The dexposed framework implementation principle of the Root-free hook in Android and how to implement the thermal repair of the application

Last Update:2016-05-09 Source: Internet

Author: User

Tags system log

Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

first, PrefaceToday we look at Ali an open source framework dexposed, about this framework online has been a lot of analysis, but are explained the principle, and not very clear, here because the work of the need to study a bit, so here first explain the principle of this framework, Then in an example to see how he used, and finally used it to implement the application of the hot fix Problem. Ii. Preparation of knowledge pointsFirst of all, when explaining this framework, let's start by understanding a few points of knowledge:1, about the previous xposed frameworkWe know this framework very early on, would like to tidy up by the way this framework, but the framework of the network said a lot, but also very detailed, so do not do too much analysis, here is about his central idea and the core Principle.By following the device root, the replacement /system/bin/app_process program controls the zygote process, making the App_ The process will load Xposedbridge.jar this jar package during startup to complete hijacking of the zygote process and the Dalvik virtual machines it creates.So Here's a question, why replace the app_process program?About the App_process program online also has a lot of explanation, he is actually a program, stored in the System/bin directory, his role is to start a program, such as we know the zygote process, as well as all the app launch, App_ Process just to find the main function that needs to run the program is the entry function, and then execute, he can not only execute C + + programs, but also execute Java programs, in fact, before we have encountered a situation, is to run a Java program in Android jar, actually, That's What the app_process command started. The commands you run are also simple:App_process [java-options] Cmd-dir start-class-name [options]We can check his source code app_main.cpp: From App_process's main function (in app_main.cpp), it can be seen that app_ There are two ways to start a process: the one in init.rc, which starts Com.android.internal.os.ZygoteInit in zygote mode and changes the process name to zygote, and the other is to start COM with a non-zygote simulation . android.internal.os.RuntimeInit, and call its main method, the final execution of main will be Finishinit,finishinit is a native method, this method will call App_ The onstarted method of the process, in onstarted, will invoke the actual class to be executed: Don't want to introduce too much here, because later will talk about an Android application of the startup process, then detailed Analysis. Here we know a point is that all Android programs are launched through the app_process command, and the app_process command can also launch any Java program, such as we use the AM command, This command Java source code and Shell source code is located: Android Source Directory \frameworks\base\cmds\We can view the internal implementation of his Java source code: Specifies that there is an entry function mainAnd then look at Him. Shell source: See here first set the Classpath variable, is the path of am.jar, and then start to execute the command, the command needs to specify the specific class Name.Here we also learned how to execute a jar file in Android. So from the above we have analyzed the function of the app_process command, then we know why the xposed framework needs to replace the app_process command:first, in an Android system, the application process is hatched by the zygote process, and the zygote process is initiated by the Init process. The zygote process creates a Dalvik virtual machine instance at startup, and whenever it hatches a new application process, it copies the Dalvik virtual machine instance into the new application process, allowing each application process to have a separate Dalvik virtual machine instance. This is why Xposed chose to replace App_process. The zygote process, in addition to creating a Dalvik virtual machine instance, will load the Java Runtime library into the process and register some of the Android core Class's JNI methods to the Dalvik virtual machine instance created Earlier. Note that when an application process is hatched by the zygote process, it not only gets the Dalvik VM instance copy in the zygote process, but also shares the Java Runtime Library with Zygote. This is why you can load the Xposedbridge jar package into every Android Application. Xposedbridge has a private native (JNI) method hookmethodnative, and this method is also used in App_process. This function provides a method object that uses the Java reflection mechanism to overwrite the built-in Method. see, This is one of the reasons why the xposed framework chooses app_proess as a portal because there are two benefits to this entry:1 ", Once modified, you can modify all the apps2, the time here is the earliest, can load all thingsThe above is a simple analysis of the implementation of the xposed framework, This is the first knowledge we need to understand the Point. 2, Modify the Non-native method for the native methodThe second point we need to know is how to change a Non-native method in Android to native, and you can assign this native method to a specific execution Function.On this point of knowledge, I wrote in a previous article: Android with process injection technology to modify the MAC address returned by the systemThis article is a very detailed explanation of how we modify the system to obtain the MAC address method, the principle is simple:The system to obtain the MAC address of the method getmacaddress changed to native, and then specify Nativefunc as Dvmresolvenativemethod this function, this function is provided by the DVM. where Dvmresolvenativemethod called Dvmlookupinternalnativemethod and Lookupsharedlibmethod to find the native function registered in Jni. Dalvik finally executes the resulting Java native Function.With the code snippet above, we learned that to hook a Java function requires steps [1] Modify the properties of the method to native [2] modified method of registerssize, inssize, nativefunc, computejniarginfo [3] registernatives native function for registered target methodWe then take the system to get the MAC address method getmacaddress and one of our own functions to do a registration:{"android/net/wifi/wifiinfo", "getmacaddress", "() ljava/lang/string;", (void*) test} Then the test function here is the function we want to do, can return any value ~ ~ This knowledge point is very important, but also the core point of knowledge we are talking about TODAY. three, the principle analysisAfter analyzing the above two points of knowledge, let's take a look at the principle of the dexposed framework, first of all we have a picture to understand: see, in fact, is not very complex, mainly divided into Java layer and native layer,first, Let's analyze the Java Layer's Dexposedbridge.java class1, hookmethodnative method: This method is a native type.Parameter description:1) method objects that require hooks2) the class to which the Hook method belongs3) the slot value of the method, the meaning of this slot is the smallest unit of local variable storage in the method, and a slot can hold a data type that is less than 32 bits. when a Java program is compiled as a class file, the max_ of the Code property of the method The locals data item determines the maximum capacity that the method needs to allocate a local variable Table.4) additional information, such as the callback object for which we need to hook the method, the return type of the hook method, the parameter type and so on, see the place where the Hookmethodnative method is Called. 2, Invokesupernative and Invokeoriginalmethodnative methods These two methods are also native, and these two methods are better understood, is to execute the method of the parent method and the original method, because when we hook a method, we must decide whether to call the parent class method or the original Method. 3. Handlehookedmethod method This method is the core of the entire dexposed framework Java layer method, This method is used to replace the method we need to hook, specifically how to replace the next to the native layer Said. Then three things were done in this method:1. Perform all callback methods before the hook is required Beforemethod2. Execute the native method of hook3. Execute all callback methods after the hook is required Aftermethod This method is our core method of stealing dragon and phoenix, and here we can see that the dexposed framework also has an advantage of AOP programming, The concept of AOP is face-oriented programming, to be able to intercept or hook a method before or after what can be done, One of the core of the spring framework in Javaweb is AOP programming. second, The above analysis Dexposedbridge.java core class, The following look at the implementation of native layer Dexposed.cpp1. initnative function This initialization function mainly gets the method object corresponding to some of our methods in dexposedbridge.java, which is used Later.This method is called in the Jni_onload function, and we know that this function is called when the so file is Loaded. So it's usually done here in the initialization Operation. What else has been done in this approach? There are also dexposedinfo functions: This function mainly obtains some information of the device, in fact, his corresponding upper Java class is the Systemproperty.java class.There is also a dexposedonvmcreated function: This function does two things, one is to get the class object that needs the hook, and the other is to execute the registered JNI function:Register_com_taobao_android_dexposed_dexposedbridge The Hookmethodnative method in Dexposedbridge.java is registered Here. 2. com_taobao_android_dexposed_dexposedbridge_hookmethodnative function This function does two things:1), constructs the Dexposedhookinfo information: The structure information for the dexposedhookinfo is defined in the Dexposed.h header File. Is the message of the method that needs the Hook.2), change the method that needs the hook to native, then specify his nativefunc as the Dexposedcallhandler function 3. Dexposedcallhandler function This method first obtains the Dexposedhookinfo information we have just Constructed. Then execute the Dexposedhandlehookedmethod method This method is initialized in initnative, which is the Handlehookedmethod method of Dexposedbridge.java China in the Java layer. All right, we're done here. native layer of code, the following to Summarize:1, first in the Jni_onload function to do three things:1) Get device Information dexposedinfo2) registering the Jni method (com_taobao_android_dexposed_dexposedbridge_hookmethodnative) 3) initialization information (method object for methods in Java layer Dexposedbridge)2, and then in the Com_taobao_android_dexposed_dexposedbridge_hookmethodnative function mainly do two things:1) constructs the information passed by the Java layer into Dexposedinfo information2) set the hook method to native, and specify the Nativefunc function3, finally in the second step in the implementation of the Nativefunc function Dexposedcallhandler function mainly done two things:1) get the Dexposedinfo information just constructed2) call the Handlehookedmethod method in Java layer Dexposedbridge.javaSo we can see in the process, first through the JNI registration, from the Java world to the native world, and then in the native world, the main modification of the hook method of some information, and then call through reflection Handlehookedmethod back to the Java WORLD. four, Case Analysis1. Method of Hook systemThe above explains the implementation of the dexposed framework, the following example to see his function, here we choose the hook system log class: Here directly call the Dexposedbridge.findandhookmethod method to achieve, note here to do a device judgment, if it is 5.0+ the hook program itself Showlog method, if not on the hook system log in the D method.The last parameter can be seen, is a callback, is let us operate the hook method before and after the operation, here in the Afterhookedmethod method to display the log message in the screen textview, we run to see the effect: Here we can successfully hook off the system method. So the analysis here, need to summarize:1, xposed Framework is required root, His function is full, can hook off the system method, but also can hook off other applications of some METHODS.2, dexposed Framework is not required root, but he can only hook off in their own application process of some methods, other application process is no way to hookSo we can compare these two frameworks with each other for good. Generally do the game plug what, dexposed is not to do, and xposed can do. 2. Implement Thermal Repair functionSo the analysis here we have not finished, and we have an important point of knowledge today, is how to use the dexposed framework to implement the application of hot repair, the so-called hot repair, after the application is released, in a module problems, can be repaired online, do not need a new Version. This before actually get this fast, with dynamic loading technology can be done, each module can be made dynamically loaded, and then if the module has a problem, the online update repair module (typically dex or jar form), then since we introduced the dexposed framework, And knowing that he can hook up his own application process, then there is a thought that we can provide a module with a certain protocol, and then in this module we call some of the methods of dexposedbridge, and then hook off the problem in our application module method, So as to achieve the heat repair Function. specifically, you can see the following picture: Let's look at an example to fix the functionality of a display dialog in an app:First look at the Heat repair Project PatchexampleFor a class, fix the dialog box class: This class is simple enough, but it is important to note that each repair class must comply with the Ipatch protocol Interface.Let's compile the fix pack and copy it to the cache directory where the app needs to be repaired:ADB push patchdemo.apk/sdcard/android/data/com.taobao.dexposed/cache/Why this is the directory, below to analyze the hot fix code in the host App: see, here is the call on it, really we are in use, should be downloaded from the Internet apk, and then saved to the local load Operation.But here we don't run first, let's take a look at Patch source Code: Here is a core approach, which is the loadallcallbacks method: The Dexfile class is used here to get all the classes in the Dex file in the APK and then determine which classes implement the Ipatch Protocol. finally, the Handlepatch method is followed in the call Protocol. Implement the hot fix feature.okay, After analyzing the code, let's run the program to See: however, we encountered this error in the process of repair, in fact, this error I introduced in the previous explanation of the dynamic loading of the article, that is, our host project has the definition of the Ipatch class, the dynamic repair module also refers to the Ipatch class, so that the same class was loaded two times the Error. What we need to modify here is that the repair module does not refer to the jar already in the host module, so there is a problem here, how can we compile an APK package that does not contain the specified jar? I didn't find a good way to do this in eclipse, and finally it was the ant script that did it, just to make sure the project was compiled and not include the specified jar package in the APK. Specifically how to use the ant script to package an apk, do not know the students can see: how to use the ant script to compile the APK package here is not doing too much Introduction.We have fixed the following apk and then Run: see, the repair success here ~ ~ Project Download: http://download.csdn.net/detail/jiangwei0910410003/9513513 v. Overview of Technologyokay, Here we go. dexposed this framework, how to use this framework to implement the application of the hot repair Function. Here's a summary of the points of knowledge:1, dexposed Framework is free of root implementation hook, But he also has limitations is only hook the application of some METHODS.2, the principle of dexposed frame hook method, is the first to modify the method needs to hook for the native method, and then set the Nativefunc value for the function we need to handleThe function then calls the upper Java code using the reflection mechanism to3, dexposed Framework to achieve thermal repair, is based on hook technology, each need to repair the module needs to follow a protocol, and then use hook technology, to hook off the needFix the method to implement the replace Function.Summing up the dexposed framework is actually a sentence:Find a better time (jni_onload), modify the hook method, and then hook up the upper Java code, realize the Dragon to steal the Phoenix function Vi. SummaryHere is a description of the dexposed framework of some knowledge, in the actual project we will encounter some problems, but this article only explains the framework of the implementation of the principle,In the actual use of the process will encounter some problems, then in the process can Be. For more information please: click here PS: attention, The latest Android technology real-time push dexposed Framework for Root-free Hook implementation in Android and how to implement hot fixes for applications

This article is an English version of an article which is originally in the Chinese language on aliyun.com and is provided for information purposes only. This website makes no representation or warranty of any kind, either expressed or implied, as to the accuracy, completeness ownership or reliability of the article or any translations thereof. If you have any concerns or complaints relating to the article, please send an email, providing a detailed description of the concern or complaint, to info-contact@alibabacloud.com. A staff member will contact you within 5 working days. Once verified, infringing content will be removed immediately.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

Sales Support

1 on 1 presale consultation

Chat Contact Sales
After-Sales Support

24/7 Technical Support 6 Free Tickets per Quarter Faster Response

Open a Ticket
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

Learn More