Android App-Hook and Plug-In Technology

453 Pages·2019·14.969 MB·English

by  Jianqiang Bao

Android App-Hook
and Plug-In Technology
Jianqiang Bao

Android App-Hook
Android App-Hook and
and Plug-In Technology Plug-In Technology
Android App-Hook and Plug-In Technology
Jianqiang Bao
Jianqiang Bao
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2020 by CRC Press, Taylor & Francis Group, 6000 Broken Sound Pkwy., NW, Suite 300, Boca Raton.,
FL 33487, under exclusive license granted by Beijing Huazhang Graphics & Information Co., Ltd./China
Machine Press for English language and throughout the world.
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed on acid-free paper
International Standard Book Number-13: 978-0-367-20700-7 (Hardback)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts
have been made to publish reliable data and information, but the author and publisher cannot assume
responsibility for the validity of all materials or the consequences of their use. The authors and publishers
have attempted to trace the copyright holders of all material reproduced in this publication and apologize
to copyright holders if permission to publish in this form has not been obtained. If any copyright material
has not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, trans-
mitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter
invented, including photocopying, microfilming, and recording, or in any information storage or retrieval
system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copyright.com
(http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood
Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and
registration for a variety of users. For organizations that have been granted a photocopy license by the
CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Acknowledgments, xvii
About the Author, xix
About the Translators, xxi
Introduction, xxiii
Chapter 1 ▪ Plug-Ins from the Past to the Future 1
1.1 ANDROID PLUG-INS IN CHINA 1
1.2 HISTORY OF ANDROID PLUG-IN TECHNIQUES 2
1.3 USAGE OF PLUG-INS 8
1.4 ANOTHER CHOICE: REACT NATIVE 9
1.5 DO ALL COMPONENTS REQUIRE PLUG-INS? 10
1.6 DOUBLE-OPENING AND VIRTUAL MACHINE 10
1.7 FROM NATIVE TO HTML5 11
1.8 SUMMARY 12
Chapter 2 ▪ The Underlying Knowledge of Android 13
2.1 OVERVIEW OF UNDERLYING ANDROID KNOWLEDGE 13
2.2 BINDER 15
2.3 AIDL 17
2.4 ACTIVITYMANAGERSERVICE 22
2.5 ACTIVITY WORKING PRINCIPLES 23
2.5.1 How to Launch an App 23
2.5.2 Starting the App Is Not So Simple 24
v
vi ◾ Contents
2.5.2.1 Click the App Icon in Launcher and
Send a Message to the AMS 25
2.5.2.2 The AMS Handles the Information
from the Launcher 30
2.5.2.3 The Launcher Goes to Sleep and Informs
the AMS Again 31
2.5.2.4 The AMS Creates a New Process 33
2.5.2.5 Start a New Process and Inform the AMS 34
2.5.2.6 The AMS Tells the New App Which
Activity to Launch 35
2.5.2.7 The Amazon App Starts an Activity 35
2.6 NAVIGATION IN APP 37
2.7 FAMILY OF CONTEXT 38
2.8 SERVICE 41
2.8.1 Start Service in a New Process 41
2.8.1.1 The App Sends a Message to the AMS to
Launch Service 42
2.8.1.2 The AMS Creates a New Process 42
2.8.1.3 Start a New Process and Inform the AMS 43
2.8.1.4 The AMS Sends Information to the
New Process 43
2.8.1.5 New Process to Launch Service 43
2.8.2 Start a Service in the Same Process 44
2.8.3 Bind a Service in the Same Process 44
2.8.3.1 The App Sends a Message to the AMS to
Bind a Service 45
2.8.3.2 The AMS Sends Two Messages to the
App Process 45
2.8.3.3 The App Receives the First Message 45
2.8.3.4 The App Receives the Second Message and
Sends a Binder Object to the AMS 46
2.8.3.5 AMS Informs the App 46
Contents   ◾   vii
2.9 BROADCASTRECEIVER 47
2.9.1 Registration 48
2.9.2 Send a Broadcast 49
2.10 CONTENTPROVIDER 51
2.10.1 The Essence of the ContentProvider 54
2.10.2 The ASM 54
2.10.3 Communication between ContentProvider
and the AMS 56
2.11 THE PMS AND APP INSTALLATION PROCESS 57
2.11.1 PMS Introduction 57
2.11.2 App Installation Process 58
2.11.3 PackageParser 59
2.11.4 ActivityThread and PackageManager 60
2.12 CLASSLOADER 61
2.13 PARENT-DELEGATION 63
2.14 MULTIDEX 63
2.15 A MUSIC PLAYER APP 65
2.15.1 A Music Player Based on Two Receivers 65
2.15.2 A Music Player Based on One Receiver 71
2.16 SUMMARY 77
Chapter 3 ▪ Reflection 79
3.1 BASIC REFLECTION 79
3.1.1 Get the Class Using a String 80
3.1.1.1 Get the Class Using a String 80
3.1.1.2 Class.forName 80
3.1.1.3 Property class 80
3.1.1.4 Property TYPE 80
3.1.2 Get the Property and Method of the Class 81
3.1.2.1 Get the Constructor of the Class 81
3.1.2.2 Invoke a Private Method of the Class 83
viii ◾ Contents
3.1.2.3 Invoke a Private and Static Method of the
Class 84
3.1.2.4 Get a Private Field of the Class and Modify
Its Value 84
3.1.2.5 Get the Private Static Field of the Class
and Modify Its Value 85
3.1.3 Generics and Singleton<T> 86
3.2 jOOR 88
3.2.1 Get a Class from a String 89
3.2.1.1 Get a Class from a String 89
3.2.1.2 Get a Class by Using on and get 89
3.2.2 Get the Property and Method of a Class 90
3.2.2.1 Get a Constructor of a Class 90
3.2.2.2 Get the Private Method of the Class 90
3.2.2.3 Get the Private and Static Method of
the Class 91
3.2.2.4 Get the Private Field of the Class 91
3.2.2.5 Get the Private and Static Field of the Class 91
3.2.3 Generics and Singleton<T> 91
3.3 ENCAPSULATED CLASSES OF THE BASIC REFLECTION 93
3.3.1 Get a Constructor 93
3.3.2 Invoke Instance Methods 94
3.3.3 Invoke Static Methods 95
3.3.4 Get the Field of the Class and Set Its Value 95
3.3.5 Handle Generics 96
3.4 FURTHER ENCAPSULATION OF THE REFLECTION 97
3.4.1 Reflect a Method with Only One Parameter or
without Parameters 97
3.4.2 Replace String with Class Type 100
3.4.3 Differences between the Static and
Instance Fields 101
3.4.4 Optimization of the Field Reflection 102
3.5 SUMMARY 103
Contents   ◾   ix
Chapter 4 ▪ Proxy Pattern 105
4.1 WHAT IS A PROXY PATTERN? 105
4.1.1 Remote Proxy 106
4.1.2 Write Log 108
4.2 STATIC-PROXY AND DYNAMIC-PROXY 109
4.3 A HOOK ON THE AMN 111
4.4 A HOOK ON THE PMS 113
4.5 SUMMARY 114
Chapter 5 ▪ Hooking startActivity() 115
5.1 INVOKE STARTACTIVITY() IN TWO WAYS 115
5.2 HOOKING STARTACTIVITY() OF THE ACTIVITY 116
5.2.1 Solution 1: Hooking the Method
startActivityForResult of Activity 118
5.2.2 Solution 2: Hooking the Field mInstrumentation
of Activity 118
5.2.3 Solution 3: Hooking the Method getDefault()
of AMN 121
5.2.4 Solution 4: Hooking the Field mCallback of H 125
5.2.5 Solution 5: Hooking Instrumentation Again 128
5.3 HOOKING THE METHOD STARTACTIVITY OF
CONTEXT 131
5.3.1 Solution 6: Hooking the Field mInstrumentation of
ActivityThread 131
5.3.2 Which Solution Is the Best? 133
5.4 LAUNCH AN ACTIVITY NOT DECLARED IN
ANDROIDMANIFEST.XML 133
5.4.1 How to Hook AMN 133
5.4.2 First Half of the Hook 135
5.4.3 Second Half of the Hook: Hooking the Field
mCallback of H 139
5.4.4 Second Half of the Hook: Hooking the
mInstrumentation Field of ActivityThread 141
5.5 SUMMARY 143