Java 类android.app.ActivityManagerNative 实例源码

/**
 * hookSystemServices, but need to compatible with Android O in future.
 */
private void hookSystemServices() {
    try {
        Singleton<IActivityManager> defaultSingleton = (Singleton<IActivityManager>) ReflectUtil.getField(ActivityManagerNative.class, null, "gDefault");
        IActivityManager activityManagerProxy = ActivityManagerProxy.newInstance(this, defaultSingleton.get());

        // Hook IActivityManager from ActivityManagerNative
        ReflectUtil.setField(defaultSingleton.getClass().getSuperclass(), defaultSingleton, "mInstance", activityManagerProxy);

        if (defaultSingleton.get() == activityManagerProxy) {
            this.mActivityManager = activityManagerProxy;
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}

public static boolean run(float delta) {
  try {
    IActivityManager amn = ActivityManagerNative.getDefault();
    Configuration config = amn.getConfiguration();
    config.fontScale = (delta == 0) ? 1 : (config.fontScale + delta);
    amn.updatePersistentConfiguration(config);
    return true;
  } catch (Throwable e) {
    Debug.log(e);
    return false;
  }
}

@Override
public void inject() throws Throwable {

    Field f_gDefault = ActivityManagerNative.class.getDeclaredField("gDefault");
    if (!f_gDefault.isAccessible()) {
        f_gDefault.setAccessible(true);
    }
    if (f_gDefault.getType() == IActivityManager.class) {
        f_gDefault.set(null, getHookObject().getProxyObject());

    } else if (f_gDefault.getType() == Singleton.class) {

        Singleton gDefault = (Singleton) f_gDefault.get(null);
        Field f_mInstance = Singleton.class.getDeclaredField("mInstance");
        if (!f_mInstance.isAccessible()) {
            f_mInstance.setAccessible(true);
        }
        f_mInstance.set(gDefault, getHookObject().getProxyObject());
    } else {
        // 不会经过这里
        throw new UnsupportedOperationException("Singleton is not visible in AMN.");
    }

    HookBinder<IActivityManager> hookAMBinder = new HookBinder<IActivityManager>() {
        @Override
        protected IBinder queryBaseBinder() {
            return ServiceManager.getService(Context.ACTIVITY_SERVICE);
        }

        @Override
        protected IActivityManager createInterface(IBinder baseBinder) {
            return getHookObject().getProxyObject();
        }
    };
    hookAMBinder.injectService(Context.ACTIVITY_SERVICE);
}

public static IActivityManager getAMN() {
    return ActivityManagerNative.getDefault();
}