Android热修复——深入剖析AndFix热修复及自己动手实现

Application app   
=  new Application();
1.
2.

/**
 * bug测试类
 */
public class BugClass {
    public int test(){
        //测试bug
        throw new RuntimeException("这是一个异常！");
    }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.

package com.example.bthvi.mycloassloaderapplication;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface Replace {
    //修复哪一个class
    String clazz();
    //修复哪一个方法
    String method();
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.

import com.example.bthvi.mycloassloaderapplication.Replace;

/**
 * bug测试类
 */
public class BugClass {

    @Replace(clazz = "com.example.bthvi.mycloassloaderapplication.xxx.BugClass",method = "test")
    public int test(){
        return 1;
    }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.

package com.example.bthvi.mycloassloaderapplication;
import android.content.Context;
import android.os.Environment;

import java.io.File;
import java.io.IOException;
import java.lang.reflect.Method;
import java.util.Enumeration;

import dalvik.system.DexFile;
/**
 *@author bthvi
 *@time 2019/7/20
 *@desc 不用启动APP实现热修复
 */
public class FixDexManager {
    private final static String TAG = "FixDexUtil";
    private static final String DEX_SUFFIX = ".dex";
    private static final String APK_SUFFIX = ".apk";
    private static final String JAR_SUFFIX = ".jar";
    private static final String ZIP_SUFFIX = ".zip";
    public static final String DEX_DIR = "odex";
    private static final String OPTIMIZE_DEX_DIR = "optimize_dex";
    private Context context;

    public FixDexManager(Context context) {
        this.context = context;
    }

    public void isGoingToFix() {
        File externalStorageDirectory = Environment.getExternalStorageDirectory();

        // 遍历所有的修复dex , 因为可能是多个dex修复包
        File fileDir = externalStorageDirectory != null ?
                new File(externalStorageDirectory,"007"):
                new File(context.getFilesDir(), DEX_DIR);// data/data/包名/files/odex（这个可以任意位置）

        File[] listFiles = fileDir.listFiles();
        if (listFiles != null){
            System.out.println("TAG==目录下文件数量="+listFiles.length);
            for (File file : listFiles) {
                System.out.println("TAG==文件名称="+file.getName());
                if (file.getName().startsWith("fix") &&
                        (file.getName().endsWith(DEX_SUFFIX))) {
                    loadDex(file);// 开始修复
                    //有目标dex文件, 需要修复
                }
            }
        }
    }
    /**
     * 加载Dex文件
     * @param file
     */
    public void loadDex(File file) {
        try {
            DexFile dexFile = DexFile.loadDex(file.getAbsolutePath(),
                    new File(context.getCacheDir(), "opt").getAbsolutePath(), Context.MODE_PRIVATE);
            //当前的dex里面的class 类名集合
            Enumeration<String> entry=dexFile.entries();
            while (entry.hasMoreElements()) {
                //拿到Class类名
                String clazzName= entry.nextElement();
                //通过加载得到类  这里不能通过反射，因为当前的dex没有加载到虚拟机内存中
                Class realClazz= dexFile.loadClass(clazzName, context.getClassLoader());
                if (realClazz != null) {
                    fixClazz(realClazz);
                }
            }
        } catch (IOException e) {
            e.printStackTrace();
        }

    }

    /**
     * 修复有bug的方法
     * @param realClazz
     */
    private void fixClazz(Class realClazz) {
        //得到类中所有方法
        Method[] methods=realClazz.getMethods();
        //遍历方法 通过注解 得到需要修复的方法
        for (Method rightMethod : methods) {
            //拿到注解
            Replace replace = rightMethod.getAnnotation(Replace.class);
            if (replace == null) {
                continue;
            }
            //得到类名
            String clazzName=replace.clazz();
            //得到方法名
            String methodName=replace.method();
            try {
                //反射得到本地的有bug的方法的类
                Class wrongClazz=  Class.forName(clazzName);
                //得到有bug的方法（注意修复包中的方法参数名和参数列表必须一致）
                Method wrongMethod = wrongClazz.getDeclaredMethod(methodName, rightMethod.getParameterTypes());
                //调用native方法替换有bug的方法
                replace(wrongMethod, rightMethod);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }



    }

    public native static void replace(Method wrongMethod, Method rightMethod) ;
}

1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.

#include <jni.h>
#include <string>
#include "art_method.h"

extern "C"
JNIEXPORT void JNICALL
Java_com_example_bthvi_mycloassloaderapplication_FixDexManager_replace(JNIEnv *env, jclass type, jobject wrongMethod,
                                             jobject rightMethod) {

    //ArtMethod存在于Android 系统源码中，只需要导入我们需要的部分（art_method.h）
    art::mirror::ArtMethod *wrong=  (art::mirror::ArtMethod *)env->FromReflectedMethod(wrongMethod);
    art::mirror::ArtMethod *right=  (art::mirror::ArtMethod *)env->FromReflectedMethod(rightMethod);
    //    method   --->class ----被加载--->ClassLoader
    //错误的成员变量替换为正确的成员变量
    wrong->declaring_class_ = right->declaring_class_;
    wrong->dex_cache_resolved_methods_ = right->dex_cache_resolved_methods_;
    wrong->access_flags_ = right->access_flags_;
    wrong->dex_cache_resolved_types_ = right->dex_cache_resolved_types_;
    wrong->dex_code_item_offset_ = right->dex_code_item_offset_;
    //    这里   方法索引的替换
    wrong->method_index_ = right->method_index_;
    wrong->dex_method_index_ = right->dex_method_index_;

}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.

namespace art {
    namespace mirror {
        class Object{
            // The Class representing the type of the object.
            uint32_t klass_;
            // Monitor and hash code information.
            uint32_t monitor_;

        };
        //简化ArtMethod  只需要关注我们需要的，只需要成员变量声明
        class ArtMethod : public Object {
        public:

            uint32_t access_flags_;
            uint32_t dex_code_item_offset_;
            // Index into method_ids of the dex file associated with this method
            //方法再dex中的索引
            uint32_t method_dex_index_;
            uint32_t dex_method_index_;
            //在方法表的索引
            uint32_t method_index_;
            const void *native_method_;

            const uint16_t *vmap_table_;
            // Short cuts to declaring_class_->dex_cache_ member for fast compiled code access.
            uint32_t dex_cache_resolved_methods_;
            //方法 自发
            // Short cuts to declaring_class_->dex_cache_ member for fast compiled code access.
            uint32_t dex_cache_resolved_types_;


            // Field order required by test "ValidateFieldOrderOfJavaCppUnionClasses".
            // The class we are a part of.
            //所属的函数
            uint32_t declaring_class_;
        };
    }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.

//  Android 6.0系统源码中ArtMethod 精简版  去掉注释
class ArtMethod {
public:
    uint32_t declaring_class_;
    uint32_t dex_cache_resolved_methods_;
    uint32_t dex_cache_resolved_types_;
    uint32_t access_flags_;
    uint32_t dex_code_item_offset_;
    uint32_t dex_method_index_;
    uint32_t method_index_;

    struct PtrSizedFields {
        // Method dispatch from the interpreter invokes this pointer which may cause a bridge into
        // compiled code.
        void* entry_point_from_interpreter_;
        // Pointer to JNI function registered to this method, or a function to resolve the JNI function.
        void* entry_point_from_jni_;
        // Method dispatch from quick compiled code invokes this pointer which may cause bridging into
        // the interpreter.
        void* entry_point_from_quick_compiled_code_;
    } ptr_sized_fields_;
};

//  Android 7.0系统源码中ArtMethod 精简版  去掉注释
class ArtMethod {
public:

	uint32_t declaring_class_;
	uint32_t access_flags_;
	uint32_t dex_code_item_offset_;
	uint32_t dex_method_index_;
	uint16_t method_index_;
	uint16_t hotness_count_;
	struct PtrSizedFields {
		// Short cuts to declaring_class_->dex_cache_ member for fast compiled code access.
		ArtMethod** dex_cache_resolved_methods_;

		// Short cuts to declaring_class_->dex_cache_ member for fast compiled code access.
		void* dex_cache_resolved_types_;

		// Pointer to JNI function registered to this method, or a function to resolve the JNI function,
		// or the profiling data for non-native methods, or an ImtConflictTable.
		void* entry_point_from_jni_;

		// Method dispatch from quick compiled code invokes this pointer which may cause bridging into
		// the interpreter.
		void* entry_point_from_quick_compiled_code_;
	} ptr_sized_fields_;

};
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.