专栏名称: 看雪学苑
致力于移动与安全研究的开发者社区,看雪学院(kanxue.com)官方微信公众帐号。
目录
相关文章推荐
云技术  ·  134万元,DeepSeek大模型大单:电信中标 ·  7 小时前  
云技术  ·  134万元,DeepSeek大模型大单:电信中标 ·  7 小时前  
FreeBuf  ·  老旧系统安全防护:现代化改造策略 ·  昨天  
计算机与网络安全  ·  2024-2025年度卫生信息技术产品及服务 ... ·  16 小时前  
51好读  ›  专栏  ›  看雪学苑

安卓逆向之插件化技术学习

看雪学苑  · 公众号  · 互联网安全  · 2025-05-09 17:59

主要观点总结

本文介绍了插件化开发在Android技术中的应用,提到了Flutter等技术的发展,以及插件化技术的适用场景。作者个人经历了从学习Android基础到源码的过程,并探索了插件化开发的相关知识。文章详细描述了startActivity方法的调用链、AMS与ActivityThread的交互,以及插件Dex的加载和资源加载的过程。同时,提到了So加载的问题,以及Service的加载与AMS的交互。最后,作者分享了个人对插件化开发的思考和学习经历,并给出了Vapp项目的地址。

关键观点总结

关键观点1: 插件化开发背景与意义

从Android技术的概念提出到Flutter等技术的发展,插件化技术一直是Android进步的重要方向。

关键观点2: 插件化技术适用场景

适用于大型应用模块化拆分、按需加载功能和第三方服务集成等场景。

关键观点3: 插件化开发探索

作者个人经历了从Android基础到源码的学习,并探索了插件化开发的相关知识。

关键观点4: startActivity方法调用链

描述了startActivity方法的调用链,以及AMS与ActivityThread的交互。

关键观点5: 插件Dex加载

介绍了插件Dex的加载过程,包括双亲委派模型、Dex文件解析和类加载流程。

关键观点6: 资源加载

讨论了资源加载的问题,如资源冲突等,并提供了解决思路。

关键观点7: So加载

提出了So加载的问题,并提供了解决方案,如预加载So文件。

关键观点8: Service加载

介绍了Service的加载与AMS的交互,并给出了相关代码示例。

关键观点9: 学习经历与项目分享

作者分享了个人对插件化开发的思考和学习经历,并给出了Vapp项目的地址。


正文

请到「今天看啥」查看全文



5428 } else {
5429 // Note we want to go through this method for compatibility with
5430 // existing applications that may have overridden it.
5431 mParent.startActivityFromChild(this , intent , requestCode);
5432 }
5433 }
5434 }


主要的代码就是这个玩意了 :mInstrumentation.execStartActivity


1710      public ActivityResult execStartActivity(
1711 Context who, IBinder contextThread, IBinder token, Activity target,
1712 Intent intent, int requestCode, Bundle options) {
1713 IApplicationThread whoThread = (IApplicationThread) contextThread;
1714 Uri referrer = target != null ? target.onProvideReferrer() : null;
1715 if (referrer != null) {
1716 intent.putExtra(Intent.EXTRA_REFERRER, referrer);
1717 }
1718 if (mActivityMonitors != null) {
1719 synchronized (mSync) {
1720 final int N = mActivityMonitors.size();
1721 for (int i=0; i i++) {
1722 final ActivityMonitor am = mActivityMonitors.get(i);
1723 ActivityResult result = null;
1724 if (am.ignoreMatchingSpecificIntents()) {
1725 result = am.onStartActivity(intent);
1726 }
1727 if (result != null) {
1728 am.mHits++;
1729 return result;
1730 } else if (am.match(who, null, intent)) {
1731 am.mHits++;
1732 if (am.isBlocking()) {
1733 return requestCode >= 0 ? am.getResult() : null;
1734 }
1735 break;
1736 }
1737 }
1738 }
1739 }
1740 try {
1741 intent.migrateExtraStreamToClipData(who);
1742 intent.prepareToLeaveProcess(who);
1743 int result = ActivityTaskManager.getService().startActivity(whoThread,
1744 who.getOpPackageName(), who.getAttributionTag(), intent,
1745 intent.resolveTypeIfNeeded(who.getContentResolver()), token,
1746 target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
1747 checkStartActivityResult(result, intent);
1748 } catch (RemoteException e) {
1749 throw new RuntimeException("Failure from system", e);
1750 }
1751 return null;
1752 }


这里就调用 ActivityTaskManager.getService().startActivity方法了,这里就开始 与 ams沟通, AMS 的内部就不记录了。


后面会调用 ActivityThread的 H 对象进行沟通。


@Override
public void scheduleTransaction(ClientTransaction transaction) {
mH.sendMessage(H.EXECUTE_TRANSACTION, transaction); // 发送消息到应用进程
}
    case EXECUTE_TRANSACTION:
2213 final ClientTransaction transaction = (ClientTransaction) msg.obj;
2214 mTransactionExecutor.execute(transaction);
2215 if (isSystem()) {
2216 // Client transactions inside system process are recycled on the client side
2217 // instead of ClientLifecycleManager to avoid being cleared before this
2218 // message is handled.
2219 transaction.recycle();
2220 }
2221 // TODO(lifecycler): Recycle locally scheduled transactions.


我查看了TransactionExecutor 的类


     /** Transition the client through previously initialized state sequence. */
205 private void performLifecycleSequence(ActivityClientRecord r, IntArray path,
206 ClientTransaction transaction
) {
207 final int size = path.size();
208 for (int i = 0, state; i < size; i++) {
209 state = path.get(i);
210 if (DEBUG_RESOLVER) {
211 Slog.d(TAG, tId(transaction) + "Transitioning activity: "
212 + getShortActivityName(r.token, mTransactionHandler)
213 + " to state: " + getStateName(state));
214 }
215 switch (state) {
216 case ON_CREATE:
217 mTransactionHandler.handleLaunchActivity(r, mPendingActions,
218 null /* customIntent */);
219 break;
220 case ON_START:
221 mTransactionHandler.handleStartActivity(r, mPendingActions,
222 null /* activityOptions */);
223 break;
224 case ON_RESUME:
225 mTransactionHandler.handleResumeActivity(r, false /* finalStateRequest */,
226 r.isForward, "LIFECYCLER_RESUME_ACTIVITY");
227 break;
228 case ON_PAUSE:
229 mTransactionHandler.handlePauseActivity(r, false /* finished */,
230 false /* userLeaving */, 0 /* configChanges */, mPendingActions,
231 "LIFECYCLER_PAUSE_ACTIVITY");
232 break;
233 case ON_STOP:
234 mTransactionHandler.handleStopActivity(r, 0 /* configChanges */,
235 mPendingActions, false /* finalStateRequest */,
236 "LIFECYCLER_STOP_ACTIVITY");
237 break;
238 case ON_DESTROY:
239 mTransactionHandler.handleDestroyActivity(r, false /* finishing */,
240 0 /* configChanges */, false /* getNonConfigInstance */,
241 "performLifecycleSequence. cycling to:" + path.get(size - 1));
242 break;
243 case ON_RESTART:
244 mTransactionHandler.performRestartActivity(r, false /* start */);
245 break;
246 default:
247 throw new IllegalArgumentException("Unexpected lifecycle state: " + state);
248 }
249 }
250 }


这里就进入


 mTransactionHandler.handleLaunchActivity(r, mPendingActions,
218 null /* customIntent */);
/**
3758 * Extended implementation of activity launch. Used when server requests a launch or relaunch.
3759 */
3760 @Override
3761 public Activity handleLaunchActivity(ActivityClientRecord r,
3762 PendingTransactionActions pendingActions, Intent customIntent) {
3763 // If we are getting ready to gc after going to the background, well
3764 // we are back active so skip it.
3765 unscheduleGcIdler();
3766 mSomeActivitiesChanged = true;
3767
3768 if (r.profilerInfo != null) {
3769 mProfiler.setProfiler(r.profilerInfo);
3770 mProfiler.startProfiling();
3771 }
3772
3773 if (r.mPendingFixedRotationAdjustments != null) {
3774 // The rotation adjustments must be applied before handling configuration, so process
3775 // level display metrics can be adjusted.
3776 overrideApplicationDisplayAdjustments(r.token, adjustments ->
3777 adjustments.setFixedRotationAdjustments(r.mPendingFixedRotationAdjustments));
3778 }
3779
3780 // Make sure we are running with the most recent config.
3781 mConfigurationController.handleConfigurationChanged(null, null);
3782
3783 if (localLOGV) Slog.v(
3784 TAG, "Handling launch of " + r);
3785
3786 // Initialize before creating the activity
3787 if (ThreadedRenderer.sRendererEnabled
3788 && (r.activityInfo.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0) {
3789 HardwareRenderer.preload();
3790 }
3791 WindowManagerGlobal.initialize();
3792
3793 // Hint the GraphicsEnvironment that an activity is launching on the process.
3794 GraphicsEnvironment.hintActivityLaunch();
3795






请到「今天看啥」查看全文