热修复实现(一)

/**
 * A class loader that loads classes from {@code .jar} and {@code .apk} files
 * containing a {@code classes.dex} entry. This can be used to execute code not
 * installed as part of an application.
 *
 * <p>This class loader requires an application-private, writable directory to
 * cache optimized classes. Use {@code Context.getDir(String, int)} to create
 * such a directory: <pre>   {@code
 *   File dexOutputDir = context.getDir("dex", 0);
 * }</pre>
 *
 * <p><strong>Do not cache optimized classes on external storage.</strong>
 * External storage does not provide access controls necessary to protect your
 * application from code injection attacks.
 */
public class DexClassLoader extends BaseDexClassLoader {
    /**
     * Creates a {@code DexClassLoader} that finds interpreted and native
     * code.  Interpreted classes are found in a set of DEX files contained
     * in Jar or APK files.
     *
     * <p>The path lists are separated using the character specified by the
     * {@code path.separator} system property, which defaults to {@code :}.
     *
     * @param dexPath the list of jar/apk files containing classes and
     *     resources, delimited by {@code File.pathSeparator}, which
     *     defaults to {@code ":"} on Android
     * @param optimizedDirectory directory where optimized dex files
     *     should be written; must not be {@code null}
     * @param libraryPath the list of directories containing native
     *     libraries, delimited by {@code File.pathSeparator}; may be
     *     {@code null}
     * @param parent the parent class loader
     */
    public DexClassLoader(String dexPath, String optimizedDirectory,
            String libraryPath, ClassLoader parent) {
        super(dexPath, new File(optimizedDirectory), libraryPath, parent);
    }
}

/**
     * Loads the class with the specified name. Invoking this method is
     * equivalent to calling {@code loadClass(className, false)}.
     * <p>
     * <strong>Note:</strong> In the Android reference implementation, the
     * second parameter of {@link #loadClass(String, boolean)} is ignored
     * anyway.
     * </p>
     *
     * @return the {@code Class} object.
     * @param className
     *            the name of the class to look for.
     * @throws ClassNotFoundException
     *             if the class can not be found.
     */
    public Class<?> loadClass(String className) throws ClassNotFoundException {
        return loadClass(className, false);
    }

    /**
     * Loads the class with the specified name, optionally linking it after
     * loading. The following steps are performed:
     * <ol>
     * <li> Call {@link #findLoadedClass(String)} to determine if the requested
     * class has already been loaded.</li>
     * <li>If the class has not yet been loaded: Invoke this method on the
     * parent class loader.</li>
     * <li>If the class has still not been loaded: Call
     * {@link #findClass(String)} to find the class.</li>
     * </ol>
     * <p>
     * <strong>Note:</strong> In the Android reference implementation, the
     * {@code resolve} parameter is ignored; classes are never linked.
     * </p>
     *
     * @return the {@code Class} object.
     * @param className
     *            the name of the class to look for.
     * @param resolve
     *            Indicates if the class should be resolved after loading. This
     *            parameter is ignored on the Android reference implementation;
     *            classes are not resolved.
     * @throws ClassNotFoundException
     *             if the class can not be found.
     */
    protected Class<?> loadClass(String className, boolean resolve) throws ClassNotFoundException {
        Class<?> clazz = findLoadedClass(className);

        if (clazz == null) {
            ClassNotFoundException suppressed = null;
            try {
            	// 先检查父ClassLoader是否已经家在过该类
                clazz = parent.loadClass(className, false);
            } catch (ClassNotFoundException e) {
                suppressed = e;
            }

            if (clazz == null) {
                try {
                	// 调用DexClassLoader.findClass()方法。
                    clazz = findClass(className);
                } catch (ClassNotFoundException e) {
                    e.addSuppressed(suppressed);
                    throw e;
                }
            }
        }

        return clazz;
    }

/**
 * Base class for common functionality between various dex-based
 * {@link ClassLoader} implementations.
 */
public class BaseDexClassLoader extends ClassLoader {
    /** originally specified path (just used for {@code toString()}) */
    private final String originalPath;
    /** structured lists of path elements */
    private final DexPathList pathList;
    /**
     * Constructs an instance.
     *
     * @param dexPath the list of jar/apk files containing classes and
     * resources, delimited by {@code File.pathSeparator}, which
     * defaults to {@code ":"} on Android
     * @param optimizedDirectory directory where optimized dex files
     * should be written; may be {@code null}
     * @param libraryPath the list of directories containing native
     * libraries, delimited by {@code File.pathSeparator}; may be
     * {@code null}
     * @param parent the parent class loader
     */
    public BaseDexClassLoader(String dexPath, File optimizedDirectory,
            String libraryPath, ClassLoader parent) {
        super(parent);
        this.originalPath = dexPath;
        this.pathList =
            new DexPathList(this, dexPath, libraryPath, optimizedDirectory);
    }
    @Override
    protected Class<?> findClass(String name) throws ClassNotFoundException {
        // 从DexPathList中找
        Class clazz = pathList.findClass(name);
        if (clazz == null) {
            throw new ClassNotFoundException(name);
        }
        return clazz;
    }
    @Override
    protected URL findResource(String name) {
        return pathList.findResource(name);
    }
    @Override
    protected Enumeration<URL> findResources(String name) {
        return pathList.findResources(name);
    }
    @Override
    public String findLibrary(String name) {
        return pathList.findLibrary(name);
    }

/**
 * A pair of lists of entries, associated with a {@code ClassLoader}.
 * One of the lists is a dex/resource path — typically referred
 * to as a "class path" — list, and the other names directories
 * containing native code libraries. Class path entries may be any of:
 * a {@code .jar} or {@code .zip} file containing an optional
 * top-level {@code classes.dex} file as well as arbitrary resources,
 * or a plain {@code .dex} file (with no possibility of associated
 * resources).
 *
 * <p>This class also contains methods to use these lists to look up
 * classes and resources.</p>
 */
/*package*/ final class DexPathList {
    private static final String DEX_SUFFIX = ".dex";
    private static final String JAR_SUFFIX = ".jar";
    private static final String ZIP_SUFFIX = ".zip";
    private static final String APK_SUFFIX = ".apk";
    /** class definition context */
    private final ClassLoader definingContext;
    /** list of dex/resource (class path) elements */ 
    // 把dex封装成一个数组，每个Element代表一个dex
    private final Element[] dexElements;
    /** list of native library directory elements */
    private final File[] nativeLibraryDirectories;

    // .....

    /**
     * Finds the named class in one of the dex files pointed at by
     * this instance. This will find the one in the earliest listed
     * path element. If the class is found but has not yet been
     * defined, then this method will define it in the defining
     * context that this instance was constructed with.
     *
     * @return the named class or {@code null} if the class is not
     * found in any of the dex files
     */
    public Class findClass(String name) {
        for (Element element : dexElements) {
            DexFile dex = element.dexFile;
            // 遍历数组，拿到第一个就返回
            if (dex != null) {
                Class clazz = dex.loadClassBinaryName(name, definingContext);
                if (clazz != null) {
                    return clazz;
                }
            }
        }
        return null;
    }
}

/**
* 添加apk包外的dex文件
* 自动执行install
* @param dexFile
*/
public static void addDexFileAutoInstall(Context context, List<File> dexFile,File optimizedDirectory) {
    if (dexFile != null && !dexFile.isEmpty() &&!dexFiles.contains(dexFile)) {
         dexFiles.addAll(dexFile);
         LogUtil.d(TAG, "add other dexfile");
         installDexFile(context,optimizedDirectory);
     }
}

/**
 * 添加apk包外的dex文件，
 * @param context
 */
publicstatic void installDexFile(Context context, File optimizedDirectory){
    if (checkValidZipFiles(dexFiles)) {
        try {
            installSecondaryDexes(context.getClassLoader(), optimizedDirectory, dexFiles);
        } catch (IllegalAccessExceptione){
           e.printStackTrace();
        } catch (NoSuchFieldExceptione) {
           e.printStackTrace();
        } catch (InvocationTargetExceptione){
           e.printStackTrace();
        } catch (NoSuchMethodExceptione) {
           e.printStackTrace();
        } catch (IOExceptione) {
           e.printStackTrace();
        }
    }
}

private static voidexpandFieldArray(Object instance, String fieldName, Object[]extraElements) throws NoSuchFieldException, IllegalArgumentException,
IllegalAccessException {
    Field jlrField = findField(instance, fieldName);
    Object[]original = (Object[]) jlrField.get(instance);
    Object[]combined = (Object[]) Array.newInstance(original.getClass().getComponentType(),original.length + extraElements.length);
    // 将后来的dex放在前面，主dex放在最后。
    System.arraycopy(extraElements, 0, combined, 0, extraElements.length);
    System.arraycopy(original, 0, combined, extraElements.length,original.length);
    // 原始的dex合并，是将主dex放在前面，其他的dex依次放在后面。
    //System.arraycopy(original, 0, combined, 0, original.length);
    //System.arraycopy(extraElements, 0, combined, original.length,extraElements.length);
    jlrField.set(instance, combined);
}

//指明要hook的lib ：
MSConfig(MSFilterLibrary,"/system/lib/libdvm.so")
 
// 在初始化的时候进行hook
MSInitialize {
    LOGD("Cydia Init");
    MSImageRef image;
    //载入lib
    image = MSGetImageByName("/system/lib/libdvm.so");
    if (image != NULL) {
        LOGD("image is not null");
        void *dexload=MSFindSymbol(image,"dvmResolveClass");
        if(dexload != NULL) {
            LOGD("dexloadis not null");
            MSHookFunction(dexload, (void*)proxyDvmResolveClass, (void**)&dvmResolveClass_Proxy);
        } else{
            LOGD("errorfind dvmResolveClass");
        }
    }
}
// 在初始化的时候进行hook//保留原来的地址
ClassObject* (*dvmResolveClass_Proxy)(ClassObject* referrer, u4 classIdx, boolfromUnverifiedConstant);
// 新方法地址
static ClassObject* proxyDvmResolveClass(ClassObject* referrer, u4 classIdx,bool fromUnverifiedConstant) {
        return dvmResolveClass_Proxy(referrer, classIdx,true);
}

if (ClassVerifier.PREVENT_VERIFY) {
    System.out.println(AntilazyLoad.class);
}

public class PluginClass {
    public PluginClass() {
        Log.d("JG","初始化PluginClass");
    }

    public int function(int a, int b){
        return a+b;  
    }  
}

<activity android:name=".MainActivity">
         <intent-filter>
             <action android:name="com.maplejaw.plugin"/>
         </intent-filter>
</activity>

/**
   * 这种方式用于从已安装的apk中读取，必须要有一个activity，且需要配置ACTION
   */
private void useDexClassLoader(){
      //创建一个意图，用来找到指定的apk
      Intent intent = new Intent("com.maplejaw.plugin");
      //获得包管理器
      PackageManager pm = getPackageManager();
      List<ResolveInfo> resolveinfoes =  pm.queryIntentActivities(intent, 0);
      if(resolveinfoes.size()==0){
          return;
      }
      //获得指定的activity的信息
      ActivityInfo actInfo = resolveinfoes.get(0).activityInfo;

      //获得包名
      String packageName = actInfo.packageName;
      //获得apk的目录或者jar的目录
      String apkPath = actInfo.applicationInfo.sourceDir;
      //dex解压后的目录,注意，这个用宿主程序的目录，android中只允许程序读取写自己
      //目录下的文件
      String dexOutputDir = getApplicationInfo().dataDir;

      //native代码的目录
      String libPath = actInfo.applicationInfo.nativeLibraryDir;

      //创建类加载器，把dex加载到虚拟机中
      DexClassLoader calssLoader = new DexClassLoader(apkPath, dexOutputDir, libPath,
              this.getClass().getClassLoader());

      //利用反射调用插件包内的类的方法

      try {
          Class<?> clazz = calssLoader.loadClass(packageName+".PluginClass");

          Object obj = clazz.newInstance();
          Class[] param = new Class[2];
          param[0] = Integer.TYPE;
          param[1] = Integer.TYPE;

          Method method = clazz.getMethod("function", param);

          Integer ret = (Integer)method.invoke(obj, 12,34);

          Log.d("JG", "返回的调用结果为:" + ret);

      } catch (Exception e) {
          e.printStackTrace();
      } 
  }

public void btnClick(View view){
    useDexClassLoader();
}

//apk路径
String path=Environment.getExternalStorageDirectory().getAbsolutePath()+"/1.apk";

private void useDexClassLoader(String path){
  
    File codeDir=getDir("dex", Context.MODE_PRIVATE);

    //创建类加载器，把dex加载到虚拟机中
    DexClassLoader calssLoader = new DexClassLoader(path, codeDir.getAbsolutePath(), null,
            this.getClass().getClassLoader());

    //利用反射调用插件包内的类的方法

    try {
        Class<?> clazz = calssLoader.loadClass("com.maplejaw.plugin.PluginClass");

        Object obj = clazz.newInstance();
        Class[] param = new Class[2];
        param[0] = Integer.TYPE;
        param[1] = Integer.TYPE;

        Method method = clazz.getMethod("function", param);

        Integer ret = (Integer)method.invoke(obj, 12,21);

        Log.d("JG", "返回的调用结果为: " + ret);

    } catch (Exception e) {
        e.printStackTrace();
    } 

/** Return an AssetManager instance for your application's package. */
    public abstract AssetManager getAssets();

    /** Return a Resources instance for your application's package. */
    public abstract Resources getResources();

protected void loadResources() {
    try {
        AssetManager assetManager = AssetManager.class.newInstance();
        Method addAssetPath = assetManager.getClass().getMethod("addAssetPath", String.class);
        addAssetPath.invoke(assetManager, mDexPath);
        mAssetManager = assetManager;
    } catch (Exception e) {
        e.printStackTrace();
    }
    Resources superRes = super.getResources();
    mResources = new Resources(mAssetManager, superRes.getDisplayMetrics(),
            superRes.getConfiguration());
    mTheme = mResources.newTheme();
    mTheme.setTo(super.getTheme());
}

@hide
    public final int addAssetPath(String path) {
    synchronized (this) {
        int res = addAssetPathNative(path);
        makeStringBlocks(mStringBlocks);
        return res;
    }
}

@Override
protected void onResume() {
    super.onResume();
    Method onResume = mActivityLifecircleMethods.get("onResume");
    if (onResume != null) {
        try {
            onResume.invoke(mRemoteActivity, new Object[] { });
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

@Override
protected void onPause() {
    Method onPause = mActivityLifecircleMethods.get("onPause");
    if (onPause != null) {
        try {
            onPause.invoke(mRemoteActivity, new Object[] { });
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
    super.onPause();
}

public interface DLPlugin {

    public void onStart();

    public void onRestart();

    public void onActivityResult(int requestCode, int resultCode, Intent

    data);

    public void onResume();

    public void onPause();

    public void onStop();

    public void onDestroy();

    public void onCreate(Bundle savedInstanceState);

    public void setProxy(Activity proxyActivity, String dexPath);

    public void onSaveInstanceState(Bundle outState);

    public void onNewIntent(Intent intent);

    public void onRestoreInstanceState(Bundle savedInstanceState);

    public boolean onTouchEvent(MotionEvent event);

    public boolean onKeyUp(int keyCode, KeyEvent event);

    public void onWindowAttributesChanged(LayoutParams params);

    public void onWindowFocusChanged(boolean hasFocus);

    public void onBackPressed();

…

}

@Override
protected void onStart() {
    mRemoteActivity.onStart();
    super.onStart();
}

@Override
protected void onRestart() {
    mRemoteActivity.onRestart();
    super.onRestart();
}

@Override
protected void onResume() {
    mRemoteActivity.onResume();
    super.onResume();
}