mirror of
https://github.com/feicong/rom-course.git
synced 2025-08-29 18:54:56 +00:00
第六章完成
This commit is contained in:
dqzg12300
parent
4dd4af3b0a
commit
d2527fec13
@ -765,19 +765,704 @@ public class MainActivity extends AppCompatActivity {
|
|||||||
cn.mik.myservicedemo I/MainActivity: msg: hello mikrom service
|
cn.mik.myservicedemo I/MainActivity: msg: hello mikrom service
|
||||||
```
|
```
|
||||||
|
|
||||||
## 6.5 修改APP默认权限
|
## 6.5 APP权限
|
||||||
|
|
||||||
|
Android中的权限是指应用程序访问设备功能和用户数据所需的授权。在Android系统中，所有的应用程序都必须声明其需要的权限，以便在安装时就向用户展示，并且在运行时需要获取相应的授权才能使用。
|
||||||
|
|
||||||
|
这一节将介绍APP的权限，以及在源码中是如何加载`AndroidManifest.xml`文件获取到权限，并进行控制的，最后尝试在加载流程中进行修改，让APP默认具有一些权限，无需APP进行申请。
|
||||||
|
|
||||||
### 6.5.1 APP权限介绍
|
### 6.5.1 APP权限介绍
|
||||||
|
|
||||||
|
Android系统将权限分为普通权限和危险权限两类，其中危险权限需要用户明确授权才能使用，而普通权限则不需要。普通权限通常不涉及到用户隐私和设备安全问题，例如访问网络、读取手机状态等。而危险权限则可能会涉及到用户隐私和设备安全问题，例如读取联系人信息、访问摄像头等。
|
||||||
|
在AndroidManifest.xml文件中声明权限，可以使用`<uses-permission>`标签来声明需要的权限，例如：
|
||||||
|
|
||||||
|
```
|
||||||
|
<manifest package="com.example.app">
|
||||||
|
<uses-permission android:name="android.permission.READ_CONTACTS" />
|
||||||
|
<uses-permission android:name="android.permission.CAMERA" />
|
||||||
|
...
|
||||||
|
</manifest>
|
||||||
|
```
|
||||||
|
|
||||||
### 6.5.2 APP权限的源码跟踪
|
Android中的常见权限列表如下。
|
||||||
|
|
||||||
|
1. 日历权限：`android.permission.READ_CALENDAR、android.permission.WRITE_CALENDAR`
|
||||||
|
2. 相机权限：`android.permission.CAMERA`
|
||||||
|
3. 联系人权限：`android.permission.READ_CONTACTS、android.permission.WRITE_CONTACTS、android.permission.GET_ACCOUNTS`
|
||||||
|
4. 定位权限：`android.permission.ACCESS_FINE_LOCATION、android.permission.ACCESS_COARSE_LOCATION`
|
||||||
|
5. 麦克风权限：`android.permission.RECORD_AUDIO`
|
||||||
|
6. 手机状态和电话权限：`android.permission.READ_PHONE_STATE、android.permission.CALL_PHONE、android.permission.READ_CALL_LOG、android.permission.WRITE_CALL_LOG、android.permission.ADD_VOICEMAIL、android.permission.USE_SIP、android.permission.PROCESS_OUTGOING_CALLS`
|
||||||
|
7. 传感器权限：`android.permission.BODY_SENSORS`
|
||||||
|
8. 短信权限：`android.permission.READ_SMS、android.permission.RECEIVE_SMS、android.permission.SEND_SMS、android.permission.RECEIVE_WAP_PUSH、android.permission.RECEIVE_MMS`
|
||||||
|
9. 存储权限：`android.permission.READ_EXTERNAL_STORAGE、android.permission.WRITE_EXTERNAL_STORAGE`
|
||||||
|
10. 联网权限：`android.permission.INTERNET`
|
||||||
|
|
||||||
|
androidManifest.xml文件是Android应用程序的清单文件，它在应用程序安装和运行过程中都会被解析。Android系统启动时也会解析每个已安装应用程序的清单文件（即androidManifest.xml），以了解应用程序所需的权限、组件等信息，并将这些信息记录在系统中。而这项解析工作是由`PackageManagerService`系统服务来完成的。因此开始分析的入手点可以从该系统服务的启动开始。
|
||||||
|
|
||||||
### 6.5.3 AOSP10下的默认权限修改
|
### 6.5.2 权限解析源码跟踪
|
||||||
|
|
||||||
|
`PackageManagerService`系统服务的启动是再`SystemServer`进程中，在`SystemServer.java`中搜索就能该进程启动的入口，相关代码如下。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private void startBootstrapServices() {
|
||||||
|
...
|
||||||
|
t.traceBegin("StartPackageManagerService");
|
||||||
|
try {
|
||||||
|
Watchdog.getInstance().pauseWatchingCurrentThread("packagemanagermain");
|
||||||
|
mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
|
||||||
|
domainVerificationService, mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF,
|
||||||
|
mOnlyCore);
|
||||||
|
} finally {
|
||||||
|
Watchdog.getInstance().resumeWatchingCurrentThread("packagemanagermain");
|
||||||
|
}
|
||||||
|
...
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
## 6.6 进程注入器
|
继续跟进看该服务的main函数
|
||||||
|
|
||||||
|
```java
|
||||||
|
public static PackageManagerService main(Context context, Installer installer,
|
||||||
|
@NonNull DomainVerificationService domainVerificationService, boolean factoryTest,
|
||||||
|
boolean onlyCore) {
|
||||||
|
...
|
||||||
|
PackageManagerService m = new PackageManagerService(injector, onlyCore, factoryTest,
|
||||||
|
Build.FINGERPRINT, Build.IS_ENG, Build.IS_USERDEBUG, Build.VERSION.SDK_INT,
|
||||||
|
Build.VERSION.INCREMENTAL);
|
||||||
|
...
|
||||||
|
ServiceManager.addService("package", m);
|
||||||
|
final PackageManagerNative pmn = m.new PackageManagerNative();
|
||||||
|
ServiceManager.addService("package_native", pmn);
|
||||||
|
return m;
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
然后这里调用了`PackageManagerService`的构造函数，继续查看构造函数代码。
|
||||||
|
|
||||||
|
```java
|
||||||
|
public PackageManagerService(Injector injector, boolean onlyCore, boolean factoryTest,
|
||||||
|
final String buildFingerprint, final boolean isEngBuild,
|
||||||
|
final boolean isUserDebugBuild, final int sdkVersion, final String incrementalVersion) {
|
||||||
|
...
|
||||||
|
synchronized (mInstallLock) {
|
||||||
|
// writer
|
||||||
|
synchronized (mLock) {
|
||||||
|
...
|
||||||
|
// 遍历系统应用程序目录列表
|
||||||
|
for (int i = mDirsToScanAsSystem.size() - 1; i >= 0; i--) {
|
||||||
|
final ScanPartition partition = mDirsToScanAsSystem.get(i);
|
||||||
|
if (partition.getOverlayFolder() == null) {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
scanDirTracedLI(partition.getOverlayFolder(), systemParseFlags,
|
||||||
|
systemScanFlags | partition.scanFlag, 0,
|
||||||
|
packageParser, executorService);
|
||||||
|
}
|
||||||
|
|
||||||
|
scanDirTracedLI(frameworkDir, systemParseFlags,
|
||||||
|
systemScanFlags | SCAN_NO_DEX | SCAN_AS_PRIVILEGED, 0,
|
||||||
|
packageParser, executorService);
|
||||||
|
...
|
||||||
|
|
||||||
|
} // synchronized (mLock)
|
||||||
|
} // synchronized (mInstallLock)
|
||||||
|
// CHECKSTYLE:ON IndentationCheck
|
||||||
|
...
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
`mDirsToScanAsSystem`是`PackageManagerService`类中的一个成员变量，用于存储系统应用程序目录列表。
|
||||||
|
|
||||||
|
系统应用程序存储在多个目录中，例如`/system/app、/system/priv-app`等。当系统启动时，`PackageManagerService`类会扫描这些目录以查找系统应用程序，并将其添加到应用程序列表中。这个列表中的每个元素都是一个File对象，表示一个系统应用程序目录。
|
||||||
|
|
||||||
|
当系统启动时，`PackageManagerService`会遍历`mDirsToScanAsSystem`列表并扫描其中的所有目录以查找系统应用程序。如果发现新的应用程序，则将其添加到应用程序列表中；如果发现已删除或升级的应用程序，则将其添加到`possiblyDeletedUpdatedSystemApps`列表中进行后续处理。下面看看`scanDirTracedLI`方法的实现。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private void scanDirTracedLI(File scanDir, final int parseFlags, int scanFlags,
|
||||||
|
long currentTime, PackageParser2 packageParser, ExecutorService executorService) {
|
||||||
|
Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "scanDir [" + scanDir.getAbsolutePath() + "]");
|
||||||
|
try {
|
||||||
|
scanDirLI(scanDir, parseFlags, scanFlags, currentTime, packageParser, executorService);
|
||||||
|
} finally {
|
||||||
|
Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private void scanDirLI(File scanDir, int parseFlags, int scanFlags, long currentTime,
|
||||||
|
PackageParser2 packageParser, ExecutorService executorService) {
|
||||||
|
final File[] files = scanDir.listFiles();
|
||||||
|
if (ArrayUtils.isEmpty(files)) {
|
||||||
|
Log.d(TAG, "No files in app dir " + scanDir);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (DEBUG_PACKAGE_SCANNING) {
|
||||||
|
Log.d(TAG, "Scanning app dir " + scanDir + " scanFlags=" + scanFlags
|
||||||
|
+ " flags=0x" + Integer.toHexString(parseFlags));
|
||||||
|
}
|
||||||
|
|
||||||
|
ParallelPackageParser parallelPackageParser =
|
||||||
|
new ParallelPackageParser(packageParser, executorService);
|
||||||
|
|
||||||
|
// Submit files for parsing in parallel
|
||||||
|
int fileCount = 0;
|
||||||
|
// 遍历所有文件
|
||||||
|
for (File file : files) {
|
||||||
|
final boolean isPackage = (isApkFile(file) || file.isDirectory())
|
||||||
|
&& !PackageInstallerService.isStageName(file.getName());
|
||||||
|
if (!isPackage) {
|
||||||
|
// Ignore entries which are not packages
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
// 使用parallelPackageParser.submit()方法异步地将其提交给PackageParser类来解析
|
||||||
|
parallelPackageParser.submit(file, parseFlags);
|
||||||
|
fileCount++;
|
||||||
|
}
|
||||||
|
...
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
以上代码可以看到`scanDirLI`方法主要是遍历所有文件筛选是Apk文件，或者是一个目录，`isStageName`方法是判断当前文件是否为分阶段安装的数据，`parallelPackageParser.submit()`方法异步地将其提交给`PackageParser`类来解析。跟踪查看`submit`。
|
||||||
|
|
||||||
|
```java
|
||||||
|
public void submit(File scanFile, int parseFlags) {
|
||||||
|
mExecutorService.submit(() -> {
|
||||||
|
ParseResult pr = new ParseResult();
|
||||||
|
Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "parallel parsePackage [" + scanFile + "]");
|
||||||
|
try {
|
||||||
|
pr.scanFile = scanFile;
|
||||||
|
// 解析应用程序包
|
||||||
|
pr.parsedPackage = parsePackage(scanFile, parseFlags);
|
||||||
|
} catch (Throwable e) {
|
||||||
|
pr.throwable = e;
|
||||||
|
} finally {
|
||||||
|
Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
// 返回数据
|
||||||
|
mQueue.put(pr);
|
||||||
|
} catch (InterruptedException e) {
|
||||||
|
Thread.currentThread().interrupt();
|
||||||
|
// Propagate result to callers of take().
|
||||||
|
// This is helpful to prevent main thread from getting stuck waiting on
|
||||||
|
// ParallelPackageParser to finish in case of interruption
|
||||||
|
mInterruptedInThread = Thread.currentThread().getName();
|
||||||
|
}
|
||||||
|
});
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
继续跟踪`parsePackage`是如何解析的
|
||||||
|
|
||||||
|
```java
|
||||||
|
protected ParsedPackage parsePackage(File scanFile, int parseFlags)
|
||||||
|
throws PackageParser.PackageParserException {
|
||||||
|
return mPackageParser.parsePackage(scanFile, parseFlags, true);
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
这里需要留意`mPackageParser`的类型是`PackageParser2`，而在AOSP10中，它的类型是`PackageParser`。继续查看`parsePackage`方法的实现。
|
||||||
|
|
||||||
|
```java
|
||||||
|
public ParsedPackage parsePackage(File packageFile, int flags, boolean useCaches)
|
||||||
|
throws PackageParserException {
|
||||||
|
// 尝试从缓存中找解析结果
|
||||||
|
if (useCaches && mCacher != null) {
|
||||||
|
ParsedPackage parsed = mCacher.getCachedResult(packageFile, flags);
|
||||||
|
if (parsed != null) {
|
||||||
|
return parsed;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
long parseTime = LOG_PARSE_TIMINGS ? SystemClock.uptimeMillis() : 0;
|
||||||
|
ParseInput input = mSharedResult.get().reset();
|
||||||
|
// 解析
|
||||||
|
ParseResult<ParsingPackage> result = parsingUtils.parsePackage(input, packageFile, flags);
|
||||||
|
if (result.isError()) {
|
||||||
|
throw new PackageParserException(result.getErrorCode(), result.getErrorMessage(),
|
||||||
|
result.getException());
|
||||||
|
}
|
||||||
|
...
|
||||||
|
return parsed;
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
继续跟踪`parsingUtils.parsePackage`的实现。
|
||||||
|
|
||||||
|
```java
|
||||||
|
public ParseResult<ParsingPackage> parsePackage(ParseInput input, File packageFile,
|
||||||
|
int flags)
|
||||||
|
throws PackageParserException {
|
||||||
|
if (packageFile.isDirectory()) {
|
||||||
|
return parseClusterPackage(input, packageFile, flags);
|
||||||
|
} else {
|
||||||
|
return parseMonolithicPackage(input, packageFile, flags);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
如果是一个目录，则说明这是一个集群版本`（cluster package）`的应用程序包，可能由多个应用程序组成。在这种情况下，它调用`parseClusterPackage`方法对应用程序包进行解析，并返回解析结果。
|
||||||
|
|
||||||
|
`parseClusterPackage`方法会遍历该目录下的所有文件，解析其中的每个应用程序，并将它们打包成一个`PackageParser.Package`集合返回。每个`PackageParser.Package`对象表示单独的一个应用程序。
|
||||||
|
|
||||||
|
如果`packageFile`不是一个目录，则说明这是一个单体版本`（monolithic package）`的应用程序包，只包含一个应用程序。在这种情况下，它调用`parseMonolithicPackage`方法对应用程序包进行解析，并返回解析结果。
|
||||||
|
|
||||||
|
`parseMonolithicPackage`方法会读取应用程序包的内容，并解析其中的`AndroidManifest.xml`文件和资源文件等信息，然后创建一个`PackageParser.Package`对象来表示整个应用程序，并返回该对象作为解析结果。
|
||||||
|
|
||||||
|
所以我们跟踪一条路线即可，接下来查看`parseMonolithicPackage`的实现代码。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private ParseResult<ParsingPackage> parseMonolithicPackage(ParseInput input, File apkFile,
|
||||||
|
int flags) throws PackageParserException {
|
||||||
|
...
|
||||||
|
try {
|
||||||
|
// 解析应用程序
|
||||||
|
final ParseResult<ParsingPackage> result = parseBaseApk(input,
|
||||||
|
apkFile,
|
||||||
|
apkFile.getCanonicalPath(),
|
||||||
|
assetLoader, flags);
|
||||||
|
if (result.isError()) {
|
||||||
|
return input.error(result);
|
||||||
|
}
|
||||||
|
|
||||||
|
return input.success(result.getResult()
|
||||||
|
.setUse32BitAbi(lite.isUse32bitAbi()));
|
||||||
|
} catch (IOException e) {
|
||||||
|
return input.error(INSTALL_PARSE_FAILED_UNEXPECTED_EXCEPTION,
|
||||||
|
"Failed to get path: " + apkFile, e);
|
||||||
|
} finally {
|
||||||
|
IoUtils.closeQuietly(assetLoader);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
继续查看`parseBaseApk`的实现代码。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private ParseResult<ParsingPackage> parseBaseApk(ParseInput input, File apkFile,
|
||||||
|
String codePath, SplitAssetLoader assetLoader, int flags)
|
||||||
|
throws PackageParserException {
|
||||||
|
final String apkPath = apkFile.getAbsolutePath();
|
||||||
|
...
|
||||||
|
// 读取AndroidMannifest.xml文件
|
||||||
|
try (XmlResourceParser parser = assets.openXmlResourceParser(cookie,
|
||||||
|
ANDROID_MANIFEST_FILENAME)) {
|
||||||
|
final Resources res = new Resources(assets, mDisplayMetrics, null);
|
||||||
|
// 调用另一个重载进行解析
|
||||||
|
ParseResult<ParsingPackage> result = parseBaseApk(input, apkPath, codePath, res,
|
||||||
|
parser, flags);
|
||||||
|
...
|
||||||
|
return input.success(pkg);
|
||||||
|
} catch (Exception e) {
|
||||||
|
return input.error(INSTALL_PARSE_FAILED_UNEXPECTED_EXCEPTION,
|
||||||
|
"Failed to read manifest from " + apkPath, e);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
在这里看到读取`AndroidMannifest.xml`配置文件了，随后调用另一个重载进行解析。代码如下。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private ParseResult<ParsingPackage> parseBaseApk(ParseInput input, String apkPath,
|
||||||
|
String codePath, Resources res, XmlResourceParser parser, int flags)
|
||||||
|
throws XmlPullParserException, IOException {
|
||||||
|
...
|
||||||
|
final TypedArray manifestArray = res.obtainAttributes(parser, R.styleable.AndroidManifest);
|
||||||
|
try {
|
||||||
|
final boolean isCoreApp =
|
||||||
|
parser.getAttributeBooleanValue(null, "coreApp", false);
|
||||||
|
final ParsingPackage pkg = mCallback.startParsingPackage(
|
||||||
|
pkgName, apkPath, codePath, manifestArray, isCoreApp);
|
||||||
|
// 解析Apk文件中xml的各种标记
|
||||||
|
final ParseResult<ParsingPackage> result =
|
||||||
|
parseBaseApkTags(input, pkg, manifestArray, res, parser, flags);
|
||||||
|
if (result.isError()) {
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
return input.success(pkg);
|
||||||
|
} finally {
|
||||||
|
manifestArray.recycle();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
继续查看`parseBaseApkTags`的实现代码。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private ParseResult<ParsingPackage> parseBaseApkTags(ParseInput input, ParsingPackage pkg,
|
||||||
|
TypedArray sa, Resources res, XmlResourceParser parser, int flags)
|
||||||
|
throws XmlPullParserException, IOException {
|
||||||
|
...
|
||||||
|
while ((type = parser.next()) != XmlPullParser.END_DOCUMENT
|
||||||
|
&& (type != XmlPullParser.END_TAG
|
||||||
|
|| parser.getDepth() > depth)) {
|
||||||
|
...
|
||||||
|
// <application> has special logic, so it's handled outside the general method
|
||||||
|
if (TAG_APPLICATION.equals(tagName)) {
|
||||||
|
if (foundApp) {
|
||||||
|
...
|
||||||
|
} else {
|
||||||
|
foundApp = true;
|
||||||
|
result = parseBaseApplication(input, pkg, res, parser, flags);
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
result = parseBaseApkTag(tagName, input, pkg, res, parser, flags);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (result.isError()) {
|
||||||
|
return input.error(result);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
...
|
||||||
|
return input.success(pkg);
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
检查`tagName`是否为`<application>`标记。如果是`<application>`标记，则表示当前正在解析应用程序包的主要组件，在该标记中会定义应用程序的所有组件、权限等信息。如果没有发现`<application>`标记，则继续递归调用处理其他标记。所以接下来查看`parseBaseApplication`方法的实现。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private ParseResult<ParsingPackage> parseBaseApplication(ParseInput input,
|
||||||
|
ParsingPackage pkg, Resources res, XmlResourceParser parser, int flags)
|
||||||
|
throws XmlPullParserException, IOException {
|
||||||
|
final String pkgName = pkg.getPackageName();
|
||||||
|
int targetSdk = pkg.getTargetSdkVersion();
|
||||||
|
|
||||||
|
TypedArray sa = res.obtainAttributes(parser, R.styleable.AndroidManifestApplication);
|
||||||
|
try {
|
||||||
|
...
|
||||||
|
// 解析应用程序包中基本APK文件的标志
|
||||||
|
parseBaseAppBasicFlags(pkg, sa);
|
||||||
|
...
|
||||||
|
// 根据xml配置，对pkg的值做相应的修改
|
||||||
|
if (sa.getBoolean(R.styleable.AndroidManifestApplication_persistent, false)) {
|
||||||
|
// Check if persistence is based on a feature being present
|
||||||
|
final String requiredFeature = sa.getNonResourceString(R.styleable
|
||||||
|
.AndroidManifestApplication_persistentWhenFeatureAvailable);
|
||||||
|
pkg.setPersistent(requiredFeature == null || mCallback.hasFeature(requiredFeature));
|
||||||
|
}
|
||||||
|
|
||||||
|
if (sa.hasValueOrEmpty(R.styleable.AndroidManifestApplication_resizeableActivity)) {
|
||||||
|
pkg.setResizeableActivity(sa.getBoolean(
|
||||||
|
R.styleable.AndroidManifestApplication_resizeableActivity, true));
|
||||||
|
} else {
|
||||||
|
pkg.setResizeableActivityViaSdkVersion(
|
||||||
|
targetSdk >= Build.VERSION_CODES.N);
|
||||||
|
}
|
||||||
|
...
|
||||||
|
|
||||||
|
} finally {
|
||||||
|
sa.recycle();
|
||||||
|
}
|
||||||
|
...
|
||||||
|
// 根据xml中的tag进行对应的处理
|
||||||
|
while ((type = parser.next()) != XmlPullParser.END_DOCUMENT
|
||||||
|
&& (type != XmlPullParser.END_TAG
|
||||||
|
|| parser.getDepth() > depth)) {
|
||||||
|
if (type != XmlPullParser.START_TAG) {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
final ParseResult result;
|
||||||
|
String tagName = parser.getName();
|
||||||
|
boolean isActivity = false;
|
||||||
|
switch (tagName) {
|
||||||
|
case "activity":
|
||||||
|
isActivity = true;
|
||||||
|
// fall-through
|
||||||
|
case "receiver":
|
||||||
|
ParseResult<ParsedActivity> activityResult =
|
||||||
|
ParsedActivityUtils.parseActivityOrReceiver(mSeparateProcesses, pkg,
|
||||||
|
res, parser, flags, sUseRoundIcon, input);
|
||||||
|
|
||||||
|
if (activityResult.isSuccess()) {
|
||||||
|
ParsedActivity activity = activityResult.getResult();
|
||||||
|
if (isActivity) {
|
||||||
|
hasActivityOrder |= (activity.getOrder() != 0);
|
||||||
|
pkg.addActivity(activity);
|
||||||
|
} else {
|
||||||
|
hasReceiverOrder |= (activity.getOrder() != 0);
|
||||||
|
pkg.addReceiver(activity);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
result = activityResult;
|
||||||
|
break;
|
||||||
|
case "service":
|
||||||
|
ParseResult<ParsedService> serviceResult =
|
||||||
|
ParsedServiceUtils.parseService(mSeparateProcesses, pkg, res, parser,
|
||||||
|
flags, sUseRoundIcon, input);
|
||||||
|
if (serviceResult.isSuccess()) {
|
||||||
|
ParsedService service = serviceResult.getResult();
|
||||||
|
hasServiceOrder |= (service.getOrder() != 0);
|
||||||
|
pkg.addService(service);
|
||||||
|
}
|
||||||
|
|
||||||
|
result = serviceResult;
|
||||||
|
break;
|
||||||
|
case "provider":
|
||||||
|
ParseResult<ParsedProvider> providerResult =
|
||||||
|
ParsedProviderUtils.parseProvider(mSeparateProcesses, pkg, res, parser,
|
||||||
|
flags, sUseRoundIcon, input);
|
||||||
|
if (providerResult.isSuccess()) {
|
||||||
|
pkg.addProvider(providerResult.getResult());
|
||||||
|
}
|
||||||
|
|
||||||
|
result = providerResult;
|
||||||
|
break;
|
||||||
|
case "activity-alias":
|
||||||
|
activityResult = ParsedActivityUtils.parseActivityAlias(pkg, res,
|
||||||
|
parser, sUseRoundIcon, input);
|
||||||
|
if (activityResult.isSuccess()) {
|
||||||
|
ParsedActivity activity = activityResult.getResult();
|
||||||
|
hasActivityOrder |= (activity.getOrder() != 0);
|
||||||
|
pkg.addActivity(activity);
|
||||||
|
}
|
||||||
|
|
||||||
|
result = activityResult;
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
result = parseBaseAppChildTag(input, tagName, pkg, res, parser, flags);
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (result.isError()) {
|
||||||
|
return input.error(result);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
...
|
||||||
|
return input.success(pkg);
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
基本大多数的解析都在这里实现了，最后看看基本APK标志是如何解析处理的。`parseBaseAppBasicFlags`的实现如下。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private void parseBaseAppBasicFlags(ParsingPackage pkg, TypedArray sa) {
|
||||||
|
int targetSdk = pkg.getTargetSdkVersion();
|
||||||
|
//@formatter:off
|
||||||
|
// CHECKSTYLE:off
|
||||||
|
pkg
|
||||||
|
// Default true
|
||||||
|
.setAllowBackup(bool(true, R.styleable.AndroidManifestApplication_allowBackup, sa))
|
||||||
|
.setAllowClearUserData(bool(true, R.styleable.AndroidManifestApplication_allowClearUserData, sa))
|
||||||
|
.setAllowClearUserDataOnFailedRestore(bool(true, R.styleable.AndroidManifestApplication_allowClearUserDataOnFailedRestore, sa))
|
||||||
|
.setAllowNativeHeapPointerTagging(bool(true, R.styleable.AndroidManifestApplication_allowNativeHeapPointerTagging, sa))
|
||||||
|
.setEnabled(bool(true, R.styleable.AndroidManifestApplication_enabled, sa))
|
||||||
|
.setExtractNativeLibs(bool(true, R.styleable.AndroidManifestApplication_extractNativeLibs, sa))
|
||||||
|
.setHasCode(bool(true, R.styleable.AndroidManifestApplication_hasCode, sa))
|
||||||
|
// Default false
|
||||||
|
.setAllowTaskReparenting(bool(false, R.styleable.AndroidManifestApplication_allowTaskReparenting, sa))
|
||||||
|
.setCantSaveState(bool(false, R.styleable.AndroidManifestApplication_cantSaveState, sa))
|
||||||
|
.setCrossProfile(bool(false, R.styleable.AndroidManifestApplication_crossProfile, sa))
|
||||||
|
.setDebuggable(bool(false, R.styleable.AndroidManifestApplication_debuggable, sa))
|
||||||
|
.setDefaultToDeviceProtectedStorage(bool(false, R.styleable.AndroidManifestApplication_defaultToDeviceProtectedStorage, sa))
|
||||||
|
.setDirectBootAware(bool(false, R.styleable.AndroidManifestApplication_directBootAware, sa))
|
||||||
|
.setForceQueryable(bool(false, R.styleable.AndroidManifestApplication_forceQueryable, sa))
|
||||||
|
.setGame(bool(false, R.styleable.AndroidManifestApplication_isGame, sa))
|
||||||
|
.setHasFragileUserData(bool(false, R.styleable.AndroidManifestApplication_hasFragileUserData, sa))
|
||||||
|
.setLargeHeap(bool(false, R.styleable.AndroidManifestApplication_largeHeap, sa))
|
||||||
|
.setMultiArch(bool(false, R.styleable.AndroidManifestApplication_multiArch, sa))
|
||||||
|
.setPreserveLegacyExternalStorage(bool(false, R.styleable.AndroidManifestApplication_preserveLegacyExternalStorage, sa))
|
||||||
|
.setRequiredForAllUsers(bool(false, R.styleable.AndroidManifestApplication_requiredForAllUsers, sa))
|
||||||
|
.setSupportsRtl(bool(false, R.styleable.AndroidManifestApplication_supportsRtl, sa))
|
||||||
|
.setTestOnly(bool(false, R.styleable.AndroidManifestApplication_testOnly, sa))
|
||||||
|
.setUseEmbeddedDex(bool(false, R.styleable.AndroidManifestApplication_useEmbeddedDex, sa))
|
||||||
|
.setUsesNonSdkApi(bool(false, R.styleable.AndroidManifestApplication_usesNonSdkApi, sa))
|
||||||
|
.setVmSafeMode(bool(false, R.styleable.AndroidManifestApplication_vmSafeMode, sa))
|
||||||
|
.setAutoRevokePermissions(anInt(R.styleable.AndroidManifestApplication_autoRevokePermissions, sa))
|
||||||
|
.setAttributionsAreUserVisible(bool(false, R.styleable.AndroidManifestApplication_attributionsAreUserVisible, sa))
|
||||||
|
// targetSdkVersion gated
|
||||||
|
.setAllowAudioPlaybackCapture(bool(targetSdk >= Build.VERSION_CODES.Q, R.styleable.AndroidManifestApplication_allowAudioPlaybackCapture, sa))
|
||||||
|
.setBaseHardwareAccelerated(bool(targetSdk >= Build.VERSION_CODES.ICE_CREAM_SANDWICH, R.styleable.AndroidManifestApplication_hardwareAccelerated, sa))
|
||||||
|
.setRequestLegacyExternalStorage(bool(targetSdk < Build.VERSION_CODES.Q, R.styleable.AndroidManifestApplication_requestLegacyExternalStorage, sa))
|
||||||
|
.setUsesCleartextTraffic(bool(targetSdk < Build.VERSION_CODES.P, R.styleable.AndroidManifestApplication_usesCleartextTraffic, sa))
|
||||||
|
// Ints Default 0
|
||||||
|
.setUiOptions(anInt(R.styleable.AndroidManifestApplication_uiOptions, sa))
|
||||||
|
// Ints
|
||||||
|
.setCategory(anInt(ApplicationInfo.CATEGORY_UNDEFINED, R.styleable.AndroidManifestApplication_appCategory, sa))
|
||||||
|
// Floats Default 0f
|
||||||
|
.setMaxAspectRatio(aFloat(R.styleable.AndroidManifestApplication_maxAspectRatio, sa))
|
||||||
|
.setMinAspectRatio(aFloat(R.styleable.AndroidManifestApplication_minAspectRatio, sa))
|
||||||
|
// Resource ID
|
||||||
|
.setBanner(resId(R.styleable.AndroidManifestApplication_banner, sa))
|
||||||
|
.setDescriptionRes(resId(R.styleable.AndroidManifestApplication_description, sa))
|
||||||
|
.setIconRes(resId(R.styleable.AndroidManifestApplication_icon, sa))
|
||||||
|
.setLogo(resId(R.styleable.AndroidManifestApplication_logo, sa))
|
||||||
|
.setNetworkSecurityConfigRes(resId(R.styleable.AndroidManifestApplication_networkSecurityConfig, sa))
|
||||||
|
.setRoundIconRes(resId(R.styleable.AndroidManifestApplication_roundIcon, sa))
|
||||||
|
.setTheme(resId(R.styleable.AndroidManifestApplication_theme, sa))
|
||||||
|
.setDataExtractionRules(
|
||||||
|
resId(R.styleable.AndroidManifestApplication_dataExtractionRules, sa))
|
||||||
|
// Strings
|
||||||
|
.setClassLoaderName(string(R.styleable.AndroidManifestApplication_classLoader, sa))
|
||||||
|
.setRequiredAccountType(string(R.styleable.AndroidManifestApplication_requiredAccountType, sa))
|
||||||
|
.setRestrictedAccountType(string(R.styleable.AndroidManifestApplication_restrictedAccountType, sa))
|
||||||
|
.setZygotePreloadName(string(R.styleable.AndroidManifestApplication_zygotePreloadName, sa))
|
||||||
|
// Non-Config String
|
||||||
|
.setPermission(nonConfigString(0, R.styleable.AndroidManifestApplication_permission, sa));
|
||||||
|
// CHECKSTYLE:on
|
||||||
|
//@formatter:on
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
相信你坚持跟踪到这里后，对于权限处理已经豁然开朗了，实际上总结就是，读取并解析xml文件，然后根据xml中配置的节点进行相应的处理，最终这些处理都是将值对应的设置给了`ParsingPackage`类型的对象`pkg`中。最终外层就通过拿到pkg对象，知道应该如何控制它的权限了。
|
||||||
|
|
||||||
|
### 6.5.3 修改APP默认权限
|
||||||
|
|
||||||
|
经过对源码的阅读，熟悉了APK对xml文件的解析流程后，想要为APP添加一个默认的权限就非常简单了。下面将为ROM添加一个联网权限：android.permission.INTERNET作为例子。只需要在`parseBaseApplication`函数中为`pkg`对象添加权限即可。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private ParseResult<ParsingPackage> parseBaseApplication(ParseInput input,
|
||||||
|
ParsingPackage pkg, Resources res, XmlResourceParser parser, int flags)
|
||||||
|
throws XmlPullParserException, IOException {
|
||||||
|
...
|
||||||
|
// add 添加联网权限
|
||||||
|
List<String> requestedPermissions = pkg.getRequestedPermissions();
|
||||||
|
String addPermissionName = "android.permission.INTERNET";
|
||||||
|
if (!requestedPermissions.contains(addPermissionName)){
|
||||||
|
|
||||||
|
pkg.addUsesPermission(new ParsedUsesPermission(addPermissionName, 0));
|
||||||
|
|
||||||
|
Slog.w("mikrom","parseBaseApplication add android.permission.INTERNET " );
|
||||||
|
}
|
||||||
|
// add end
|
||||||
|
boolean hasActivityOrder = false;
|
||||||
|
boolean hasReceiverOrder = false;
|
||||||
|
boolean hasServiceOrder = false;
|
||||||
|
final int depth = parser.getDepth();
|
||||||
|
int type;
|
||||||
|
while ((type = parser.next()) != XmlPullParser.END_DOCUMENT
|
||||||
|
&& (type != XmlPullParser.END_TAG
|
||||||
|
|| parser.getDepth() > depth)) {
|
||||||
|
...
|
||||||
|
}
|
||||||
|
...
|
||||||
|
return input.success(pkg);
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
理解源码中的实现原理后，有各种方式都能完成修改APP权限，由此可见，阅读跟踪源码观察实现原理是非常重要的手段。
|
||||||
|
|
||||||
|
## 6.6 进程注入
|
||||||
|
|
||||||
|
在上一小节中，通过对加载解析xml文件的流程进行分析，最终找到了合适的时机对默认权限进行修改，而在第三章的学习中，详细介绍了一个APP运行起来的流程，当对源码的运行流程有了足够的了解后，同样可以在其中找到合适的时机对普通用户的APP进行一些定制化的处理，例如对该进程进行注入，这一小节将介绍如何为用户进程注入jar包。
|
||||||
|
|
||||||
|
### 6.6.1 注入时机的选择
|
||||||
|
|
||||||
|
`ActivityThread`负责管理应用程序的主线程以及所有活动`Activity`的生命周期。通过`MessageQueue`和`Handler`机制与其他线程进行通信，处理来自系统和应用程序的各种消息。
|
||||||
|
|
||||||
|
在应用程序启动时，`ActivityThread`会被创建并开始运行，它会负责创建应用程序的主线程，并调用`Application`对象的`onCreate`方法初始化应用程序。同时，`ActivityThread`还会负责加载和启动应用程序中的第一个`Activity`，即启动界面`Splash Screen`或者主界面`Main Activity`，并处理`Activity`的生命周期事件，如`onCreate()、onResume()、onPause()`等。
|
||||||
|
|
||||||
|
所以可以在`ActivityThread`的调用中寻找合适的时机，那么什么叫合适的时机呢，可以将注入的需求进行整理，然后所有符合条件的调用时机都可以算作合适的时机。
|
||||||
|
|
||||||
|
注入时机尽量在一个仅调用一次的函数中，避免多次注入出现不可预料的异常情况。
|
||||||
|
|
||||||
|
注入时机分为早期和晚期，早期表示在一个调用链尽量靠前时机，这时进程的业务代码还没开始执行，就完成注入代码了，但是过早的时机会导致有些需要用到的数据还未准备就绪，例如`Application`未完成创建。如果你注入的代码无需涉及这些数据，那么可以选择尽量早的时机。例如在Zygote进程孵化的时机也是可以的。
|
||||||
|
|
||||||
|
第三章中介绍到的`handleBindApplication`就是比较合适的注入时机，主线程中通过调用这个方法来绑定应用程序，在该方法中创建了`Application`对象，并且调用了`attachBaseContext`方法和`onCreate`方法进行初始化。可以选择在创建`Application`对象后，就注入自己的jar包和so动态库。
|
||||||
|
|
||||||
|
### 6.6.2 注入jar包
|
||||||
|
|
||||||
|
在`handleBindApplication`方法中加一段注入jar包的方式和正常开发的APP中注入jar包并没有什么区别。在这个时机中是调用的onCreate方法，所以完成可以想象成是在onCreate中写一段注入代码。而onCreate中注入jar包在第五章，内置jar包中有详细介绍过。下面贴上当时的注入代码。
|
||||||
|
|
||||||
|
```java
|
||||||
|
protected void onCreate(Bundle savedInstanceState) {
|
||||||
|
super.onCreate(savedInstanceState);
|
||||||
|
setContentView(R.layout.activity_main);
|
||||||
|
// 使用PathClassLoader加载jar文件
|
||||||
|
String jarPath = "/system/framework/kjar.jar";
|
||||||
|
ClassLoader systemClassLoader=ClassLoader.getSystemClassLoader();
|
||||||
|
String javaPath= System.getProperty("java.library.path");
|
||||||
|
PathClassLoader pathClassLoader=new PathClassLoader(jarPath,javaPath,systemClassLoader);
|
||||||
|
Class<?> clazz1 = null;
|
||||||
|
try {
|
||||||
|
// 通过反射调用函数
|
||||||
|
clazz1 = pathClassLoader.loadClass("cn.mik.myjar.MyCommon");
|
||||||
|
Method method = clazz1.getDeclaredMethod("getMyJarVer");
|
||||||
|
Object result = method.invoke(null);
|
||||||
|
Log.i("MainActivity","getMyJarVer:"+result);
|
||||||
|
|
||||||
|
} catch (ClassNotFoundException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (InvocationTargetException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (NoSuchMethodException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (IllegalAccessException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
唯一的区别仅仅在于，需要将注入的代码封装成一个方法，然后在`handleBindApplication`方法中，`Application`函数执行后进行调用。下面简单调整测试使用的jar包添加一个测试方法`injectJar`，代码如下。
|
||||||
|
|
||||||
|
```java
|
||||||
|
public class MyCommon {
|
||||||
|
public static String getMyJarVer(){
|
||||||
|
return "v1.0";
|
||||||
|
}
|
||||||
|
public static int add(int a,int b){
|
||||||
|
return a+b;
|
||||||
|
}
|
||||||
|
public static void injectJar(Application app){
|
||||||
|
Toast.makeText(app, "Hello, inject jar!", Toast.LENGTH_SHORT);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
重新将测试的jar包编译后，解压并使用dx将classes.dex文件转换为jar包后内置到系统中。
|
||||||
|
|
||||||
|
```
|
||||||
|
unzip app-debug.apk -d app-debug
|
||||||
|
|
||||||
|
dx --dex --min-sdk-version=26 --output=./kjar.jar ./app-debug/classes.dex
|
||||||
|
|
||||||
|
cp ./kjar.jar ~/android_src/aosp12/framewoorks/native/myjar/
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
最后添加注入代码如下。
|
||||||
|
|
||||||
|
```java
|
||||||
|
private void InjectJar(Application app){
|
||||||
|
String jarPath = "/system/framework/kjar.jar";
|
||||||
|
ClassLoader systemClassLoader=ClassLoader.getSystemClassLoader();
|
||||||
|
String javaPath= System.getProperty("java.library.path");
|
||||||
|
PathClassLoader pathClassLoader=new PathClassLoader(jarPath,javaPath,systemClassLoader);
|
||||||
|
Class<?> clazz1 = null;
|
||||||
|
try {
|
||||||
|
// 通过反射调用函数
|
||||||
|
clazz1 = pathClassLoader.loadClass("cn.mik.myjar.MyCommon");
|
||||||
|
Method method = clazz1.getDeclaredMethod("injectJar",Application.class);
|
||||||
|
Object result = method.invoke(null);
|
||||||
|
|
||||||
|
} catch (ClassNotFoundException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (InvocationTargetException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (NoSuchMethodException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (IllegalAccessException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private void handleBindApplication(AppBindData data) {
|
||||||
|
...
|
||||||
|
app = data.info.makeApplication(data.restrictedBackupMode, null);
|
||||||
|
// Propagate autofill compat state
|
||||||
|
app.setAutofillOptions(data.autofillOptions);
|
||||||
|
// Propagate Content Capture options
|
||||||
|
app.setContentCaptureOptions(data.contentCaptureOptions);
|
||||||
|
sendMessage(H.SET_CONTENT_CAPTURE_OPTIONS_CALLBACK, data.appInfo.packageName);
|
||||||
|
mInitialApplication = app;
|
||||||
|
// 注入
|
||||||
|
InjectJar(app)
|
||||||
|
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
准备就绪，编译并刷入手机中，安装任意app后，打开时都会弹出消息提示框。
|
||||||
|
|
||||||
|
注入so动态库同样和内置so的步骤没有任何区别，更简单的办法是通过在jar包中直接加载动态库即可，无需另外添加代码。
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user