Table Of Content

Android App-Hook and Plug-In Technology Jianqiang Bao Android App-Hook Android App-Hook and and Plug-In Technology Plug-In Technology Android App-Hook and Plug-In Technology Jianqiang Bao Jianqiang Bao CRC Press Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2020 by CRC Press, Taylor & Francis Group, 6000 Broken Sound Pkwy., NW, Suite 300, Boca Raton., FL 33487, under exclusive license granted by Beijing Huazhang Graphics & Information Co., Ltd./China Machine Press for English language and throughout the world. CRC Press is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S. Government works Printed on acid-free paper International Standard Book Number-13: 978-0-367-20700-7 (Hardback) This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, trans- mitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers. For permission to photocopy or use material electronically from this work, please access www.copyright.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged. Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe. Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the CRC Press Web site at http://www.crcpress.com Contents Acknowledgments, xvii About the Author, xix About the Translators, xxi Introduction, xxiii Chapter 1 ▪ Plug-Ins from the Past to the Future 1 1.1 ANDROID PLUG-INS IN CHINA 1 1.2 HISTORY OF ANDROID PLUG-IN TECHNIQUES 2 1.3 USAGE OF PLUG-INS 8 1.4 ANOTHER CHOICE: REACT NATIVE 9 1.5 DO ALL COMPONENTS REQUIRE PLUG-INS? 10 1.6 DOUBLE-OPENING AND VIRTUAL MACHINE 10 1.7 FROM NATIVE TO HTML5 11 1.8 SUMMARY 12 Chapter 2 ▪ The Underlying Knowledge of Android 13 2.1 OVERVIEW OF UNDERLYING ANDROID KNOWLEDGE 13 2.2 BINDER 15 2.3 AIDL 17 2.4 ACTIVITYMANAGERSERVICE 22 2.5 ACTIVITY WORKING PRINCIPLES 23 2.5.1 How to Launch an App 23 2.5.2 Starting the App Is Not So Simple 24 v vi ◾ Contents 2.5.2.1 Click the App Icon in Launcher and Send a Message to the AMS 25 2.5.2.2 The AMS Handles the Information from the Launcher 30 2.5.2.3 The Launcher Goes to Sleep and Informs the AMS Again 31 2.5.2.4 The AMS Creates a New Process 33 2.5.2.5 Start a New Process and Inform the AMS 34 2.5.2.6 The AMS Tells the New App Which Activity to Launch 35 2.5.2.7 The Amazon App Starts an Activity 35 2.6 NAVIGATION IN APP 37 2.7 FAMILY OF CONTEXT 38 2.8 SERVICE 41 2.8.1 Start Service in a New Process 41 2.8.1.1 The App Sends a Message to the AMS to Launch Service 42 2.8.1.2 The AMS Creates a New Process 42 2.8.1.3 Start a New Process and Inform the AMS 43 2.8.1.4 The AMS Sends Information to the New Process 43 2.8.1.5 New Process to Launch Service 43 2.8.2 Start a Service in the Same Process 44 2.8.3 Bind a Service in the Same Process 44 2.8.3.1 The App Sends a Message to the AMS to Bind a Service 45 2.8.3.2 The AMS Sends Two Messages to the App Process 45 2.8.3.3 The App Receives the First Message 45 2.8.3.4 The App Receives the Second Message and Sends a Binder Object to the AMS 46 2.8.3.5 AMS Informs the App 46 Contents ◾ vii 2.9 BROADCASTRECEIVER 47 2.9.1 Registration 48 2.9.2 Send a Broadcast 49 2.10 CONTENTPROVIDER 51 2.10.1 The Essence of the ContentProvider 54 2.10.2 The ASM 54 2.10.3 Communication between ContentProvider and the AMS 56 2.11 THE PMS AND APP INSTALLATION PROCESS 57 2.11.1 PMS Introduction 57 2.11.2 App Installation Process 58 2.11.3 PackageParser 59 2.11.4 ActivityThread and PackageManager 60 2.12 CLASSLOADER 61 2.13 PARENT-DELEGATION 63 2.14 MULTIDEX 63 2.15 A MUSIC PLAYER APP 65 2.15.1 A Music Player Based on Two Receivers 65 2.15.2 A Music Player Based on One Receiver 71 2.16 SUMMARY 77 Chapter 3 ▪ Reflection 79 3.1 BASIC REFLECTION 79 3.1.1 Get the Class Using a String 80 3.1.1.1 Get the Class Using a String 80 3.1.1.2 Class.forName 80 3.1.1.3 Property class 80 3.1.1.4 Property TYPE 80 3.1.2 Get the Property and Method of the Class 81 3.1.2.1 Get the Constructor of the Class 81 3.1.2.2 Invoke a Private Method of the Class 83 viii ◾ Contents 3.1.2.3 Invoke a Private and Static Method of the Class 84 3.1.2.4 Get a Private Field of the Class and Modify Its Value 84 3.1.2.5 Get the Private Static Field of the Class and Modify Its Value 85 3.1.3 Generics and Singleton<T> 86 3.2 jOOR 88 3.2.1 Get a Class from a String 89 3.2.1.1 Get a Class from a String 89 3.2.1.2 Get a Class by Using on and get 89 3.2.2 Get the Property and Method of a Class 90 3.2.2.1 Get a Constructor of a Class 90 3.2.2.2 Get the Private Method of the Class 90 3.2.2.3 Get the Private and Static Method of the Class 91 3.2.2.4 Get the Private Field of the Class 91 3.2.2.5 Get the Private and Static Field of the Class 91 3.2.3 Generics and Singleton<T> 91 3.3 ENCAPSULATED CLASSES OF THE BASIC REFLECTION 93 3.3.1 Get a Constructor 93 3.3.2 Invoke Instance Methods 94 3.3.3 Invoke Static Methods 95 3.3.4 Get the Field of the Class and Set Its Value 95 3.3.5 Handle Generics 96 3.4 FURTHER ENCAPSULATION OF THE REFLECTION 97 3.4.1 Reflect a Method with Only One Parameter or without Parameters 97 3.4.2 Replace String with Class Type 100 3.4.3 Differences between the Static and Instance Fields 101 3.4.4 Optimization of the Field Reflection 102 3.5 SUMMARY 103 Contents ◾ ix Chapter 4 ▪ Proxy Pattern 105 4.1 WHAT IS A PROXY PATTERN? 105 4.1.1 Remote Proxy 106 4.1.2 Write Log 108 4.2 STATIC-PROXY AND DYNAMIC-PROXY 109 4.3 A HOOK ON THE AMN 111 4.4 A HOOK ON THE PMS 113 4.5 SUMMARY 114 Chapter 5 ▪ Hooking startActivity() 115 5.1 INVOKE STARTACTIVITY() IN TWO WAYS 115 5.2 HOOKING STARTACTIVITY() OF THE ACTIVITY 116 5.2.1 Solution 1: Hooking the Method startActivityForResult of Activity 118 5.2.2 Solution 2: Hooking the Field mInstrumentation of Activity 118 5.2.3 Solution 3: Hooking the Method getDefault() of AMN 121 5.2.4 Solution 4: Hooking the Field mCallback of H 125 5.2.5 Solution 5: Hooking Instrumentation Again 128 5.3 HOOKING THE METHOD STARTACTIVITY OF CONTEXT 131 5.3.1 Solution 6: Hooking the Field mInstrumentation of ActivityThread 131 5.3.2 Which Solution Is the Best? 133 5.4 LAUNCH AN ACTIVITY NOT DECLARED IN ANDROIDMANIFEST.XML 133 5.4.1 How to Hook AMN 133 5.4.2 First Half of the Hook 135 5.4.3 Second Half of the Hook: Hooking the Field mCallback of H 139 5.4.4 Second Half of the Hook: Hooking the mInstrumentation Field of ActivityThread 141 5.5 SUMMARY 143