Android10 hook Activity技术分析

在插件化中，hook Activity作为最基本的技术，用来在宿主app中新增Activity，而通常情况下，Activity必须在Manifest中注册在才可以使用，下面将就Android10.0来分析hook Activity的详细过程。

要hook Activity之前，必须知道Activity的启动过程，才能够选择合适的点进行hook，在前面的文章中有分析Android10StartActivity启动过程分析，hook主要是两个点：一是在Activity给AMS之前替换代理的Activity，二是在handler中发送启动Activity时替换为插件的Activity。

分析完了Activity的hook点之后，还有一个重要的问题，如何加载插件的类和资源，只有加载了插件中的类和资源，后面的hook才有意义。

一、类加载

在Android中，将代码编译后会生成apk文件，apk文件里面有一个或多个classes.dex文件，它是所有class文件进行合并，优化后生成。在apk运行时ART虚拟机或Dalvik虚拟机会加载dex文件，加载都是通过ClassLoader实现。

ClassLoader是一个抽象类，实现分为系统类加载器和自定义类加载器。

系统类加载器有三种：

BootClassLoader：用于加载Android Framework中class文件。

PathClassLoader：用于Android应用程序类加载器，可以加载指定的dex，以及jar、zip、apk中的dex。

DexClassLoader：用于加载指定的dex，以及jar、zip、apk中的dex。

1.1 PathClassLoader

[->libcore\dalvik\src\main\java\dalvik\system\PathClassLoader.java]


public class PathClassLoader extends BaseDexClassLoader {
    /**
     * Creates a {@code PathClassLoader} that operates on a given list of files
     * and directories. This method is equivalent to calling
     * {@link #PathClassLoader(String, String, ClassLoader)} with a
     * {@code null} value for the second argument (see description there).
     *
     * @param dexPath the list of jar/apk files containing classes and
     * resources, delimited by {@code File.pathSeparator}, which
     * defaults to {@code ":"} on Android
     * @param parent the parent class loader
     */
    public PathClassLoader(String dexPath, ClassLoader parent) {
        super(dexPath, null, null, parent);
    }

    /**
     * Creates a {@code PathClassLoader} that operates on two given
     * lists of files and directories. The entries of the first list
     * should be one of the following:
     *
     * 
     * JAR/ZIP/APK files, possibly containing a "classes.dex" file as
     * well as arbitrary resources.
     * Raw ".dex" files (not inside a zip file).
     * 
     *
     * The entries of the second list should be directories containing
     * native library files.
     *
     * @param dexPath the list of jar/apk files containing classes and
     * resources, delimited by {@code File.pathSeparator}, which
     * defaults to {@code ":"} on Android
     * @param librarySearchPath the list of directories containing native
     * libraries, delimited by {@code File.pathSeparator}; may be
     * {@code null}
     * @param parent the parent class loader
     */
    public PathClassLoader(String dexPath, String librarySearchPath, ClassLoader parent) {
        super(dexPath, null, librarySearchPath, parent);
    }
}

BaseDexClassLoader

[->libcore\dalvik\src\main\java\dalvik\system\BaseDexClassLoader.java]


public class BaseDexClassLoader extends ClassLoader {

    /**
     * Hook for customizing how dex files loads are reported.
     *
     * This enables the framework to monitor the use of dex files. The
     * goal is to simplify the mechanism for optimizing foreign dex files and
     * enable further optimizations of secondary dex files.
     *
     * The reporting happens only when new instances of BaseDexClassLoader
     * are constructed and will be active only after this field is set with
     * {@link BaseDexClassLoader#setReporter}.
     */
    /* @NonNull */ private static volatile Reporter reporter = null;

    private final DexPathList pathList;
    .....
}

1.2 DexClassLoader

[->libcore\dalvik\src\main\java\dalvik\system\DexClassLoader.java]


public class DexClassLoader extends BaseDexClassLoader {
    /**
     * Creates a {@code DexClassLoader} that finds interpreted and native
     * code.  Interpreted classes are found in a set of DEX files contained
     * in Jar or APK files.
     *
     * The path lists are separated using the character specified by the
     * {@code path.separator} system property, which defaults to {@code :}.
     *
     * @param dexPath the list of jar/apk files containing classes and
     * resources, delimited by {@code File.pathSeparator}, which
     * defaults to {@code ":"} on Android
     * @param optimizedDirectory this parameter is deprecated and has no effect since API level 26.
     * @param librarySearchPath the list of directories containing native
     * libraries, delimited by {@code File.pathSeparator}; may be
     * {@code null}
     * @param parent the parent class loader
     */
    public DexClassLoader(String dexPath, String optimizedDirectory,
            String librarySearchPath, ClassLoader parent) {
        super(dexPath, null, librarySearchPath, parent);
    }
}

PathClassLoader和DexClassLoader两者都是继承于BaseDexClassLoader，并且类中只有构成方法，实现全部在BaseDexClassLoader中。从源码中可以看出DexClassLoader多个一个optimizedDirectory参数，但是实际上没什么用处，这两者最后调用的super方法一模一样。

classloader

1.3 加载原理

类加载器通过loadClass方法加载apk文件中的类。

1.3.1 ClassLoader.loadClass

[->libcore\ojluni\src\main\java\java\lang\ClassLoader.java]


protected Class<?> loadClass(String name, boolean resolve)
        throws ClassNotFoundException
    {
            // First, check if the class has already been loaded
            // 检查这个类是否已经被加载
            Class<?> c = findLoadedClass(name);
            if (c == null) {
                try {
                    if (parent != null) {
                        //如果parent不为空，则调用parent的loadClass进行加载
                        c = parent.loadClass(name, false);
                    } else {
                        //正常情况下不会走到这里
                        c = findBootstrapClassOrNull(name);
                    }
                } catch (ClassNotFoundException e) {
                    // ClassNotFoundException thrown if class not found
                    // from the non-null parent class loader
                }

                if (c == null) {
                    // If still not found, then invoke findClass in order
                    // to find the class.
                    //如果还是找不到，就调用findClass去查找
                    c = findClass(name);
                }
            }
            return c;
    }
    
    private Class<?> findBootstrapClassOrNull(String name){
        return null;
    }
    
     protected final Class<?> findLoadedClass(String name) {
        ClassLoader loader;
        if (this == BootClassLoader.getInstance())
            loader = null;
        else
            loader = this;
            //通过native方法实现查找
        return VMClassLoader.findLoadedClass(loader, name);
    }

上面类加载的过程就是双亲委派机制。先检查类是否已经被加载，如果已经加载，直接获取并返回。如果没有被加载，parent不为空，则调用parent的loadClass进行加载，依次递归，直到找到或者加载了就返回；如果还没有找到也加载不了，则自己去加载。

BootClassLoader是最后一个加载器，BootClassLoader重写了findClass和loadClass方法，并且在loadClass方法中不再获取parent，从而结束递归。

在所有parent都不能加载的情况下，DexClassLoader加载过程如下，它的父类继承了BaseDexClassLoader，并重写了findClass方法。

1.3.2 BaseDexClassLoader.findClass

[->libcore\dalvik\src\main\java\dalvik\system\BaseDexClassLoader.java]


@Override
protected Class<?> findClass(String name) throws ClassNotFoundException {
       List<Throwable> suppressedExceptions = new ArrayList<Throwable>();
        //在pathlist中查找指定的class
       Class c = pathList.findClass(name, suppressedExceptions);
       if (c == null) {
           ClassNotFoundException cnfe = new ClassNotFoundException(
                   "Didn't find class \"" + name + "\" on path: " + pathList);
           for (Throwable t : suppressedExceptions) {
               cnfe.addSuppressed(t);
           }
           throw cnfe;
       }
       return c;
   }
   
  private final DexPathList pathList;
     /**
    * @hide
    */
   public BaseDexClassLoader(String dexPath, File optimizedDirectory,
           String librarySearchPath, ClassLoader parent, boolean isTrusted) {
       super(parent);
       this.pathList = new DexPathList(this, dexPath, librarySearchPath, null, isTrusted);

       if (reporter != null) {
           reportClassLoaderChain();
       }
   }

1.3.3 DexPathList.findClass

[->\libcore\dalvik\src\main\java\dalvik\system\DexPathList.java]


/**
   * List of dex/resource (class path) elements.
   * Should be called pathElements, but the Facebook app uses reflection
   * to modify 'dexElements' (http://b/7726934).
   */
private Element[] dexElements;

public Class<?> findClass(String name, List<Throwable> suppressed) {
      for (Element element : dexElements) {
         //通过element获取class对象
          Class<?> clazz = element.findClass(name, definingContext, suppressed);
          if (clazz != null) {
              return clazz;
          }
      }

      if (dexElementsSuppressedExceptions != null) {
          suppressed.addAll(Arrays.asList(dexElementsSuppressedExceptions));
      }
      return null;
  }

dexElements初始化在构造函数中完成


DexPathList(ClassLoader definingContext, String dexPath,
           String librarySearchPath, File optimizedDirectory, boolean isTrusted) {
       ...
       this.dexElements = makeDexElements(splitDexPath(dexPath), optimizedDirectory,
                                          suppressedExceptions, definingContext, isTrusted);

        ...
   }

生成Element数组，每一个dex对应一个Element


private static Element[] makeDexElements(List<File> files, File optimizedDirectory,
           List<IOException> suppressedExceptions, ClassLoader loader, boolean isTrusted) {
     Element[] elements = new Element[files.size()];
     int elementsPos = 0;
     /*
      * Open all files and load the (direct or contained) dex files up front.
      */
     for (File file : files) {
         if (file.isDirectory()) {
             // We support directories for looking up resources. Looking up resources in
             // directories is useful for running libcore tests.
             elements[elementsPos++] = new Element(file);
         } else if (file.isFile()) {
             String name = file.getName();

             DexFile dex = null;
             if (name.endsWith(DEX_SUFFIX)) {
                 // Raw dex file (not inside a zip/jar).
                 try {
                     dex = loadDexFile(file, optimizedDirectory, loader, elements);
                     if (dex != null) {
                         elements[elementsPos++] = new Element(dex, null);
                     }
                 } catch (IOException suppressed) {
                     System.logE("Unable to load dex file: " + file, suppressed);
                     suppressedExceptions.add(suppressed);
                 }
             } else {
                 try {
                     dex = loadDexFile(file, optimizedDirectory, loader, elements);
                 } catch (IOException suppressed) {
                     /*
                      * IOException might get thrown "legitimately" by the DexFile constructor if
                      * the zip file turns out to be resource-only (that is, no classes.dex file
                      * in it).
                      * Let dex == null and hang on to the exception to add to the tea-leaves for
                      * when findClass returns null.
                      */
                     suppressedExceptions.add(suppressed);
                 }

                 if (dex == null) {
                     elements[elementsPos++] = new Element(file);
                 } else {
                     elements[elementsPos++] = new Element(dex, file);
                 }
             }
             if (dex != null && isTrusted) {
               dex.setTrusted();
             }
         } else {
             System.logW("ClassLoader referenced unknown path: " + file);
         }
     }
     if (elementsPos != elements.length) {
         elements = Arrays.copyOf(elements, elementsPos);
     }
     return elements;
   }

Class对象从Element中获取，每一个Element对应一个dex文件。通过上面的分析，可以想到插件apk的加载方法，通过DexClassLoader加载器加载插件apk，再通过反射的方法获取到宿主的dexElements，最后将插件dexElements和宿主的dexElements合并并赋值给dexElements，其详细流程如下：

1.创建插件的DexClassLoader类加载器，通过反射获取插件中的dexElements

2.获取宿主的PathClassLoader类加载器，通过反射获取宿主的dexElements

3.合并插件和宿主的dexElements，生成新的Element[]

4.最后通过反射将新的Element[]赋值给宿主的dexElements


//获取BaseDexClassLoader类的class
 Class<?> clazz = Class.forName("dalvik.system.BaseDexClassLoader");
 //获取BaseDexClassLoader类成员变量pathList
 Field pathListField = clazz.getDeclaredField("pathList");
 pathListField.setAccessible(true);

 //获取宿主PathClassLoader
 PathClassLoader pathClassLoader = (PathClassLoader) context.getClassLoader();
 //获取宿主pathlist值
 Object hostPathList = pathListField.get(pathClassLoader);

 //获取宿主的dexElements
 Class<?> hostPathListClass = hostPathList.getClass();
 Field hostDexElementsField = hostPathListClass.getDeclaredField("dexElements");
 hostDexElementsField.setAccessible(true);
 Object[] hostDexElements = (Object[]) hostDexElementsField.get(hostPathList);

 //获取插件pathlist值
 DexClassLoader dexClassLoader = new DexClassLoader(apkPath,context.getCacheDir().getAbsolutePath(),null,pathClassLoader);
 Object pluginPathList = pathListField.get(dexClassLoader);

 //获取插件的dexElements
 Class<?> pluginPathListClass = pluginPathList.getClass();
 Field pluginDexElementsField = pluginPathListClass.getDeclaredField("dexElements");
 pluginDexElementsField.setAccessible(true);
 Object[] pluginDexElements = (Object[]) pluginDexElementsField.get(pluginPathList);

 //创建新的Element数组
 Object[] newDexElements = (Object[]) Array.newInstance(hostDexElements.getClass().getComponentType(),hostDexElements.length+pluginDexElements.length);
 System.arraycopy(hostDexElements,0,newDexElements,0,hostDexElements.length);
 System.arraycopy(pluginDexElements,0,newDexElements,hostDexElements.length,pluginDexElements.length);

 //将新的Element[]赋值给dexElements
 hostDexElementsField.set(hostPathList,newDexElements);

这样就完成了插件apk中类的加载，热修复也用到了这样的类加载的原理，不同的是将插件的Elements放在了最前面。

二、资源加载

要加载插件中的资源，可以通过AssetManager来实现，因为资源的加载实际上是通过AssetManager来加载的。AssetManager可以通过文件名访问那些被编译过的应用程序的资源文件也可以访问没有被编译过的应用程序资源文件。

下面分析下AssetManager如何加载资源的，获取资源是通过getResources方法：

在ActivityThread中attach 方法里面的createAppContext创建Context时会设置Resources。

2.1 CL.createAppContext

[->base\core\java\android\app\ContextImpl.java]


static ContextImpl createAppContext(ActivityThread mainThread, LoadedApk packageInfo) {
      if (packageInfo == null) throw new IllegalArgumentException("packageInfo");
      ContextImpl context = new ContextImpl(null, mainThread, packageInfo, null, null, null, 0,
              null);
      context.setResources(packageInfo.getResources());
      return context;
  }