Android在JNI层反射替换当前app的ClassLoader

最新推荐文章于 2024-07-09 17:30:58 发布

原创最新推荐文章于 2024-07-09 17:30:58 发布 · 6.4k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#c++ #jni #classloader

C/C++ 同时被 2 个专栏收录

80 篇文章

订阅专栏

Android

16 篇文章

订阅专栏

这篇博客探讨了如何在Android中利用JNI技术结合反射，深入到JNI层替换当前应用的ClassLoader。通过找到并修改ContextImpl的mPackageInfo对象中的mClassLoader字段，实现了对系统ClassLoader的替换，展示了反射的强大功能。

值得一提的是，反射确实是个很强大很灵活的东西, 借助哈希、红黑树等高度优化的数据结构让反射的代价降到了极低，通过反射+JNI, 可以做到几乎任何你想做的东西。

JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM *jvm, void *unused)
{
	JNIEnv *env;
	jvm->GetEnv(reinterpret_cast<void **>(&env), JNI_VERSION_1_6);

	jclass clsContextImpl        = env->FindClass("android/app/ContextImpl");
	jfieldID mPackageInfoFieldID = env->GetFieldID(clsContextImpl, "mPackageInfo", "Landroid/app/LoadedApk;");
	jobject mPackageInfo         = env->GetObjectField(ActivityThread::getSystemContext(env), mPackageInfoFieldID);
	jclass mPackageInfoClass     = env->GetObjectClass(mPackageInfo);
	jfieldID mClassLoaderFieldID = env->GetFieldID(mPackageInfoClass, "mClassLoader", "Ljava/lang/ClassLoader;");
	jobject mClassLoader         = env->GetObjectField(mPackageInfo, mClassLoaderFieldID);
	LOGI("original loader = %p", mClassLoader);

	jclass clsSystemClassLoader  = env->FindClass("java/lang/ClassLoader$SystemClassLoader");
	jfieldID fSystemClassLoader  = env->GetStaticFieldID(clsSystemClassLoader, "loader", "Ljava/lang/ClassLoader;");
	jobject insSystemClassLoader = env->GetStaticObjectField(clsSystemClassLoader, fSystemClassLoader);
	LOGI("system loader = %p", insSystemClassLoader);

	env->SetObjectField(mPackageInfo, mClassLoaderFieldID, ...);
	env->SetStaticObjectField(clsSystemClassLoader, fSystemClassLoader, ...);
}