Android插件化之ContentProvider

妖狐艹你老母 2021-11-27 05:34 502阅读 0赞

先来了解一下ContentProvider的安装和获取过程，查找Hook点。

安装ContentProvider过程：

应用程序在创建Application的过程中,执行handleBindApplication(),会将contentprovider进行安装。

ActivityThread

  1. private void handleBindApplication(AppBindData data) { 
  2.     //...省略部分源码
  3.     if (!data.restrictedBackupMode) { 
  4.                 if (!ArrayUtils.isEmpty(data.providers)) { 
  5.                     installContentProviders(app, data.providers);
  6.                     // For process that contains content providers, we want to
  7.                     // ensure that the JIT is enabled "at some point".
  8.                     mH.sendEmptyMessageDelayed(H.ENABLE_JIT, 10*1000);
  9.                 }
  10.     }
  11. }

installContentProviders():

  1. private void installContentProviders(
  2.             Context context, List<ProviderInfo> providers) { 
  3.         final ArrayList<IActivityManager.ContentProviderHolder> results =
  4.             new ArrayList<IActivityManager.ContentProviderHolder>();
  6.         for (ProviderInfo cpi : providers) { 
  7.             if (DEBUG_PROVIDER) { 
  8.                 StringBuilder buf = new StringBuilder(128);
  9.                 buf.append("Pub ");
  10.                 buf.append(cpi.authority);
  11.                 buf.append(": ");
  12.                 buf.append(cpi.name);
  13.                 Log.i(TAG, buf.toString());
  14.             }
  15.             IActivityManager.ContentProviderHolder cph = installProvider(context, null, cpi,
  16.                     false /*noisy*/, true /*noReleaseNeeded*/, true /*stable*/);
  17.             if (cph != null) { 
  18.                 cph.noReleaseNeeded = true;
  19.                 results.add(cph);
  20.             }
  21.         }
  23.         try { 
  24.             // 将安装好的ContentProvider代理对象和相应一些信息，存储在AMS中，供其他应用程序进行访问。
  25.             ActivityManagerNative.getDefault().publishContentProviders(
  26.                 getApplicationThread(), results);
  27.         } catch (RemoteException ex) { 
  28.             throw ex.rethrowFromSystemServer();
  29.         }
  30.     }

通过contextImpl和解析apk得到的ProviderInfo列表,进行安装。

hook点：只要解析出插件中的ContentProvider信息，再调用installContentProviders()就可以进行安装插件中的ConentProvider。

继续看安装过程，installProvider():

  1. private IActivityManager.ContentProviderHolder installProvider(Context context,
  2.             IActivityManager.ContentProviderHolder holder, ProviderInfo info,
  3.             boolean noisy, boolean noReleaseNeeded, boolean stable) { 
  5.         ContentProvider localProvider = null;
  6.         IContentProvider provider;
  7.         if (holder == null || holder.provider == null) { 
  8.             if (DEBUG_PROVIDER || noisy) { 
  9.                 Slog.d(TAG, "Loading provider " + info.authority + ": "
  10.                         + info.name);
  11.             }
  12.             Context c = null;
  13.             ApplicationInfo ai = info.applicationInfo;
  14.             if (context.getPackageName().equals(ai.packageName)) { 
  15.                 c = context;
  16.             } else if (mInitialApplication != null &&
  17.                     mInitialApplication.getPackageName().equals(ai.packageName)) { 
  18.                 c = mInitialApplication;
  19.             } else { 
  20.                 try { 
  21.                     c = context.createPackageContext(ai.packageName,
  22.                             Context.CONTEXT_INCLUDE_CODE);
  23.                 } catch (PackageManager.NameNotFoundException e) { 
  24.                     // Ignore
  25.                 }
  26.             }
  27.             if (c == null) { 
  28.                 Slog.w(TAG, "Unable to get context for package " +
  29.                       ai.packageName +
  30.                       " while loading content provider " +
  31.                       info.name);
  32.                 return null;
  33.             }
  34.             try { 
  35.                 // 创建ContentProvider对象，执行相应的生命周期
  36.                 final java.lang.ClassLoader cl = c.getClassLoader();
  37.                 localProvider = (ContentProvider)cl.
  38.                     loadClass(info.name).newInstance();
  39.                 provider = localProvider.getIContentProvider();
  40.                 localProvider.attachInfo(c, info);
  41.             } catch (java.lang.Exception e) { 
  42.                 if (!mInstrumentation.onException(null, e)) { 
  43.                     throw new RuntimeException(
  44.                             "Unable to get provider " + info.name
  45.                             + ": " + e.toString(), e);
  46.                 }
  47.                 return null;
  48.             }
  49.         }
  51.         IActivityManager.ContentProviderHolder retHolder;    
  52.         synchronized (mProviderMap) { 
  53.             if (DEBUG_PROVIDER) Slog.v(TAG, "Checking to add " + provider
  54.                     + " / " + info.name);
  55.             IBinder jBinder = provider.asBinder();
  56.             if (localProvider != null) { 
  57.                 ComponentName cname = new ComponentName(info.packageName, info.name);
  58.                 ProviderClientRecord pr = mLocalProvidersByName.get(cname);
  59.                 if (pr != null) { 
  60.                     if (DEBUG_PROVIDER) { 
  61.                         Slog.v(TAG, "installProvider: lost the race, "
  62.                                 + "using existing local provider");
  63.                     }
  64.                     provider = pr.mProvider;
  65.                 } else { 
  66.                     holder = new IActivityManager.ContentProviderHolder(info);
  67.                     holder.provider = provider;
  68.                     holder.noReleaseNeeded = true;
  69.                     // 在本地进程中，进行存储构建好的CotnentProvider和代理对象
  70.                     pr = installProviderAuthoritiesLocked(provider, localProvider, holder);
  71.                     mLocalProviders.put(jBinder, pr);
  72.                     mLocalProvidersByName.put(cname, pr);
  73.                 }
  74.                 retHolder = pr.mHolder;
  75.             }   
  77.         } 
  79.     return retHolder;
  80. }

installProviderAuthoritiesLocked():

  1. private ProviderClientRecord installProviderAuthoritiesLocked(IContentProvider provider,
  2.             ContentProvider localProvider, IActivityManager.ContentProviderHolder holder) { 
  3.         final String auths[] = holder.info.authority.split(";");
  4.         final int userId = UserHandle.getUserId(holder.info.applicationInfo.uid);
  6.         final ProviderClientRecord pcr = new ProviderClientRecord(
  7.                 auths, provider, localProvider, holder);
  8.         for (String auth : auths) { 
  9.             final ProviderKey key = new ProviderKey(auth, userId);
  10.             final ProviderClientRecord existing = mProviderMap.get(key);
  11.             if (existing != null) { 
  12.                 Slog.w(TAG, "Content provider " + pcr.mHolder.info.name
  13.                         + " already published as " + auth);
  14.             } else { 
  15.                //存储好相应信息 
  16.                 mProviderMap.put(key, pcr);
  17.             }
  18.         }
  19.         return pcr;
  20.     }

ContentProvider获取过程：

在ContextImpl#getContentResolver()获取到ContentResolver对象。

ContextImpl

  1. @Override
  2.     public ContentResolver getContentResolver() { 
  3.         return mContentResolver;
  4.     }

检索全局,发现是在ContextImpl的构造方法中创建ContentResolver对象：

  1. private ContextImpl(ContextImpl container, ActivityThread mainThread,
  2.             LoadedApk packageInfo, IBinder activityToken, UserHandle user, int flags,
  3.             Display display, Configuration overrideConfiguration, int createDisplayWithId) { 
  4.     //.... 省略部分源码
  5.     mContentResolver = new ApplicationContentResolver(this, mainThread, user);
  6. }

从上可知,应用程序是通过ApplicationContentResolver来与contentprovider进行交互操作的。

接下来 , 查看下ApplicationContentResolver这个静态内部类。

  1. private static final class ApplicationContentResolver extends ContentResolver { 
  2.         private final ActivityThread mMainThread;
  3.         private final UserHandle mUser;
  5.         public ApplicationContentResolver(
  6.                 Context context, ActivityThread mainThread, UserHandle user) { 
  7.             super(context);
  8.             mMainThread = Preconditions.checkNotNull(mainThread);
  9.             mUser = Preconditions.checkNotNull(user);
  10.         }
  12.         @Override
  13.         protected IContentProvider acquireProvider(Context context, String auth) { 
  14.             return mMainThread.acquireProvider(context,
  15.                     ContentProvider.getAuthorityWithoutUserId(auth),
  16.                     resolveUserIdFromAuthority(auth), true);
  17.         }
  18.         //... 省略部分源码
  19.         @Override
  20.         protected IContentProvider acquireUnstableProvider(Context c, String auth) { 
  21.             return mMainThread.acquireProvider(c,
  22.                     ContentProvider.getAuthorityWithoutUserId(auth),
  23.                     resolveUserIdFromAuthority(auth), false);
  24.         }
  25.        //... 省略部分源码
  26.     }

继续,查看ContentResolver#query()是如何走向的：

ContentResolver

  1. public final @Nullable Cursor query(final @RequiresPermission.Read @NonNull Uri uri,
  2.             @Nullable String[] projection, @Nullable String selection,
  3.             @Nullable String[] selectionArgs, @Nullable String sortOrder,
  4.             @Nullable CancellationSignal cancellationSignal) { 
  5.         Preconditions.checkNotNull(uri, "uri");
  6.         // 获取到ContentProvider的代理对象
  7.         IContentProvider unstableProvider = acquireUnstableProvider(uri);
  8.         if (unstableProvider == null) { 
  9.             return null;
  10.         }
  11.         //... 
  12. }

继续查看acquireUnstableProvider():

  1. public final IContentProvider acquireUnstableProvider(Uri uri) { 
  2.         if (!SCHEME_CONTENT.equals(uri.getScheme())) { 
  3.             return null;
  4.         }
  5.         String auth = uri.getAuthority();
  6.         if (auth != null) { 
  7.             return acquireUnstableProvider(mContext, uri.getAuthority());
  8.         }
  9.         return null;
  10. }

发现，会走到ApplicationContentResolver#acquireUnstableProvider():

  1. @Override
  2.         protected IContentProvider acquireUnstableProvider(Context c, String auth) { 
  3.             return mMainThread.acquireProvider(c,
  4.                     ContentProvider.getAuthorityWithoutUserId(auth),
  5.                     resolveUserIdFromAuthority(auth), false);
  6.         }

发现,会走到ActivityThread对象的acquireProvider():

ActivityThread

  1. public final IContentProvider acquireProvider(
  2.             Context c, String auth, int userId, boolean stable) { 
  3.         // 从启动应用程序进程时，已经安装的ContentProvider中查看
  4.         final IContentProvider provider = acquireExistingProvider(c, auth, userId, stable);
  5.         if (provider != null) { 
  6.             return provider;
  7.         }
  9.         // 从AMS中去找其他应用程序安装的ContentProvider。
  10.         IActivityManager.ContentProviderHolder holder = null;
  11.         try { 
  12.             holder = ActivityManagerNative.getDefault().getContentProvider(
  13.                     getApplicationThread(), auth, userId, stable);
  14.         } catch (RemoteException ex) { 
  15.             throw ex.rethrowFromSystemServer();
  16.         }
  17.         if (holder == null) { 
  18.             Slog.e(TAG, "Failed to find provider info for " + auth);
  19.             return null;
  20.         }
  22.         // 会去新安装ConntentProvider
  23.         holder = installProvider(c, holder, holder.info,
  24.                 true /*noisy*/, holder.noReleaseNeeded, stable);
  25.         return holder.provider;
  26.     }

从上可知会先从应用程序自身的已经安装的ContentProvider中查找匹配，若是没有找到,则会从AactivityManagerService中去查找其他应用程序安装的ContentProvider进行匹配。若是没有，则会重新安装应用程序的ContentProvider中重新匹配。

从应用程序自身安装的ContentProvider中查找, acquireExistingProvider():

  1. public final IContentProvider acquireExistingProvider(
  2.             Context c, String auth, int userId, boolean stable) { 
  3.         synchronized (mProviderMap) { 
  4.             final ProviderKey key = new ProviderKey(auth, userId);
  5.             final ProviderClientRecord pr = mProviderMap.get(key);
  6.             if (pr == null) { 
  7.                 return null;
  8.             }
  10.             IContentProvider provider = pr.mProvider;
  11.             IBinder jBinder = provider.asBinder();
  12.             // ContentProvider所在进程已经死亡
  13.             if (!jBinder.isBinderAlive()) { 
  14.                 // The hosting process of the provider has died; we can't
  15.                 // use this one.
  16.                 Log.i(TAG, "Acquiring provider " + auth + " for user " + userId
  17.                         + ": existing object's process dead");
  18.                 handleUnstableProviderDiedLocked(jBinder, true);
  19.                 return null;
  20.             }
  22.             // Only increment the ref count if we have one. If we don't then the
  23.             // provider is not reference counted and never needs to be released.
  24.             ProviderRefCount prc = mProviderRefCountMap.get(jBinder);
  25.             if (prc != null) { 
  26.                 // 会累计引用的个数
  27.                 incProviderRefLocked(prc, stable);
  28.             }
  29.             return provider;
  30.         }
  31.     }

从mProviderMap中获取缓存好的ContentProvider信息中查询,若是能匹配到，且能够使用则返回。反之，返回null。

实战案例

思考：

  1. 解析出插件中contentprovider
  2. 在Application#attachBaseContext()中安装插件的contentprovidr。
  3. 存在的一个问题，其他应用程序无法访问插件中ContentProvider。因PackageManagerService是无法获取到插件中信息。

在插件中编写一个contentprovoider

  1. public class PluginContentProvider extends ContentProvider { 
  2.     public static final String AUTHORITY = "com.xingen.plugin.contentprovider.PluginContentProvider";
  4.     public static final Uri URI = Uri.parse("content://" + AUTHORITY);
  6.     public static final String NAME = "name";
  8.     private static final String TABLE_NAME = "developer";
  9.     private PluginDB db;
  11.     @Override
  12.     public boolean onCreate() { 
  13.         db = new PluginDB(getContext());
  14.         return true;
  15.     }
  17.     @Nullable
  18.     @Override
  19.     public Cursor query(@NonNull Uri uri, @Nullable String[] projection, @Nullable String selection, @Nullable String[] selectionArgs, @Nullable String sortOrder) { 
  20.         SQLiteDatabase database = db.getReadableDatabase();
  21.         return database.query(TABLE_NAME, projection, selection, selectionArgs, null, null, sortOrder);
  22.     }
  24.     @Nullable
  25.     @Override
  26.     public String getType(@NonNull Uri uri) { 
  27.         return null;
  28.     }
  30.     @Nullable
  31.     @Override
  32.     public Uri insert(@NonNull Uri uri, @Nullable ContentValues values) { 
  33.         SQLiteDatabase database = db.getWritableDatabase();
  34.         long rowId = database.insert(TABLE_NAME, null, values);
  35.         Uri rowUri = ContentUris.appendId(URI.buildUpon(), rowId).build();
  36.         return rowUri;
  37.     }
  39.     @Override
  40.     public int delete(@NonNull Uri uri, @Nullable String selection, @Nullable String[] selectionArgs) { 
  41.         return 0;
  42.     }
  44.     @Override
  45.     public int update(@NonNull Uri uri, @Nullable ContentValues values, @Nullable String selection, @Nullable String[] selectionArgs) { 
  46.         return 0;
  47.     }
  49.     private static class PluginDB extends SQLiteOpenHelper { 
  50.         private static final String db_name = "developer.db";
  51.         private static final int db_version = 1;
  53.         public PluginDB(Context context) { 
  54.             super(context, db_name, null, db_version);
  55.         }
  57.         @Override
  58.         public void onCreate(SQLiteDatabase db) { 
  59.             StringBuffer stringBuffer = new StringBuffer();
  60.             stringBuffer.append("Create table ");
  61.             stringBuffer.append(TABLE_NAME);
  62.             stringBuffer.append("( _id INTEGER PRIMARY KEY AUTOINCREMENT, ");
  63.             stringBuffer.append(NAME);
  64.             stringBuffer.append(" text ");
  65.             stringBuffer.append(");");
  66.             db.execSQL(stringBuffer.toString());
  67.         }
  69.         @Override
  70.         public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) { 
  72.         }
  73.     }
  74. }

在AndroidManifest.xml中注册：

  1. <provider
  2.             android:name="com.xingen.plugin.contentprovider.PluginContentProvider"
  3.             android:authorities="com.xingen.plugin.contentprovider.PluginContentProvider">
  5.         </provider>

在宿主中编写hook,安装插件中的Contentprovider:

  1. public class ContentProviderHookManager { 
  2.     private static List<ProviderInfo> providerInfoList=new LinkedList<>();
  3.     public static void init(Application  context, String apkFilePath){ 
  4.          preloadParseContentProvider(apkFilePath);
  5.          // 便于classloader加载，修改
  6.         String packageName=context.getBaseContext().getPackageName();
  7.         for (ProviderInfo providerInfo:providerInfoList){ 
  8.              providerInfo.applicationInfo.packageName=packageName;
  9.         }
  10.         installContentProvider(context);
  11.     }
  13.     /** * 将ContentProvider安装到进程中 */
  14.     private static void installContentProvider(Context context){ 
  15.         try { 
  16.             //获取到ActivityThread
  17.             Class<?> ActivityThreadClass = Class.forName("android.app.ActivityThread");
  18.             Field sCurrentActivityThreadField = ActivityThreadClass.getDeclaredField("sCurrentActivityThread");
  19.             sCurrentActivityThreadField.setAccessible(true);
  20.             Object ActivityThread = sCurrentActivityThreadField.get(null);
  21.             // 调用 installContentProviders()
  22.             Method installContentProvidersMethod=ActivityThreadClass.getDeclaredMethod("installContentProviders",Context.class,List.class);
  23.             installContentProvidersMethod.setAccessible(true);
  24.             installContentProvidersMethod.invoke(ActivityThread,context,providerInfoList);
  25.         }catch (Exception e){ 
  26.             e.printStackTrace();
  27.         }
  29.     }
  30.     /** * 解析插件中的service * * @param apkFilePath */
  31.     private static void preloadParseContentProvider(String apkFilePath) { 
  32.         try { 
  33.             // 先获取PackageParser对象
  34.             Class<?> packageParserClass = Class.forName("android.content.pm.PackageParser");
  35.             Object packageParser = packageParserClass.newInstance();
  36.             //接着获取PackageParser.Package
  37.             Method parsePackageMethod = packageParserClass.getDeclaredMethod("parsePackage", File.class, int.class);
  38.             parsePackageMethod.setAccessible(true);
  39.             Object packageParser$package = parsePackageMethod.invoke(packageParser, new File(apkFilePath), PackageManager.GET_RECEIVERS);
  40.             // 接着获取到Package中的receivers列表
  41.             Class<?> packageParser$package_Class = packageParser$package.getClass();
  42.             Field providersField = packageParser$package_Class.getDeclaredField("providers");
  43.             providersField.setAccessible(true);
  44.             List providersList = (List) providersField.get(packageParser$package);
  45.             Class<?> packageParser$Provider_Class = Class.forName("android.content.pm.PackageParser$Provider");
  46.             // 获取 name
  47.             Field infoField = packageParser$Provider_Class.getDeclaredField("info");
  48.             infoField.setAccessible(true);
  49.             for (Object provider : providersList) { 
  50.                 ProviderInfo info = (ProviderInfo) infoField.get(provider);
  51.                 providerInfoList.add(info);
  52.             }
  53.         } catch (Exception e) { 
  54.             e.printStackTrace();
  55.         }
  56.     }
  57. }

在宿主的Application中加载：

  1. public class ProxyApplication extends Application { 
  2.     @Override
  3.     protected void attachBaseContext(Context base) { 
  4.         super.attachBaseContext(base);
  5.         loadPluginDex(base);
  6.     }
  8.     private void loadPluginDex(Context context) { 
  9.         // 先拷贝assets 下的apk，写入磁盘中。
  10.         String zipFilePath = PluginConfig.getZipFilePath(context);
  11.         File zipFile = new File(zipFilePath);
  12.         final String asset_file_name = "plugin.apk";
  13.         Utils.copyFiles(context, asset_file_name, zipFile);
  14.         String optimizedDirectory = new File(Utils.getCacheDir(context).getAbsolutePath() + File.separator + "plugin").getAbsolutePath();
  15.         // 加载插件dex
  16.         ClassLoaderHookManager.init(context, zipFilePath, optimizedDirectory);
  17.         // 安装插件中的ContentProvider
  18.          ContentProviderHookManager.init(this, zipFilePath);
  19.     }
  20. }

最后，测试：

  1. private void useContentProvider(View view) { 
  2.         final Uri uri = Uri.parse("content://" + PluginConfig.provider_name);
  3.         final String column_name = "name";
  4.         Button button = (Button) view;
  5.         final String text_query = "Hook 使用content_provider 查询";
  6.         final String text_insert = "Hook 使用content_provider 插入";
  7.         ContentResolver contentResolver = getContentResolver();
  8.         if (text_query.equals(button.getText().toString())) { // 查询
  9.             Cursor cursor = contentResolver.query(uri, null, null, null, null);
  10.             try { 
  11.                 StringBuffer stringBuffer = new StringBuffer();
  12.                 if (cursor != null && cursor.moveToFirst()) { 
  13.                     do { 
  14.                         stringBuffer.append(cursor.getString(cursor.getColumnIndex(column_name)));
  15.                         stringBuffer.append(",");
  16.                     } while (cursor.moveToNext());
  17.                 }
  18.                 if (!TextUtils.isEmpty(stringBuffer.toString())) { 
  19.                     Toast.makeText(getApplicationContext(), "查询到的名字：" + stringBuffer.toString(), Toast.LENGTH_SHORT).show();
  20.                 }
  21.             } catch (Exception e) { 
  22.                 e.printStackTrace();
  23.             } finally { 
  24.                 if (cursor != null) { 
  25.                     cursor.close();
  26.                 }
  27.                 button.setText(text_insert);
  28.             }
  29.         } else {  // 插入
  30.             ContentValues contentValues = new ContentValues();
  31.             contentValues.put(column_name, "android " + (int) (Math.random() * 100));
  32.             contentResolver.insert(uri, contentValues);
  33.             button.setText(text_query);
  34.         }
  35.     }

项目代码： https://github.com/13767004362/HookDemo

发表评论

表情：
评论列表 （有 0 条评论，502人围观）

还没有评论，来说两句吧...

相关阅读

    相关 Android组件化和插件化开发

    项目发展到一定程度，就必须进行模块的拆分。模块化是一种指导理念，其核心思想就是分而治之、降低耦合。而在 Android 工程实践，目前有两种途径，一个是组件化，一个是插件化。

    Myth丶恋晨Myth丶恋晨/ 0 赞/ 366 阅读