoo.droidplugin.hook.xhook.SQLiteDatabaseHook;
import com.morgoo.helper.Log;
import com.morgoo.helper.utils.ProcessUtils;
import java.util.ArrayList;
import java.util.List;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/3/2.
*/
public class HookFactory {
private static final String TAG = HookFactory.class.getSimpleName();
private static HookFactory sInstance = null;
private HookFactory() {
}
public static HookFactory getInstance() {
synchronized (HookFactory.class) {
if (sInstance == null) {
sInstance = new HookFactory();
}
}
return sInstance;
}
private List mHookList = new ArrayList(3);
public void setHookEnable(boolean enable) {
synchronized (mHookList) {
for (Hook hook : mHookList) {
hook.setEnable(enable);
}
}
}
public void setHookEnable(boolean enable, boolean reinstallHook) {
synchronized (mHookList) {
for (Hook hook : mHookList) {
hook.setEnable(enable, reinstallHook);
}
}
}
public void setHookEnable(Class hookClass, boolean enable) {
synchronized (mHookList) {
for (Hook hook : mHookList) {
if (hookClass.isInstance(hook)) {
hook.setEnable(enable);
}
}
}
}
public void installHook(Hook hook, ClassLoader cl) {
try {
hook.onInstall(cl);
synchronized (mHookList) {
mHookList.add(hook);
}
} catch (Throwable throwable) {
Log.e(TAG, "installHook %s error", throwable, hook);
}
}
public final void installHook(Context context, ClassLoader classLoader) throws Throwable {
if (ProcessUtils.isMainProcess(context)) {
installHook(new IActivityManagerHook(context), classLoader);
installHook(new IPackageManagerHook(context), classLoader);
} else {
installHook(new IClipboardBinderHook(context), classLoader);
//for ISearchManager
installHook(new ISearchManagerBinderHook(context), classLoader);
//for INotificationManager
installHook(new INotificationManagerBinderHook(context), classLoader);
installHook(new IMountServiceBinderHook(context), classLoader);
installHook(new IAudioServiceBinderHook(context), classLoader);
installHook(new IContentServiceBinderHook(context), classLoader);
installHook(new IWindowManagerBinderHook(context), classLoader);
if (VERSION.SDK_INT > VERSION_CODES.LOLLIPOP_MR1) {
installHook(new IGraphicsStatsBinderHook(context), classLoader);
}
// if (VERSION.SDK_INT >= VERSION_CODES.KITKAT) {
// installHook(new WebViewFactoryProviderHook(context), classLoader);
// }
if (VERSION.SDK_INT >= VERSION_CODES.KITKAT) {
installHook(new IMediaRouterServiceBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.LOLLIPOP) {
installHook(new ISessionManagerBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.JELLY_BEAN_MR2) {
installHook(new IWifiManagerBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.JELLY_BEAN_MR2) {
installHook(new IInputMethodManagerBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.ICE_CREAM_SANDWICH_MR1) {
installHook(new ILocationManagerBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.ICE_CREAM_SANDWICH_MR1) {
installHook(new ITelephonyRegistryBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.ICE_CREAM_SANDWICH_MR1) {
installHook(new ISubBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.ICE_CREAM_SANDWICH_MR1) {
installHook(new IPhoneSubInfoBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.ICE_CREAM_SANDWICH_MR1) {
installHook(new ITelephonyBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.ICE_CREAM_SANDWICH_MR1) {
installHook(new ISmsBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.ICE_CREAM_SANDWICH_MR1) {
installHook(new IMmsBinderHook(context), classLoader);
}
if (VERSION.SDK_INT >= VERSION_CODES.M) {
installHook(new IAppOpsServiceBinderHook(context), classLoader);
}
installHook(new IActivityManagerHook(context), classLoader);
installHook(new IPackageManagerHook(context), classLoader);
installHook(new PluginCallbackHook(context), classLoader);
installHook(new InstrumentationHook(context), classLoader);
installHook(new LibCoreHook(context), classLoader);
installHook(new SQLiteDatabaseHook(context), classLoader);
installHook(new IDisplayManagerBinderHook(context), classLoader);
}
}
public final void onCallApplicationOnCreate(Context context, Application app) {
installHook(new SQLiteDatabaseHook(context), app.getClassLoader());
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/HookedMethodHandler.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook;
import android.content.Context;
import com.morgoo.helper.Log;
import java.lang.reflect.Method;
public class HookedMethodHandler {
private static final String TAG = HookedMethodHandler.class.getSimpleName();
protected final Context mHostContext;
private Object mFakedResult = null;
private boolean mUseFakedResult = false;
public HookedMethodHandler(Context hostContext) {
this.mHostContext = hostContext;
}
public synchronized Object doHookInner(Object receiver, Method method, Object[] args) throws Throwable {
long b = System.currentTimeMillis();
try {
mUseFakedResult = false;
mFakedResult = null;
boolean suc = beforeInvoke(receiver, method, args);
Object invokeResult = null;
if (!suc) {
invokeResult = method.invoke(receiver, args);
}
afterInvoke(receiver, method, args, invokeResult);
if (mUseFakedResult) {
return mFakedResult;
} else {
return invokeResult;
}
} finally {
long time = System.currentTimeMillis() - b;
if (time > 5) {
Log.i(TAG, "doHookInner method(%s.%s) cost %s ms", method.getDeclaringClass().getName(), method.getName(), time);
}
}
}
public void setFakedResult(Object fakedResult) {
this.mFakedResult = fakedResult;
mUseFakedResult = true;
}
/**
* 在某个方法被调用之前执行，如果返回true，则不执行原始的方法，否则执行原始方法
*/
protected boolean beforeInvoke(Object receiver, Method method, Object[] args) throws Throwable {
return false;
}
protected void afterInvoke(Object receiver, Method method, Object[] args, Object invokeResult) throws Throwable {
}
public boolean isFakedResult() {
return mUseFakedResult;
}
public Object getFakedResult() {
return mFakedResult;
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/BinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.text.TextUtils;
import com.morgoo.droidplugin.hook.Hook;
import com.morgoo.droidplugin.hook.HookedMethodHandler;
import com.morgoo.droidplugin.reflect.Utils;
import com.morgoo.helper.MyProxy;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Arrays;
import java.util.List;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/3/2.
*/
abstract class BinderHook extends Hook implements InvocationHandler {
private Object mOldObj;
public BinderHook(Context hostContext) {
super(hostContext);
}
@Override
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
try {
if (!isEnable()) {
return method.invoke(mOldObj, args);
}
HookedMethodHandler hookedMethodHandler = mHookHandles.getHookedMethodHandler(method);
if (hookedMethodHandler != null) {
return hookedMethodHandler.doHookInner(mOldObj, method, args);
} else {
return method.invoke(mOldObj, args);
}
} catch (InvocationTargetException e) {
Throwable cause = e.getTargetException();
if (cause != null && MyProxy.isMethodDeclaredThrowable(method, cause)) {
throw cause;
} else if (cause != null) {
RuntimeException runtimeException = !TextUtils.isEmpty(cause.getMessage()) ? new RuntimeException(cause.getMessage()) : new RuntimeException();
runtimeException.initCause(cause);
throw runtimeException;
} else {
RuntimeException runtimeException = !TextUtils.isEmpty(e.getMessage()) ? new RuntimeException(e.getMessage()) : new RuntimeException();
runtimeException.initCause(e);
throw runtimeException;
}
} catch (IllegalArgumentException e) {
try {
StringBuilder sb = new StringBuilder();
sb.append(" DROIDPLUGIN{");
if (method != null) {
sb.append("method[").append(method.toString()).append("]");
} else {
sb.append("method[").append("NULL").append("]");
}
if (args != null) {
sb.append("args[").append(Arrays.toString(args)).append("]");
} else {
sb.append("args[").append("NULL").append("]");
}
sb.append("}");
String message = e.getMessage() + sb.toString();
throw new IllegalArgumentException(message, e);
} catch (Throwable e1) {
throw e;
}
} catch (Throwable e) {
if (MyProxy.isMethodDeclaredThrowable(method, e)) {
throw e;
} else {
RuntimeException runtimeException = !TextUtils.isEmpty(e.getMessage()) ? new RuntimeException(e.getMessage()) : new RuntimeException();
runtimeException.initCause(e);
throw runtimeException;
}
}
}
abstract Object getOldObj() throws Exception;
void setOldObj(Object mOldObj) {
this.mOldObj = mOldObj;
}
public abstract String getServiceName();
@Override
protected void onInstall(ClassLoader classLoader) throws Throwable {
new ServiceManagerCacheBinderHook(mHostContext, getServiceName()).onInstall(classLoader);
mOldObj = getOldObj();
Class clazz = mOldObj.getClass();
List> interfaces = Utils.getAllInterfaces(clazz);
Class[] ifs = interfaces != null && interfaces.size() > 0 ? interfaces.toArray(new Class[interfaces.size()]) : new Class[0];
Object proxiedObj = MyProxy.newProxyInstance(clazz.getClassLoader(), ifs, this);
MyServiceManager.addProxiedObj(getServiceName(), proxiedObj);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IAppOpsServiceBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IAppOpsServiceHookHandle;
import com.morgoo.helper.compat.IAppOpsServiceCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on on 16/5/11.
*/
public class IAppOpsServiceBinderHook extends BinderHook{
private static final String SERVICE_NAME = Context.APP_OPS_SERVICE;
public IAppOpsServiceBinderHook(Context hostContext) {
super(hostContext);
}
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return IAppOpsServiceCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IAppOpsServiceHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IAudioServiceBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IAudioServiceHookHandle;
import com.morgoo.helper.compat.IAudioServiceCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/3/6.
*/
public class IAudioServiceBinderHook extends BinderHook {
private final static String SERVICE_NAME = Context.AUDIO_SERVICE;
public IAudioServiceBinderHook(Context hostContext) {
super(hostContext);
}
@Override
public Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return IAudioServiceCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IAudioServiceHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IClipboardBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IClipboardHookHandle;
import com.morgoo.helper.compat.IClipboardCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/3/6.
*/
public class IClipboardBinderHook extends BinderHook {
private final static String CLIPBOARD_SERVICE = "clipboard";
public IClipboardBinderHook(Context hostContext) {
super(hostContext);
}
@Override
public Object getOldObj() throws Exception{
IBinder iBinder = MyServiceManager.getOriginService(CLIPBOARD_SERVICE);
return IClipboardCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return CLIPBOARD_SERVICE;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IClipboardHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IContentServiceBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IContentServiceHandle;
import com.morgoo.helper.compat.IContentServiceCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/5/21.
*/
public class IContentServiceBinderHook extends BinderHook {
private static final String CONTENT_SERVICE_NAME = "content";
public IContentServiceBinderHook(Context hostContext) {
super(hostContext);
}
@Override
public Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(CONTENT_SERVICE_NAME);
return IContentServiceCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return CONTENT_SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IContentServiceHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IDisplayManagerBinderHook.java
================================================
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IDisplayManagerHookHandle;
import com.morgoo.droidplugin.reflect.FieldUtils;
import com.morgoo.droidplugin.reflect.MethodUtils;
import com.morgoo.helper.compat.IDisplayManagerCompat;
/**
* IDisplayManagerBinderHook
*
* @author Liu Yichen
* @date 16/6/13
*/
public class IDisplayManagerBinderHook extends BinderHook {
private static final String TAG = IDisplayManagerBinderHook.class.getSimpleName();
private static final String SERVICE_NAME = Context.DISPLAY_SERVICE;
public IDisplayManagerBinderHook(Context hostContext) {
super(hostContext);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return IDisplayManagerCompat.asInterface(iBinder);
}
@Override
protected void onInstall(ClassLoader classLoader) throws Throwable {
super.onInstall(classLoader);
Class displayManagerGlobalClass = Class.forName("android.hardware.display.DisplayManagerGlobal");
Object displayManagerGlobal = MethodUtils.invokeStaticMethod(displayManagerGlobalClass, "getInstance");
FieldUtils.writeField(displayManagerGlobal, "mDm", MyServiceManager.getProxiedObj(SERVICE_NAME));
}
@Override
protected BaseHookHandle createHookHandle() {
return new IDisplayManagerHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IGraphicsStatsBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IClipboardHookHandle;
import com.morgoo.droidplugin.hook.handle.IGraphicsStatsHookHandle;
import com.morgoo.helper.compat.IClipboardCompat;
import com.morgoo.helper.compat.IGraphicsStatsCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/6/18.
*/
public class IGraphicsStatsBinderHook extends BinderHook {
private final static String SERVICE_NAME = "graphicsstats";
public IGraphicsStatsBinderHook(Context hostContext) {
super(hostContext);
}
@Override
public Object getOldObj() throws Exception{
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return IGraphicsStatsCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IGraphicsStatsHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IInputMethodManagerBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import android.view.inputmethod.InputMethodManager;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IAudioServiceHookHandle;
import com.morgoo.droidplugin.hook.handle.IInputMethodManagerHookHandle;
import com.morgoo.droidplugin.reflect.FieldUtils;
import com.morgoo.helper.compat.IAudioServiceCompat;
import com.morgoo.helper.compat.IInputMethodManagerCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/6/4.
*/
public class IInputMethodManagerBinderHook extends BinderHook {
private final static String SERVICE_NAME = Context.INPUT_METHOD_SERVICE;
public IInputMethodManagerBinderHook(Context hostContext) {
super(hostContext);
}
@Override
public Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return IInputMethodManagerCompat.asInterface(iBinder);
}
@Override
protected void onInstall(ClassLoader classLoader) throws Throwable {
super.onInstall(classLoader);
Object obj = FieldUtils.readStaticField(InputMethodManager.class, "sInstance");
if (obj != null) {
FieldUtils.writeStaticField(InputMethodManager.class, "sInstance", null);
}
mHostContext.getSystemService(Context.INPUT_METHOD_SERVICE);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IInputMethodManagerHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/ILocationManagerBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.ILocationManagerHookHandle;
import com.morgoo.helper.compat.ILocationManagerCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2016/2/25.
*/
public class ILocationManagerBinderHook extends BinderHook {
private final static String SERVICE_NAME = Context.LOCATION_SERVICE;
public ILocationManagerBinderHook(Context hostContext) {
super(hostContext);
}
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return ILocationManagerCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new ILocationManagerHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IMediaRouterServiceBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IMediaRouterServiceHookHandle;
import com.morgoo.helper.compat.IMediaRouterServiceCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/3/6.
*/
public class IMediaRouterServiceBinderHook extends BinderHook {
private final static String SERVICE_NAME =Context.MEDIA_ROUTER_SERVICE;
public IMediaRouterServiceBinderHook(Context hostContext) {
super(hostContext);
}
@Override
public Object getOldObj() throws Exception{
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return IMediaRouterServiceCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IMediaRouterServiceHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IMmsBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IMmsHookHandle;
import com.morgoo.helper.compat.IMmsCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2016/5/9.
*/
public class IMmsBinderHook extends BinderHook {
private static final String SERVICE_NAME = "imms";
public IMmsBinderHook(Context hostContext) {
super(hostContext);
}
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return IMmsCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IMmsHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IMountServiceBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IMountServiceHookHandle;
import com.morgoo.helper.compat.IMountServiceCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/3/6.
*/
public class IMountServiceBinderHook extends BinderHook {
private final static String SERVICE_NAME = "mount";
public IMountServiceBinderHook(Context hostContext) {
super(hostContext);
}
@Override
public Object getOldObj() throws Exception{
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return IMountServiceCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IMountServiceHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/INotificationManagerBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.INotificationManagerHookHandle;
import com.morgoo.helper.compat.INotificationManagerCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/3/2.
*/
public class INotificationManagerBinderHook extends BinderHook {
public static final String SERVICE_NAME = "notification";
public INotificationManagerBinderHook(Context hostContext) {
super(hostContext);
}
@Override
protected BaseHookHandle createHookHandle() {
return new INotificationManagerHookHandle(mHostContext);
}
public Object getOldObj() throws Exception{
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return INotificationManagerCompat.asInterface(iBinder);
}
public String getServiceName() {
return SERVICE_NAME;
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IPhoneSubInfoBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IPhoneSubInfoHookHandle;
import com.morgoo.helper.compat.IPhoneSubInfoCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2016/5/6.
*/
public class IPhoneSubInfoBinderHook extends BinderHook {
private static final String SERVICE_NAME = "iphonesubinfo";
public IPhoneSubInfoBinderHook(Context hostContext) {
super(hostContext);
}
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return IPhoneSubInfoCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new IPhoneSubInfoHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/ISearchManagerBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.IClipboardHookHandle;
import com.morgoo.droidplugin.hook.handle.ISearchManagerHookHandle;
import com.morgoo.helper.compat.ISearchManagerCompat;
/**
* Created by wyw on 15-9-18.
*/
public class ISearchManagerBinderHook extends BinderHook {
private final static String SEARCH_MANAGER_SERVICE = "search";
public ISearchManagerBinderHook(Context hostContext) {
super(hostContext);
}
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SEARCH_MANAGER_SERVICE);
return ISearchManagerCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SEARCH_MANAGER_SERVICE;
}
@Override
protected BaseHookHandle createHookHandle() {
return new ISearchManagerHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/ISessionManagerBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.ISessionManagerHookHandle;
import com.morgoo.helper.compat.ISessionManagerCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2015/3/9.
*/
public class ISessionManagerBinderHook extends BinderHook {
private final static String SERVICE_NAME = Context.MEDIA_SESSION_SERVICE;
public ISessionManagerBinderHook(Context hostContext) {
super(hostContext);
}
@Override
public Object getOldObj() throws Exception{
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return ISessionManagerCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new ISessionManagerHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/ISmsBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.ISmsHookHandle;
import com.morgoo.helper.compat.ISmsCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2016/5/9.
*/
public class ISmsBinderHook extends BinderHook {
private static final String SERVICE_NAME = "isms";
public ISmsBinderHook(Context hostContext) {
super(hostContext);
}
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return ISmsCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new ISmsHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/ISubBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.ISubBinderHookHandle;
import com.morgoo.helper.compat.ISubCompat;
import com.morgoo.helper.compat.ITelephonyRegistryCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2016/5/6.
*/
public class ISubBinderHook extends BinderHook {
private final static String SERVICE_NAME = "isub";
public ISubBinderHook(Context hostContext) {
super(hostContext);
}
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return ISubCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new ISubBinderHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/ITelephonyBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.ITelephonyHookHandle;
import com.morgoo.helper.compat.ITelephonyCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2016/5/6.
*/
public class ITelephonyBinderHook extends BinderHook {
public ITelephonyBinderHook(Context hostContext) {
super(hostContext);
}
private final static String SERVICE_NAME = Context.TELEPHONY_SERVICE;
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return ITelephonyCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new ITelephonyHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/ITelephonyRegistryBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
**
** This file is part of DroidPlugin.
**
** DroidPlugin is free software: you can redistribute it and/or
** modify it under the terms of the GNU Lesser General Public
** License as published by the Free Software Foundation, either
** version 3 of the License, or (at your option) any later version.
**
** DroidPlugin is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
** Lesser General Public License for more details.
**
** You should have received a copy of the GNU Lesser General Public
** License along with DroidPlugin. If not, see
**
**/
package com.morgoo.droidplugin.hook.binder;
import android.content.Context;
import android.os.IBinder;
import com.morgoo.droidplugin.hook.BaseHookHandle;
import com.morgoo.droidplugin.hook.handle.ITelephonyRegistryHookHandle;
import com.morgoo.helper.compat.ITelephonyRegistryCompat;
/**
* Created by Andy Zhang(zhangyong232@gmail.com) on 2016/5/6.
*/
public class ITelephonyRegistryBinderHook extends BinderHook {
private final static String SERVICE_NAME = "telephony.registry";
public ITelephonyRegistryBinderHook(Context hostContext) {
super(hostContext);
}
@Override
Object getOldObj() throws Exception {
IBinder iBinder = MyServiceManager.getOriginService(SERVICE_NAME);
return ITelephonyRegistryCompat.asInterface(iBinder);
}
@Override
public String getServiceName() {
return SERVICE_NAME;
}
@Override
protected BaseHookHandle createHookHandle() {
return new ITelephonyRegistryHookHandle(mHostContext);
}
}
================================================
FILE: project/Libraries/DroidPlugin/src/main/java/com/morgoo/droidplugin/hook/binder/IWifiManagerBinderHook.java
================================================
/*
** DroidPlugin Project
**
** Copyright(c) 2015 Andy Zhang
App进程内部的ApplicationThread server端内部有自己的Binder线程池，它与App主线程的通信通过Handler完成，这个Handler存在于ActivityThread类，它的名字很简单就叫`H`，这一点我们接下来就会讲到。
现在我们明白了这个ApplicationThread到底是个什么东西，接上文继续跟踪Activity的启动过程；我们查看ApplicationThread的`scheduleLaunchActivity`方法，这个方法很简单，就是包装了参数最终使用Handler发了一个消息。
正如刚刚所说，ApplicationThread所在的Binder服务端使用Handler与主线程进行通信，这里的scheduleLaunchActivity方法直接把启动Activity的任务通过一个消息转发给了主线程；我们查看Handler类对于这个消息的处理：
```
Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
ActivityClientRecord r = (ActivityClientRecord)msg.obj;
r.packageInfo = getPackageInfoNoCheck(
r.activityInfo.applicationInfo, r.compatInfo);
handleLaunchActivity(r, null);
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
```
可以看到，这里直接调用了ActivityThread的handleLaunchActivity方法，在这个方法内部有一句非常重要：
```
Activity a = performLaunchActivity(r, customIntent);
```
绕了这么多弯，我们的Activity终于被创建出来了！继续跟踪这个performLaunchActivity方法看看发生了什么；由于这个方法较长，我就不贴代码了，读者可以自行查阅；要指出的是，这个方法做了两件很重要的事情：
1. 使用ClassLoader加载并通过反射创建Activity对象
```
java.lang.ClassLoader cl = r.packageInfo.getClassLoader();
activity = mInstrumentation.newActivity(
cl, component.getClassName(), r.intent);
StrictMode.incrementExpectedActivityCount(activity.getClass());
r.intent.setExtrasClassLoader(cl);
```
2. 如果Application还没有创建，那么创建Application对象并回调相应的生命周期方法；
```java
Application app = r.packageInfo.makeApplication(false, mInstrumentation);
// ... 省略
if (r.isPersistable()) {
mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
} else {
mInstrumentation.callActivityOnCreate(activity, r.state);
}
```
Activity的启动过程到这里就结束了，可能读者还是觉得迷惑：不就是调用了一系列方法吗？具体做了什么还是不太清楚，而且为什么Android要这么设计？
方法调用链再长也木有关系，有两点需要明白：
1. 平时我们所说的Application被创建了，onCreate方法被调用了，我们或许并没有意识到我们所说的`Application, Activity`除了代表Android应用层通常所代表的“组件”之外，它们其实都是普通的Java对象，也是需要被构造函数构造出来的对象的；在这个过程中，我们明白了这些对象到底是如何被创建的。
2. 为什么需要一直与AMS进行通信？哪些操作是在AMS中进行的？其实`AMS`正如名字所说，管理所有的“活动”，整个系统的Activity堆栈，Activity生命周期回调都是由AMS所在的系统进程system_server帮开发者完成的；Android的Framework层帮忙完成了诸如生命周期管理等繁琐复杂的过程，简化了应用层的开发。
## 瞒天过海——启动不在AndroidManifest.xml中声明的Activity
### 简要分析
通过上文的分析，我们已经对Activity的启动过程了如指掌了；就让我们干点坏事吧 :D
对与『必须在AndroidManifest.xml中显示声明使用的Activity』这个问题，上文给出了思路——瞒天过海；我们可以在AndroidManifest.xml里面声明一个替身Activity，然后**在合适的时候**把这个假的替换成我们真正需要启动的Activity就OK了。
那么问题来了，『合适的时候』到底是什么时候？在前文[Hook机制之动态代理][3]中我们提到过Hook过程最重要的一步是**寻找Hook点**；如果是在同一个进程，`startActivity`到Activity真正启动起来这么长的调用链，我们随便找个地方Hook掉就完事儿了；但是问题木有这么简单。
Activity启动过程中很多重要的操作（正如上文分析的『必须在AndroidManifest.xml中显式声明要启动的Activity』)都不是在App进程里面执行的，而是在AMS所在的系统进程system_server完成，由于**进程隔离**的存在，我们对别的进程无能为力；所以这个Hook点就需要花点心思了。
这时候Activity启动过程的知识就派上用场了；虽然整个启动过程非常复杂，但其实一张图就能总结：
先从App进程调用`startActivity`；然后通过IPC调用进入系统进程system_server，完成Activity管理以及一些校检工作，最后又回到了APP进程完成真正的Activioty对象创建。
由于这个检验过程是在AMS进程完成的，我们对system_server进程里面的操作无能为力，只有在我们APP进程里面执行的过程才是有可能被Hook掉的，也就是第一步和第三步；具体应该怎么办呢？
既然需要一个显式声明的Activity，那就声明一个！**可以在第一步假装启动一个已经在AndroidManifest.xml里面声明过的替身Activity，让这个Activity进入AMS进程接受检验；最后在第三步的时候换成我们真正需要启动的Activity**；这样就成功欺骗了AMS进程，瞒天过海！
说到这里，是不是有点小激动呢？我们写个demo验证一下：『启动一个并没有在AndroidManifest.xml中显示声明的Activity』
### 实战过程
具体来说，我们打算实现如下功能：在MainActivity中启动一个并没有在AndroidManifest.xml中声明的TargetActivity；按照上文分析，我们需要声明一个替身Activity，我们叫它StubActivity；
那么，我们的AndroidManifest.xml如下：
```xml
看到这里我就问你怕不怕！！！这也是我们之前提到的**私有或者隐藏的API可以使用，但必须处理好兼容性问题**；如果Android 7.0发布，这里估计得添加一个新的类PackageParseApi24。
我这里使用API 23作为演示，**版本不同的可能无法运行**请自行查阅 DroidPlugin 不同版本如何处理。
OK回到正题，我们决定使用PackageParser类来提取ApplicationInfo信息。下图是API 23上，PackageParser的部分类结构图：
看起来有我们需要的方法 generateApplication；确实如此，依靠这个方法我们可以成功地拿到ApplicationInfo。
由于PackageParser是@hide的，因此我们需要通过反射进行调用。我们根据这个generateApplicationInfo方法的签名：
```java
public static ApplicationInfo generateApplicationInfo(Package p, int flags,
PackageUserState state)
```
可以写出调用generateApplicationInfo的反射代码：
```java
Class packageParserClass = Class.forName("android.content.pm.PackageParser");
// 首先拿到我们得终极目标: generateApplicationInfo方法
// API 23 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
// public static ApplicationInfo generateApplicationInfo(Package p, int flags,
// PackageUserState state) {
// 其他Android版本不保证也是如此.
Class packageParser$PackageClass = Class.forName("android.content.pm.PackageParser$Package");
Class packageUserStateClass = Class.forName("android.content.pm.PackageUserState");
Method generateApplicationInfoMethod = packageParserClass.getDeclaredMethod("generateApplicationInfo",
packageParser$PackageClass,
int.class,
packageUserStateClass);
```
要成功调用这个方法，还需要三个参数；因此接下来我们需要一步一步构建调用此函数的参数信息。
#### 构建PackageParser.Package
generateApplicationInfo方法需要的第一个参数是PackageParser.Package；从名字上看这个类代表某个apk包的信息，我们看看文档怎么解释：
> Representation of a full package parsed from APK files on disk. A package consists of a single base APK, and zero or more split APKs.
果然，这个类代表从PackageParser中解析得到的某个apk包的信息，是磁盘上apk文件在内存中的数据结构表示；因此，要获取这个类，肯定需要解析整个apk文件。PackageParser中解析apk的核心方法是parsePackage，这个方法返回的就是一个Package类型的实例，因此我们调用这个方法即可；使用反射代码如下：
```java
// 首先, 我们得创建出一个Package对象出来供这个方法调用
// 而这个需要得对象可以通过 android.content.pm.PackageParser#parsePackage 这个方法返回得 Package对象得字段获取得到
// 创建出一个PackageParser对象供使用
Object packageParser = packageParserClass.newInstance();
// 调用 PackageParser.parsePackage 解析apk的信息
Method parsePackageMethod = packageParserClass.getDeclaredMethod("parsePackage", File.class, int.class);
// 实际上是一个 android.content.pm.PackageParser.Package 对象
Object packageObj = parsePackageMethod.invoke(packageParser, apkFile, 0);
```
这样，我们就得到了generateApplicationInfo的第一个参数；第二个参数是解析包使用的flag，我们直接选择解析全部信息，也就是0；
#### 构建PackageUserState
第三个参数是PackageUserState，代表不同用户中包的信息。由于Android是一个多任务多用户系统，因此不同的用户同一个包可能有不同的状态；这里我们只需要获取包的信息，因此直接使用默认的即可；
至此，generateApplicaionInfo的参数我们已经全部构造完成，直接调用此方法即可得到我们需要的applicationInfo对象；在返回之前我们需要做一点小小的修改：使用系统系统的这个方法解析得到的ApplicationInfo对象中并没有apk文件本身的信息，所以我们把解析的apk文件的路径设置一下（ClassLoader依赖dex文件以及apk的路径）：
```java
// 第三个参数 mDefaultPackageUserState 我们直接使用默认构造函数构造一个出来即可
Object defaultPackageUserState = packageUserStateClass.newInstance();
// 万事具备!!!!!!!!!!!!!!
ApplicationInfo applicationInfo = (ApplicationInfo) generateApplicationInfoMethod.invoke(packageParser,
packageObj, 0, defaultPackageUserState);
String apkPath = apkFile.getPath();
applicationInfo.sourceDir = apkPath;
applicationInfo.publicSourceDir = apkPath;
```
### 替换ClassLoader
#### 获取LoadedApk信息
方才为了获取ApplicationInfo我们费了好大一番精力；回顾一下我们的初衷：
我们最终的目的是调用getPackageInfoNoCheck得到LoadedApk的信息，并替换其中的mClassLoader然后把把添加到ActivityThread的mPackages缓存中；从而达到我们使用自己的ClassLoader加载插件中的类的目的。
现在我们已经拿到了getPackageInfoNoCheck这个方法中至关重要的第一个参数applicationInfo；上文提到第二个参数CompatibilityInfo代表设备兼容性信息，直接使用默认的值即可；因此，两个参数都已经构造出来，我们可以调用getPackageInfoNoCheck获取LoadedApk：
```java
// android.content.res.CompatibilityInfo
Class compatibilityInfoClass = Class.forName("android.content.res.CompatibilityInfo");
Method getPackageInfoNoCheckMethod = activityThreadClass.getDeclaredMethod("getPackageInfoNoCheck", ApplicationInfo.class, compatibilityInfoClass);
Field defaultCompatibilityInfoField = compatibilityInfoClass.getDeclaredField("DEFAULT_COMPATIBILITY_INFO");
defaultCompatibilityInfoField.setAccessible(true);
Object defaultCompatibilityInfo = defaultCompatibilityInfoField.get(null);
ApplicationInfo applicationInfo = generateApplicationInfo(apkFile);
Object loadedApk = getPackageInfoNoCheckMethod.invoke(currentActivityThread, applicationInfo, defaultCompatibilityInfo);
```
我们成功地构造出了LoadedAPK, 接下来我们需要替换其中的ClassLoader，然后把它添加进ActivityThread的mPackages中：
```java
String odexPath = Utils.getPluginOptDexDir(applicationInfo.packageName).getPath();
String libDir = Utils.getPluginLibDir(applicationInfo.packageName).getPath();
ClassLoader classLoader = new CustomClassLoader(apkFile.getPath(), odexPath, libDir, ClassLoader.getSystemClassLoader());
Field mClassLoaderField = loadedApk.getClass().getDeclaredField("mClassLoader");
mClassLoaderField.setAccessible(true);
mClassLoaderField.set(loadedApk, classLoader);
// 由于是弱引用, 因此我们必须在某个地方存一份, 不然容易被GC; 那么就前功尽弃了.
sLoadedApk.put(applicationInfo.packageName, loadedApk);
WeakReference weakReference = new WeakReference(loadedApk);
mPackages.put(applicationInfo.packageName, weakReference);
```
我们的这个CustomClassLoader非常简单，直接继承了DexClassLoader，什么都没有做；当然这里可以直接使用DexClassLoader，这里重新创建一个类是为了更有区分度；以后也可以通过修改这个类实现对于类加载的控制：
```java
public class CustomClassLoader extends DexClassLoader {
public CustomClassLoader(String dexPath, String optimizedDirectory, String libraryPath, ClassLoader parent) {
super(dexPath, optimizedDirectory, libraryPath, parent);
}
}
```
到这里，我们已经成功地把把插件的信息放入ActivityThread中，这样我们插件中的类能够成功地被加载；因此插件中的Activity实例能被成功第创建；由于整个流程较为复杂，我们简单梳理一下：
1. 在ActivityThread接收到IApplication的 scheduleLaunchActivity远程调用之后，将消息转发给`H`
2. `H`类在handleMessage的时候，调用了getPackageInfoNoCheck方法来获取待启动的组件信息。在这个方法中会优先查找`mPackages`中的缓存信息，而我们已经手动把插件信息添加进去；因此能够成功命中缓存，获取到独立存在的插件信息。
3. `H`类然后调用handleLaunchActivity最终转发到performLaunchActivity方法；这个方法使用从getPackageInfoNoCheck中拿到LoadedApk中的mClassLoader来加载Activity类，进而使用反射创建Activity实例；接着创建Application，Context等完成Activity组件的启动。
看起来好像已经天衣无缝万事大吉了；但是运行一下会出现一个异常，如下：
```java
04-05 02:49:53.742 11759-11759/com.weishu.upf.hook_classloader E/AndroidRuntime﹕ FATAL EXCEPTION: main
Process: com.weishu.upf.hook_classloader, PID: 11759
java.lang.RuntimeException: Unable to start activity ComponentInfo{com.weishu.upf.ams_pms_hook.app/com.weishu.upf.ams_pms_hook.app.MainActivity}: java.lang.RuntimeException: Unable to instantiate application android.app.Application: java.lang.IllegalStateException: Unable to get package info for com.weishu.upf.ams_pms_hook.app; is package not installed?
```
错误提示说是无法实例化 `Application`，而Application的创建也是在performLaunchActivity中进行的，这里有些蹊跷，我们仔细查看一下。
#### 绕过系统检查
通过ActivityThread的performLaunchActivity方法可以得知，Application通过LoadedApk的makeApplication方法创建，我们查看这个方法，在源码中发现了上文异常抛出的位置：
```java
try {
java.lang.ClassLoader cl = getClassLoader();
if (!mPackageName.equals("android")) {
initializeJavaContextClassLoader();
}
ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);
app = mActivityThread.mInstrumentation.newApplication(
cl, appClass, appContext);
appContext.setOuterContext(app);
} catch (Exception e) {
if (!mActivityThread.mInstrumentation.onException(app, e)) {
throw new RuntimeException(
"Unable to instantiate application " + appClass
+ ": " + e.toString(), e);
}
}
```
木有办法，我们只有一行一行地查看到底是哪里抛出这个异常的了；所幸代码不多。（所以说，缩小异常范围是一件多么重要的事情！！！）
第一句 getClassLoader() 没什么可疑的，虽然方法很长，但是它木有抛出任何异常（当然，它调用的代码可能抛出异常，万一找不到只能进一步深搜了；所以我觉得这里应该使用受检异常）。
然后我们看第二句，如果包名不是`android`开头，那么调用了一个叫做initializeJavaContextClassLoader的方法；我们查阅这个方法：
```java
private void initializeJavaContextClassLoader() {
IPackageManager pm = ActivityThread.getPackageManager();
android.content.pm.PackageInfo pi;
try {
pi = pm.getPackageInfo(mPackageName, 0, UserHandle.myUserId());
} catch (RemoteException e) {
throw new IllegalStateException("Unable to get package info for "
+ mPackageName + "; is system dying?", e);
}
if (pi == null) {
throw new IllegalStateException("Unable to get package info for "
+ mPackageName + "; is package not installed?");
}
boolean sharedUserIdSet = (pi.sharedUserId != null);
boolean processNameNotDefault =
(pi.applicationInfo != null &&
!mPackageName.equals(pi.applicationInfo.processName));
boolean sharable = (sharedUserIdSet || processNameNotDefault);
ClassLoader contextClassLoader =
(sharable)
? new WarningContextClassLoader()
: mClassLoader;
Thread.currentThread().setContextClassLoader(contextClassLoader);
}
```
这里，我们找出了这个异常的来源：原来这里调用了`getPackageInfo`方法获取包的信息；而我们的插件**并没有安装在系统上**，因此系统肯定认为插件没有安装，这个方法肯定返回null。所以，我们还要欺骗一下PMS，让系统觉得**插件已经安装在系统上了**；至于如何欺骗 PMS，[Hook机制之AMS&PMS][4] 有详细解释，这里直接给出代码，不赘述了：
```java
private static void hookPackageManager() throws Exception {
// 这一步是因为 initializeJavaContextClassLoader 这个方法内部无意中检查了这个包是否在系统安装
// 如果没有安装, 直接抛出异常, 这里需要临时Hook掉 PMS, 绕过这个检查.
Class activityThreadClass = Class.forName("android.app.ActivityThread");
Method currentActivityThreadMethod = activityThreadClass.getDeclaredMethod("currentActivityThread");
currentActivityThreadMethod.setAccessible(true);
Object currentActivityThread = currentActivityThreadMethod.invoke(null);
// 获取ActivityThread里面原始的 sPackageManager
Field sPackageManagerField = activityThreadClass.getDeclaredField("sPackageManager");
sPackageManagerField.setAccessible(true);
Object sPackageManager = sPackageManagerField.get(currentActivityThread);
// 准备好代理对象, 用来替换原始的对象
Class iPackageManagerInterface = Class.forName("android.content.pm.IPackageManager");
Object proxy = Proxy.newProxyInstance(iPackageManagerInterface.getClassLoader(),
new Class[] { iPackageManagerInterface },
new IPackageManagerHookHandler(sPackageManager));
// 1. 替换掉ActivityThread里面的 sPackageManager 字段
sPackageManagerField.set(currentActivityThread, proxy);
}
```
OK到这里，我们已经能够成功地加载**简单的**独立的存在于外部文件系统中的apk了。至此 关于 DroidPlugin 对于Activity生命周期的管理已经完全讲解完毕了；这是一种极其复杂的Activity管理方案，我们仅仅写一个用来理解的demo就Hook了相当多的东西，在Framework层来回牵扯；这其中的来龙去脉要完全把握清楚还请读者亲自翻阅源码。另外，我在此 对DroidPlugin 作者献上我的膝盖～这其中的玄妙让人叹为观止！
上文给出的方案中，我们全盘接管了插件中类的加载过程，这是一种相对暴力的解决方案；能不能更温柔一点呢？通俗来说，我们可以选择改革，而不是革命——告诉系统ClassLoader一些必要信息，让它帮忙完成插件类的加载。
## 保守方案：委托系统，让系统帮忙加载
我们再次搬出ActivityThread中加载Activity类的代码：
```java
java.lang.ClassLoader cl = r.packageInfo.getClassLoader();
activity = mInstrumentation.newActivity(
cl, component.getClassName(), r.intent);
StrictMode.incrementExpectedActivityCount(activity.getClass());
r.intent.setExtrasClassLoader(cl);
```
我们知道 这个r.packageInfo中的`r`是通过getPackageInfoNoCheck获取到的；在『激进方案』中我们把插件apk手动添加进缓存，采用自己加载办法解决；如果我们不干预这个过程，导致无法命中mPackages中的缓存，会发生什么？
查阅 getPackageInfo方法如下：
```java
private LoadedApk getPackageInfo(ApplicationInfo aInfo, CompatibilityInfo compatInfo,
ClassLoader baseLoader, boolean securityViolation, boolean includeCode,
boolean registerPackage) {
final boolean differentUser = (UserHandle.myUserId() != UserHandle.getUserId(aInfo.uid));
synchronized (mResourcesManager) {
WeakReference
我们看到诸如`Activity`，`Service`等并没有直接继承`Context`，而是继承了`ContextWrapper`；继续查看`ContextWrapper`的实现：
```java
@Override
public void startActivity(Intent intent) {
mBase.startActivity(intent);
}
```
WTF!! 果然人如其名，只是一个wrapper而已；这个`mBase`是什么呢？这里我先直接告诉你，它的真正实现是`ContextImpl`类；至于为什么，有一条思路：*mBase是在ContextWrapper构造的时候传递进来的，那么在ContextWrapper构造的时候可以找到答案*
什么时候会构造ContextWrapper呢？它的子类`Application`，`Service`等被创建的时候。
可以在App的主线程`AcitivityThread`的`performLaunchActivit`方法里面找到答案；更详细的解析可以参考老罗的[ Android应用程序启动过程源代码分析][3]
好了，我们姑且当作已经知道Context.startActivity最终使用了ContextImpl里面的方法，代码如下：
```java
public void startActivity(Intent intent, Bundle options) {
warnIfCallingFromSystemProcess();
if ((intent.getFlags()&Intent.FLAG_ACTIVITY_NEW_TASK) == 0) {
throw new AndroidRuntimeException(
"Calling startActivity() from outside of an Activity "
+ " context requires the FLAG_ACTIVITY_NEW_TASK flag."
+ " Is this really what you want?");
}
mMainThread.getInstrumentation().execStartActivity(
getOuterContext(), mMainThread.getApplicationThread(), null,
(Activity)null, intent, -1, options);
}
```
代码相当简单；我们知道了两件事：
1. 其一，我们知道了在Service等非Activity的Context里面启动Activity为什么需要添加`FLAG_ACTIVITY_NEW_TASK`；
2. 其二，真正的`startActivity`使用了`Instrumentation`类的`execStartActivity`方法；继续跟踪：
```java
public ActivityResult execStartActivity(
Context who, IBinder contextThread, IBinder token, Activity target,
Intent intent, int requestCode, Bundle options) {
// ... 省略无关代码
try {
intent.migrateExtraStreamToClipData();
intent.prepareToLeaveProcess();
// ----------------look here!!!!!!!!!!!!!!!!!!!
int result = ActivityManagerNative.getDefault()
.startActivity(whoThread, who.getBasePackageName(), intent,
intent.resolveTypeIfNeeded(who.getContentResolver()),
token, target != null ? target.mEmbeddedID : null,
requestCode, 0, null, null, options);
checkStartActivityResult(result, intent);
} catch (RemoteException e) {
}
return null;
}
```
到这里我们发现真正调用的是`ActivityManagerNative`的`startActivity`方法；如果你不清楚`ActivityManager`，`ActivityManagerService`以及`ActivityManagerNative`之间的关系；建议先仔细阅读我之前关于Binder的文章 [Binder学习指南][4]。
### Activity.startActivity
Activity类的`startActivity`方法相比Context而言直观了很多；这个`startActivity`通过若干次调用辗转到达`startActivityForResult`这个方法，在这个方法内部有如下代码：
```java
Instrumentation.ActivityResult ar =
mInstrumentation.execStartActivity(
this, mMainThread.getApplicationThread(), mToken, this,
intent, requestCode, options);
```
可以看到，其实通过Activity和ContextImpl类启动Activity并无本质不同，他们都通过`Instrumentation`这个辅助类调用到了`ActivityManagerNative`的方法。
## Hook AMS
OK，我们到现在知道；其实`startActivity`最终通过`ActivityManagerNative`这个方法远程调用了`AMS`的`startActivity`方法。那么这个`ActivityManagerNative`是什么呢？
ActivityManagerNative实际上就是`ActivityManagerService`这个远程对象的Binder代理对象；每次需要与AMS打交道的时候，需要借助这个代理对象通过驱动进而完成IPC调用。
我们继续看`ActivityManagerNative`的`getDefault()`方法做了什么：
```java
static public IActivityManager getDefault() {
return gDefault.get();
}
```
`gDefault`这个静态变量的定义如下：
```java
private static final Singleton
可见，Hook确实成功了！这就是使用代理进行Hook的原理——偷梁换柱。整个Hook过程简要总结如下：
1. 寻找Hook点，原则是静态变量或者单例对象，尽量Hook pulic的对象和方法，非public不保证每个版本都一样，需要适配。
2. 选择合适的代理方式，如果是接口可以用动态代理；如果是类可以手动写代理也可以使用cglib。
3. 偷梁换柱——用代理对象替换原始对象
完整代码参照：[understand-plugin-framework][1]；里面留有一个作业：我们目前仅Hook了`Context`类的`startActivity`方法，但是`Activity`类却使用了自己的`mInstrumentation`；你可以尝试Hook掉Activity类的`startActivity`方法。
[1]: https://github.com/tiann/understand-plugin-framework
================================================
FILE: DOC/tianweishu/Service插件化.md
================================================
# Service插件化
在 [Activity生命周期管理][1] 以及 [广播的管理][2] 中我们详细探讨了Android系统中的Activity、BroadcastReceiver组件的工作原理以及它们的插件化方案，相信读者已经对Android Framework和插件化技术有了一定的了解；本文将探讨Android四大组件之一——Service组件的插件化方式。
与Activity, BroadcastReceiver相比，Service组件的不同点在哪里呢？我们能否用与之相同的方式实现Service的插件化？如果不行，它们的差别在哪里，应该如何实现Service的插件化？
我们接下来将围绕这几个问题展开，最终给出Service组件的插件化方式；阅读本文之前，可以先clone一份 [understand-plugin-framework][3]，参考此项目的 service-management 模块。另外，插件框架原理解析系列文章见[索引][4]。
## Service工作原理
连Service的工作原理都不了解，谈何插件化？知己知彼。
Service分为两种形式：以startService**启动**的服务和用bindService**绑定**的服务；由于这两个过程大体相似，这里以稍复杂的`bindService`为例分析Service组件的工作原理。
绑定Service的过程是通过`Context`类的`bindService`完成的，这个方法需要三个参数：第一个参数代表想要绑定的Service的Intent，第二个参数是一个ServiceConnetion，我们可以通过这个对象接收到Service绑定成功或者失败的回调；第三个参数则是绑定时候的一些FLAG；关于服务的基本概念，可以参阅 [官方文档][5]。（现在汉化了哦，E文不好童鞋的福音）
Context的具体实现在ContextImpl类，ContextImpl中的`bindService`方法直接调用了`bindServiceCommon`方法，此方法源码如下：
```java
private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags,
UserHandle user) {
IServiceConnection sd;
if (conn == null) {
throw new IllegalArgumentException("connection is null");
}
if (mPackageInfo != null) {
// important
sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(),
mMainThread.getHandler(), flags);
} else {
throw new RuntimeException("Not supported in system context");
}
validateServiceIntent(service);
try {
IBinder token = getActivityToken();
if (token == null && (flags&BIND_AUTO_CREATE) == 0 && mPackageInfo != null
&& mPackageInfo.getApplicationInfo().targetSdkVersion
< android.os.Build.VERSION_CODES.ICE_CREAM_SANDWICH) {
flags |= BIND_WAIVE_PRIORITY;
}
service.prepareToLeaveProcess();
int res = ActivityManagerNative.getDefault().bindService(
mMainThread.getApplicationThread(), getActivityToken(), service,
service.resolveTypeIfNeeded(getContentResolver()),
sd, flags, getOpPackageName(), user.getIdentifier());
if (res < 0) {
throw new SecurityException(
"Not allowed to bind to service " + service);
}
return res != 0;
} catch (RemoteException e) {
throw new RuntimeException("Failure from system", e);
}
}
```
大致观察就能发现这个方法最终通过ActivityManagerNative借助AMS进而完成Service的绑定过程，在跟踪AMS的`bindService`源码之前，我们关注一下这个方法开始处创建的`sd`变量。这个变量的类型是`IServiceConnection`，如果读者还有印象，我们在 [广播的管理][2] 一文中也遇到过类似的处理方式——IIntentReceiver；所以，这个IServiceConnection与IApplicationThread以及IIntentReceiver相同，都是ActivityThread给AMS提供的用来与之进行通信的Binder对象；这个接口的实现类为LoadedApk.ServiceDispatcher。
这个方法最终调用了ActivityManagerNative的bindService，而这个方法的真正实现在AMS里面，源码如下：
```java
public int bindService(IApplicationThread caller, IBinder token, Intent service,
String resolvedType, IServiceConnection connection, int flags, String callingPackage,
int userId) throws TransactionTooLargeException {
enforceNotIsolatedCaller("bindService");
// 略去参数校检
synchronized(this) {
return mServices.bindServiceLocked(caller, token, service,
resolvedType, connection, flags, callingPackage, userId);
}
}
```
bindService这个方法相当简单，只是做了一些参数校检之后直接调用了ActivityServices类的`bindServiceLocked`方法：
```java
int bindServiceLocked(IApplicationThread caller, IBinder token, Intent service,
String resolvedType, IServiceConnection connection, int flags,
String callingPackage, int userId) throws TransactionTooLargeException {
final ProcessRecord callerApp = mAm.getRecordForAppLocked(caller);
// 参数校检，略
ServiceLookupResult res =
retrieveServiceLocked(service, resolvedType, callingPackage,
Binder.getCallingPid(), Binder.getCallingUid(), userId, true, callerFg);
// 结果校检， 略
ServiceRecord s = res.record;
final long origId = Binder.clearCallingIdentity();
try {
// ... 不关心， 略
mAm.startAssociationLocked(callerApp.uid, callerApp.processName,
s.appInfo.uid, s.name, s.processName);
AppBindRecord b = s.retrieveAppBindingLocked(service, callerApp);
ConnectionRecord c = new ConnectionRecord(b, activity,
connection, flags, clientLabel, clientIntent);
IBinder binder = connection.asBinder();
ArrayList