文章目錄

• 一、ActivityThread 源碼分析
• 二、ActivityThread 部分代碼示例

dex 解密時 , 需要將 代理 Application 替換為 真實 Application ; 替換 Application 首先要理解系統如何注冊應用的 Application 的 ;

一、ActivityThread 源碼分析

---

參考源碼 : /frameworks/base/core/java/android/app/ActivityThread.java

Zygote 進程孵化器 fork 出應用進程后 , 就會執行 ActivityThread 中的 main 函數 ;

在 main 函數中 , 調用了 Looper.prepareMainLooper() 方法 , 初始化了 Looper , 在 main 方法最后 , 執行了 Looper.loop() , 開啟了無限循環獲取 Message 并執行 ;

準備完 Looper 之后 , ActivityThread thread = new ActivityThread() 創建了 ActivityThread 對象 , 并調用了該對象的 attach 函數 , thread.attach(false) ;

public static void main(String[] args) {Looper.prepareMainLooper();ActivityThread thread = new ActivityThread();thread.attach(false);Looper.loop();}

在 attach 函數中 , private void attach(boolean system) , 傳入的參數是 false , 進入第一個分支 if (!system) { ;

在該分支中 , final IActivityManager mgr = ActivityManagerNative.getDefault() , 通過 ActivityManager 拿到了 Binder 對象 ;

通過調用該 Binder 對象的 attachApplication 方法 , mgr.attachApplication(mAppThread) , 將本 ApplicationThread 對象傳送出去 ;

private void attach(boolean system) {sCurrentActivityThread = this;mSystemThread = system;if (!system) {RuntimeInit.setApplicationObject(mAppThread.asBinder());final IActivityManager mgr = ActivityManagerNative.getDefault();try {mgr.attachApplication(mAppThread);} catch (RemoteException ex) {// Ignore}// Watch for getting close to heap limit.} else {// Don't set application object here -- if the system crashes,// we can't display an alert, we just want to die die die.}}

在 main 函數中創建 ActivityThread 對象時 , 會自動創建其內部的成員屬性 , 包括主線程的 Handler , final H mH = new H() 成員 , H 類型就是 Handler 的子類 , private class H extends Handler ;

利用 Binder 調用 ActivityThread 的 bindApplication 方法 , public final void bindApplication , 在 bindApplication 方法中 , 接收 ActivityManagerService 發送來的參數 , 最后發送一條 Message 給 H mH 對象 , 即 Hander 子類對象 , sendMessage(H.BIND_APPLICATION, data) ;

最終由 H 對象 , private class H extends Handler 類型 , 處理上述邏輯 , 最終調用 handleBindApplication 方法處理 , private void handleBindApplication(AppBindData data) ;

final H mH = new H();private class H extends Handler {public void handleMessage(Message msg) {switch (msg.what) {case BIND_APPLICATION:Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");AppBindData data = (AppBindData)msg.obj;handleBindApplication(data);Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);break;}}

在 ActivityThread 的 handleBindApplication 方法中就是進行的 Application 準備工作 , 構建 Application , 并調用 Application 中的 onCreate 等生命周期函數 ;

在 handleBindApplication 方法 中 , Application app = data.info.makeApplication(data.restrictedBackupMode, null) , 此處創建 Application ;

應用 Application 的具體創建方法 , 需要查看該 data.info.makeApplication 方法 , makeApplication 是 data.info 對象中的函數 , data.info 對象類型是 android.app.LoadedApk 類型 , data.info 是調用 getPackageInfoNoCheck 獲取的 , data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo) ;

private void handleBindApplication(AppBindData data) {try {// If the app is being launched for full backup or restore, bring it up in// a restricted environment with the base application class.Application app = data.info.makeApplication(data.restrictedBackupMode, null);mInitialApplication = app;} finally {StrictMode.setThreadPolicy(savedPolicy);}}

二、ActivityThread 部分代碼示例

---

ActivityThread 部分代碼示例 :

public final class ActivityThread {final ApplicationThread mAppThread = new ApplicationThread();final Looper mLooper = Looper.myLooper();final H mH = new H();private class H extends Handler {public void handleMessage(Message msg) {switch (msg.what) {case BIND_APPLICATION:Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");AppBindData data = (AppBindData)msg.obj;handleBindApplication(data);Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);break;}}private void handleBindApplication(AppBindData data) {try {// If the app is being launched for full backup or restore, bring it up in// a restricted environment with the base application class.Application app = data.info.makeApplication(data.restrictedBackupMode, null);mInitialApplication = app;} finally {StrictMode.setThreadPolicy(savedPolicy);}}public final void bindApplication(String processName, ApplicationInfo appInfo,List<ProviderInfo> providers, ComponentName instrumentationName,ProfilerInfo profilerInfo, Bundle instrumentationArgs,IInstrumentationWatcher instrumentationWatcher,IUiAutomationConnection instrumentationUiConnection, int debugMode,boolean enableOpenGlTrace, boolean isRestrictedBackupMode, boolean persistent,Configuration config, CompatibilityInfo compatInfo, Map<String, IBinder> services,Bundle coreSettings) {sendMessage(H.BIND_APPLICATION, data);} private void attach(boolean system) {sCurrentActivityThread = this;mSystemThread = system;if (!system) {RuntimeInit.setApplicationObject(mAppThread.asBinder());final IActivityManager mgr = ActivityManagerNative.getDefault();try {mgr.attachApplication(mAppThread);} catch (RemoteException ex) {// Ignore}// Watch for getting close to heap limit.} else {// Don't set application object here -- if the system crashes,// we can't display an alert, we just want to die die die.}}public static void main(String[] args) {Looper.prepareMainLooper();ActivityThread thread = new ActivityThread();thread.attach(false);Looper.loop();} }

總結

以上是生活随笔為你收集整理的【Android 安全】DEX 加密 ( Application 替换 | Android 应用启动原理 | ActivityThread 源码分析 )的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。