Xposed资料收集

继续看
initForZygote

xposed的zip下载地址在哪里？

http://dl-xda.xposed.info/framework/

SetEntryPointFromJni方法如何理解？

参考：https://blog.csdn.net/a314131070/article/details/81092526
就是这种hook的方法不是native的肯定。然后把accessflag也改一下。

ART的方法分成几类？

invoke-virtual、invoke-direct、invoke-super

参考：
https://www.cnblogs.com/larrylawrence/p/3985464.html

https://www.cnblogs.com/linwx/p/7966181.html

handleLoadPackage是在什么时候调用的？

看看下面的堆栈就知道了。是在应用启动的时候做的。看样子明显是hook住了handleBindApplication的方法啦。

05-19 01:48:49.118  3235  3235 E HotXposed: handleLoadPackage = com.tencent.androidqqmail
05-19 01:48:49.118  3235  3235 E HotXposed: java.lang.Throwable
05-19 01:48:49.118  3235  3235 E HotXposed:     at bin.xposed.Unblock163MusicClient.Main.handleLoadPackage(Main.java:17)
05-19 01:48:49.118  3235  3235 E HotXposed:     at de.robv.android.xposed.IXposedHookLoadPackage$Wrapper.handleLoadPackage(IXposedHookLoadPackage.java:34)
05-19 01:48:49.118  3235  3235 E HotXposed:     at de.robv.android.xposed.callbacks.XC_LoadPackage.call(XC_LoadPackage.java:61)
05-19 01:48:49.118  3235  3235 E HotXposed:     at de.robv.android.xposed.callbacks.XCallback.callAll(XCallback.java:106)
05-19 01:48:49.118  3235  3235 E HotXposed:     at de.robv.android.xposed.XposedInit$2.beforeHookedMethod(XposedInit.java:134)
05-19 01:48:49.118  3235  3235 E HotXposed:     at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:340)
05-19 01:48:49.118  3235  3235 E HotXposed:     at android.app.ActivityThread.handleBindApplication(<Xposed>)
05-19 01:48:49.118  3235  3235 E HotXposed:     at android.app.ActivityThread.-wrap2(ActivityThread.java)
05-19 01:48:49.118  3235  3235 E HotXposed:     at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1546)
05-19 01:48:49.118  3235  3235 E HotXposed:     at android.os.Handler.dispatchMessage(Handler.java:102)
05-19 01:48:49.118  3235  3235 E HotXposed:     at android.os.Looper.loop(Looper.java:154)
05-19 01:48:49.118  3235  3235 E HotXposed:     at android.app.ActivityThread.main(ActivityThread.java:6121)
05-19 01:48:49.118  3235  3235 E HotXposed:     at java.lang.reflect.Method.invoke(Native Method)
05-19 01:48:49.118  3235  3235 E HotXposed:     at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)
05-19 01:48:49.118  3235  3235 E HotXposed:     at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)
05-19 01:48:49.118  3235  3235 E HotXposed:     at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:107)

handleBindApplication是在哪里被hook住的呢？
在XposedInit.java类中
进而调用
XC_LoadPackage.callAll(lpparam);

XCallback的callAll方法如下。

    /** @hide */
    public static void callAll(Param param) {
        if (param.callbacks == null)
            throw new IllegalStateException("This object was not created for use with callAll");

        for (int i = 0; i < param.callbacks.length; i++) {
            try {
                ((XCallback) param.callbacks[i]).call(param);
            } catch (Throwable t) { XposedBridge.log(t); }
        }
    }

进热调用XC_LoadPackage.java的
protected void call(Param param) throws Throwable {
if (param instanceof LoadPackageParam)
handleLoadPackage((LoadPackageParam) param);
}

那initForZygote是什么时候调用的呢？
在XposedBridge的main方法调用的。
main方法又是在哪里调用呢？
在app_main.cpp的

    if (zygote) {
        runtime.start(isXposedLoaded ? XPOSED_CLASS_DOTS_ZYGOTE : "com.android.internal.os.ZygoteInit",
                startSystemServer ? "start-system-server" : "");