动态代理hook自己进程的startActivity方法

hook 原理

package yzy.jnidemo;import android.app.Application;import android.util.Log;import java.lang.reflect.Field;import java.lang.reflect.InvocationHandler;import java.lang.reflect.Method;import java.lang.reflect.Proxy;public class MyApp extends Application {    @Override    public void onCreate() {        super.onCreate();        Log.i("INFO", "start hook");        Class<?> forName = null;        try {            forName = Class.forName("android.app.ActivityManagerNative");            Field defaultField = forName.getDeclaredField("gDefault");            defaultField.setAccessible(true);            //gDefault变量值            Object defaultValue = defaultField.get(null);            //反射SingleTon            Class<?> forName2 = Class.forName("android.util.Singleton");            Field instanceField = forName2.getDeclaredField("mInstance");            instanceField.setAccessible(true);            //系统的iActivityManager对象            Object iActivityManagerObject = instanceField.get(defaultValue);            //钩子            Class<?> iActivityManagerIntercept = Class.forName("android.app.IActivityManager");            AmsInvocationHandler handler = new AmsInvocationHandler(iActivityManagerObject);            Object proxy = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class<?>[]{iActivityManagerIntercept}, handler);            instanceField.set(defaultValue, proxy);        } catch (Exception e) {            e.printStackTrace();        }    }    private class AmsInvocationHandler implements InvocationHandler {        private Object obj ;        public AmsInvocationHandler(Object iActivityManagerObject) {            obj = iActivityManagerObject;        }        @Override        public Object invoke(Object o, Method method, Object[] objects) throws Throwable {              Log.i("yzy","invoke before " + method.getName());              method.invoke(obj,objects);              Log.i("yzy","invoke after " + method.getName());              return  null;        }    }}