Xposed源码剖析——app_process作用详解
生活随笔
收集整理的這篇文章主要介紹了
Xposed源码剖析——app_process作用详解
小編覺得挺不錯(cuò)的,現(xiàn)在分享給大家,幫大家做個(gè)參考.
Xposed源碼剖析——app_process作用詳解
首先吐槽一下CSDN的改版吧，發(fā)表這篇文章之前其實(shí)我已經(jīng)將此篇文章寫過了兩三次了。就是發(fā)表不成功。而且CSDN將我的文章草稿也一帶>刪除掉了。弄得我現(xiàn)在只有使用sublime寫一次，保證它們刪不掉。
承接上文?http://blog.csdn.net/yzzst/article/details/47659987
上面我們分析Xposed項(xiàng)目的源碼，從XposedInstaller開始說明了Xposed安裝的原理與過程。我們知道，XposedInstaller主要的工作就是：
- 替換系統(tǒng)的app_process（當(dāng)然，這個(gè)操作需要Root權(quán)限）
- 將xposed的api文件，XposedBridge.jar文件放置到私有目錄中
至于?
為什么要替換app_process文件？?
系統(tǒng)中的app_process文件有什么作用？?
替換后的app_process為什么能夠幫助我們hook？
下面我們就開始看看，rovo89大神的xposed開源項(xiàng)目。從GitHub上面clone下來xposed項(xiàng)目，我們?cè)谀夸浿锌吹狡淠夸浗Y(jié)構(gòu)，如下所示：
從目錄中，我們能夠清楚的了解到，其中xposed項(xiàng)目現(xiàn)在已經(jīng)支持Dalvik虛擬機(jī)與art虛擬機(jī)的架構(gòu)了。
app_main.cpp 源碼閱讀與對(duì)比
ok這里，我們先從app_process的源碼開始閱讀，打開app_main.cpp文件，估計(jì)大家和我一下，一時(shí)間也看不出來xposed針對(duì)源碼修改了一些什么。
那么，我們就直接拿源碼與xposed中的app_main.cpp進(jìn)行對(duì)比。
源碼地址：/frameworks/base/cmds/app_process/app_main.cpp
發(fā)現(xiàn)了，rovo89針對(duì)了一下幾個(gè)地方進(jìn)行了修改。
atrace_set_tracing_enabled 進(jìn)行了替換修改?
onVmCreated 增加了Xposed的回調(diào)
main函數(shù)中，增加了 xposed 的 options 操作?
?
我們?cè)趚posed.cpp中，能夠看到其handleOptions的具體邏輯，其實(shí)就是處理一些xposed的特殊命令而已。?
如下所示：
* main函數(shù)中，啟動(dòng)的時(shí)候增加了啟動(dòng)一些邏輯 *?
具體的， 我們可以看到。runtime.start那一段。做出了一個(gè)啟動(dòng)。
<code class="language-java hljs has-numbering" style="display: block; padding: 0px; color: inherit; box-sizing: border-box; font-family: 'Source Code Pro', monospace;font-size:undefined; white-space: pre; border-radius: 0px; word-wrap: normal; background: transparent;"> isXposedLoaded = xposed::initialize(zygote, startSystemServer, className, argc, argv);<span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">if</span> (zygote) {<span class="hljs-comment" style="color:#8800;box-sizing: border-box;">// 當(dāng)xposed成功啟動(dòng)的時(shí)候，start XPOSED_CLASS_DOTS_ZYGOTE這個(gè)類</span>runtime.start(isXposedLoaded ? XPOSED_CLASS_DOTS_ZYGOTE : <span class="hljs-string" style="color:#0880;box-sizing: border-box;">"com.android.internal.os.ZygoteInit"</span>,startSystemServer ? <span class="hljs-string" style="color:#0880;box-sizing: border-box;">"start-system-server"</span> : <span class="hljs-string" style="color:#0880;box-sizing: border-box;">""</span>);} <span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">else</span> <span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">if</span> (className) {<span class="hljs-comment" style="color:#8800;box-sizing: border-box;">// Remainder of args get passed to startup class main()</span>runtime.mClassName = className;runtime.mArgC = argc - i;runtime.mArgV = argv + i;<span class="hljs-comment" style="color:#8800;box-sizing: border-box;">// 當(dāng)xposed成功啟動(dòng)的時(shí)候，start XPOSED_CLASS_DOTS_ZYGOTE這個(gè)類</span>runtime.start(isXposedLoaded ? XPOSED_CLASS_DOTS_TOOLS : <span class="hljs-string" style="color:#0880;box-sizing: border-box;">"com.android.internal.os.RuntimeInit"</span>,application ? <span class="hljs-string" style="color:#0880;box-sizing: border-box;">"application"</span> : <span class="hljs-string" style="color:#0880;box-sizing: border-box;">"tool"</span>);} <span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">else</span> {fprintf(stderr, <span class="hljs-string" style="color:#0880;box-sizing: border-box;">"Error: no class name or --zygote supplied.\n"</span>);app_usage();LOG_ALWAYS_FATAL(<span class="hljs-string" style="color:#0880;box-sizing: border-box;">"app_process: no class name or --zygote supplied."</span>);<span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">return</span> <span class="hljs-number" style="color:#06666;box-sizing: border-box;">10</span>;}</code><ul class="pre-numbering" style="box-sizing: border-box; position: absolute; width: 50px; top: 0px; left: 0px; margin: 0px; padding: 6px 0px 40px; border-right-width: 1px; border-right-style: solid; border-right-color: rgb(221, 221, 221); list-style: none; text-align: right; background-color: rgb(238, 238, 238);"><li style="box-sizing: border-box; padding: 0px 5px;">1</li><li style="box-sizing: border-box; padding: 0px 5px;">2</li><li style="box-sizing: border-box; padding: 0px 5px;">3</li><li style="box-sizing: border-box; padding: 0px 5px;">4</li><li style="box-sizing: border-box; padding: 0px 5px;">5</li><li style="box-sizing: border-box; padding: 0px 5px;">6</li><li style="box-sizing: border-box; padding: 0px 5px;">7</li><li style="box-sizing: border-box; padding: 0px 5px;">8</li><li style="box-sizing: border-box; padding: 0px 5px;">9</li><li style="box-sizing: border-box; padding: 0px 5px;">10</li><li style="box-sizing: border-box; padding: 0px 5px;">11</li><li style="box-sizing: border-box; padding: 0px 5px;">12</li><li style="box-sizing: border-box; padding: 0px 5px;">13</li><li style="box-sizing: border-box; padding: 0px 5px;">14</li><li style="box-sizing: border-box; padding: 0px 5px;">15</li><li style="box-sizing: border-box; padding: 0px 5px;">16</li><li style="box-sizing: border-box; padding: 0px 5px;">17</li><li style="box-sizing: border-box; padding: 0px 5px;">18</li><li style="box-sizing: border-box; padding: 0px 5px;">19</li></ul>這里的我們看到，在main函數(shù)中啟動(dòng)了邏輯，
<code class="hljs sql has-numbering" style="display: block; padding: 0px; color: inherit; box-sizing: border-box; font-family: 'Source Code Pro', monospace;font-size:undefined; white-space: pre; border-radius: 0px; word-wrap: normal; background: transparent;">runtime.<span class="hljs-operator" style="box-sizing: border-box;"><span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">start</span>(isXposedLoaded ? XPOSED_CLASS_DOTS_ZYGOTE : <span class="hljs-string" style="color:#0880;box-sizing: border-box;">"com.android.internal.os.ZygoteInit"</span>,startSystemServer ? <span class="hljs-string" style="color:#0880;box-sizing: border-box;">"start-system-server"</span> : <span class="hljs-string" style="color:#0880;box-sizing: border-box;">""</span>);</span></code><ul class="pre-numbering" style="box-sizing: border-box; position: absolute; width: 50px; top: 0px; left: 0px; margin: 0px; padding: 6px 0px 40px; border-right-width: 1px; border-right-style: solid; border-right-color: rgb(221, 221, 221); list-style: none; text-align: right; background-color: rgb(238, 238, 238);"><li style="box-sizing: border-box; padding: 0px 5px;">1</li><li style="box-sizing: border-box; padding: 0px 5px;">2</li></ul>其中，XPOSED_CLASS_DOTS_ZYGOTE 變量在，xposed.h頭文件中有定義，如下所示：
<code class="hljs cs has-numbering" style="display: block; padding: 0px; color: inherit; box-sizing: border-box; font-family: 'Source Code Pro', monospace;font-size:undefined; white-space: pre; border-radius: 0px; word-wrap: normal; background: transparent;"><span class="hljs-preprocessor" style="color:#444444;box-sizing: border-box;">#<span class="hljs-keyword" style="color:#444444;box-sizing: border-box;">define</span> XPOSED_CLASS_DOTS_ZYGOTE "de.robv.android.xposed.XposedBridge"</span></code><ul class="pre-numbering" style="box-sizing: border-box; position: absolute; width: 50px; top: 0px; left: 0px; margin: 0px; padding: 6px 0px 40px; border-right-width: 1px; border-right-style: solid; border-right-color: rgb(221, 221, 221); list-style: none; text-align: right; background-color: rgb(238, 238, 238);"><li style="box-sizing: border-box; padding: 0px 5px;">1</li></ul>發(fā)現(xiàn)，其實(shí)這個(gè)類就是我們之前向私有目錄防止的XposedBridge項(xiàng)目的包名。
而runtime.start這個(gè)包名有什么作用呢？我們?cè)贏ndroidRuntime中找到start方法的具體邏輯?
在源代碼中/frameworks/base/core/jni/AndroidRuntime.cpp中看到
系統(tǒng)源碼對(duì)start方法的定義，就是啟動(dòng)對(duì)應(yīng)類的 start void main入口函數(shù)。這里，就將三個(gè)項(xiàng)目的邏輯連接起來了。
XposedBridge.java
我們?cè)赬posedBridge.java代碼中，看到其main方法，如下所示：
<code class="language-java hljs has-numbering" style="display: block; padding: 0px; color: inherit; box-sizing: border-box; font-family: 'Source Code Pro', monospace;font-size:undefined; white-space: pre; border-radius: 0px; word-wrap: normal; background: transparent;"> <span class="hljs-javadoc" style="color:#8800;box-sizing: border-box;">/*** Called when native methods and other things are initialized, but before preloading classes etc.*/</span><span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">protected</span> <span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">static</span> <span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">void</span> <span class="hljs-title" style="box-sizing: border-box;">main</span>(String[] args) {<span class="hljs-comment" style="color:#8800;box-sizing: border-box;">// Initialize the Xposed framework and modules</span><span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">try</span> {SELinuxHelper.initOnce();SELinuxHelper.initForProcess(<span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">null</span>);runtime = getRuntime();<span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">if</span> (initNative()) {XPOSED_BRIDGE_VERSION = getXposedVersion();<span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">if</span> (isZygote) {startsSystemServer = startsSystemServer();<span class="hljs-comment" style="color:#8800;box-sizing: border-box;">// 為啟動(dòng)一個(gè)新的 zygote做好 hook準(zhǔn)備</span>initForZygote();}<span class="hljs-comment" style="color:#8800;box-sizing: border-box;">// 載入Xposed的一些modules</span>loadModules();} <span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">else</span> {log(<span class="hljs-string" style="color:#0880;box-sizing: border-box;">"Errors during native Xposed initialization"</span>);}} <span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">catch</span> (Throwable t) {log(<span class="hljs-string" style="color:#0880;box-sizing: border-box;">"Errors during Xposed initialization"</span>);log(t);disableHooks = <span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">true</span>;}<span class="hljs-comment" style="color:#8800;box-sizing: border-box;">// 調(diào)用系統(tǒng)原來的啟動(dòng)方法</span><span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">if</span> (isZygote)ZygoteInit.main(args);<span class="hljs-keyword" style="color:#0088;box-sizing: border-box;">else</span>RuntimeInit.main(args);}</code><ul class="pre-numbering" style="box-sizing: border-box; position: absolute; width: 50px; top: 0px; left: 0px; margin: 0px; padding: 6px 0px 40px; border-right-width: 1px; border-right-style: solid; border-right-color: rgb(221, 221, 221); list-style: none; text-align: right; background-color: rgb(238, 238, 238);"><li style="box-sizing: border-box; padding: 0px 5px;">1</li><li style="box-sizing: border-box; padding: 0px 5px;">2</li><li style="box-sizing: border-box; padding: 0px 5px;">3</li><li style="box-sizing: border-box; padding: 0px 5px;">4</li><li style="box-sizing: border-box; padding: 0px 5px;">5</li><li style="box-sizing: border-box; padding: 0px 5px;">6</li><li style="box-sizing: border-box; padding: 0px 5px;">7</li><li style="box-sizing: border-box; padding: 0px 5px;">8</li><li style="box-sizing: border-box; padding: 0px 5px;">9</li><li style="box-sizing: border-box; padding: 0px 5px;">10</li><li style="box-sizing: border-box; padding: 0px 5px;">11</li><li style="box-sizing: border-box; padding: 0px 5px;">12</li><li style="box-sizing: border-box; padding: 0px 5px;">13</li><li style="box-sizing: border-box; padding: 0px 5px;">14</li><li style="box-sizing: border-box; padding: 0px 5px;">15</li><li style="box-sizing: border-box; padding: 0px 5px;">16</li><li style="box-sizing: border-box; padding: 0px 5px;">17</li><li style="box-sizing: border-box; padding: 0px 5px;">18</li><li style="box-sizing: border-box; padding: 0px 5px;">19</li><li style="box-sizing: border-box; padding: 0px 5px;">20</li><li style="box-sizing: border-box; padding: 0px 5px;">21</li><li style="box-sizing: border-box; padding: 0px 5px;">22</li><li style="box-sizing: border-box; padding: 0px 5px;">23</li><li style="box-sizing: border-box; padding: 0px 5px;">24</li><li style="box-sizing: border-box; padding: 0px 5px;">25</li><li style="box-sizing: border-box; padding: 0px 5px;">26</li><li style="box-sizing: border-box; padding: 0px 5px;">27</li><li style="box-sizing: border-box; padding: 0px 5px;">28</li><li style="box-sizing: border-box; padding: 0px 5px;">29</li><li style="box-sizing: border-box; padding: 0px 5px;">30</li><li style="box-sizing: border-box; padding: 0px 5px;">31</li><li style="box-sizing: border-box; padding: 0px 5px;">32</li><li style="box-sizing: border-box; padding: 0px 5px;">33</li><li style="box-sizing: border-box; padding: 0px 5px;">34</li></ul>ok，那么，整個(gè)app_process的復(fù)制hook邏輯，到這里我們已經(jīng)清楚了。邏輯如下圖所示。
那么，xposed具體怎么實(shí)現(xiàn)系統(tǒng)api邏輯的replace和inject我們下次在做分析。
原文地址： http://blog.csdn.net/yzzst/article/details/47829657
總結(jié)
以上是生活随笔為你收集整理的Xposed源码剖析——app_process作用详解的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： Xposed源码剖析——概述
- 下一篇： Xposed源码剖析——Xposed初始