安卓热修复框架AndFix核心代码分析并改进

@AndFix/src/com/alipay/euler/andfix/AndFix.java
private static native void replaceMethod(Method src, Method dest);

@AndFix/jni/andfix.cpp
static void replaceMethod(JNIEnv* env, jclass clazz, jobject src,
jobject dest) {
if (isArt) {
art_replaceMethod(env, src, dest);
} else {
dalvik_replaceMethod(env, src, dest);
}
}

@AndFix/jni/art/art_method_replace.cpp
extern void __attribute__ ((visibility ("hidden"))) art_replaceMethod(
JNIEnv* env, jobject src, jobject dest) {
if (apilevel > 23) {
replace_7_0(env, src, dest);
} elseif (apilevel > 22) {
replace_6_0(env, src, dest);
} elseif (apilevel > 21) {
replace_5_1(env, src, dest);
} elseif (apilevel > 19) {
replace_5_0(env, src, dest);
}else{
replace_4_4(env, src, dest);
}
}

@AndFixProject/app/src/main/cpp/art_7_0.h
namespace art {
namespace mirror {
class ArtMethod {
public:
// Field order required by test"ValidateFieldOrderOfJavaCppUnionClasses".
// The class we are a part of.
uint32_t declaring_class_;
// Access flags; low 16 bits are defined by spec.
uint32_t access_flags_;
/* Dex file fields. The defining dex file is available via declaring_class_->dex_cache_ */
// Offset to the CodeItem.
uint32_t dex_code_item_offset_;
// Index into method_ids of the dex file associated with this method.
uint32_t dex_method_index_;
/* End of dex file fields. */
// Entry within a dispatch table for this method. For static/direct methods the index is into
// the declaringClass.directMethods, for virtual methods the vtable and for interface methods the
// ifTable.
uint16_t method_index_;
// The hotness we measure for this method. Incremented by the interpreter. Not atomic, as we allow
// missing increments: if the method is hot, we will see it eventually.
uint16_t hotness_count_;
// Fake padding field gets inserted here.
// Must be the last fields in the method.
// PACKED(4) is necessary for the correctness of
// RoundUp(OFFSETOF_MEMBER(ArtMethod, ptr_sized_fields_), pointer_size).
struct PtrSizedFields {
// Short cuts to declaring_class_->dex_cache_ member for fast compiled code access.
ArtMethod** dex_cache_resolved_methods_;
// Short cuts to declaring_class_->dex_cache_ member for fast compiled code access.
void* dex_cache_resolved_types_;
// Pointer to JNI function registered to this method, or a function to resolve the JNI function,
// or the profiling data for non-native methods, or an ImtConflictTable.
void* entry_point_from_jni_;
// Method dispatch from quick compiled code invokes this pointer which may cause bridging into
// the interpreter.
void* entry_point_from_quick_compiled_code_;
} ptr_sized_fields_;
};
}
}

   @AndFixProject/app/src/main/java/com.wind.cache.andfixproject/AndFixManager.java
public static native void andFixMethod(Method srcMethod, Method dstMethod);

@AndFixProject/app/src/main/cpp/andFix.cpp
Java_com_wind_cache_andfixproject_AndFixManager_andFixMethod(JNIEnv *env, jobject instance,
jobject srcMethod, jobject dstMethod) {
LOGD("start fix art_method!!!!");
art::mirror::ArtMethod* meth = (art::mirror::ArtMethod*) env->FromReflectedMethod(srcMethod);
art::mirror::ArtMethod* target = (art::mirror::ArtMethod*) env->FromReflectedMethod(dstMethod);
target->declaring_class_ = meth->declaring_class_;
target->access_flags_ = meth->access_flags_;
target->dex_code_item_offset_ = meth->dex_code_item_offset_;
target->dex_method_index_ = meth->dex_method_index_;
target->method_index_ = meth->method_index_;
target->hotness_count_ = meth->hotness_count_;
target->ptr_sized_fields_.dex_cache_resolved_types_ = meth->ptr_sized_fields_.dex_cache_resolved_types_;
target->ptr_sized_fields_.dex_cache_resolved_methods_ = meth->ptr_sized_fields_.dex_cache_resolved_methods_;
target->ptr_sized_fields_.entry_point_from_jni_ = meth->ptr_sized_fields_.entry_point_from_jni_;
target->ptr_sized_fields_.entry_point_from_quick_compiled_code_ = meth->ptr_sized_fields_.entry_point_from_quick_compiled_code_;
}

public class RightMethodClass {
public int fixGet(int a, int b) {
return a+b+100000;
}
}

public class WrongMethodClass {
public int get(int a, int b) {
Log.e("WrongMethodClass", "you have run the wrong method !!!!");
return a*b;
}
}

    public static void startAndFix(Context context) {
try {
Class<?> clazz = loadRightMethodClass(context);
Method srcMethod = clazz.getMethod("fixGet", int.class, int.class);
Method dstMethod = WrongMethodClass.class.getMethod("get", int.class, int.class);
andFixMethod(srcMethod, dstMethod); //调用native方法进行方法的替换
} catch (NoSuchMethodException e) {
e.printStackTrace();
}
}
private static String fixDexPath = "file:///android_asset/fix.dex";
//从assets目录中加载dex文件中的正确方法的类
private static Class<?> loadRightMethodClass(Context context) {
DexClassLoader rightClassLoader = new DexClassLoader(fixDexPath, context.getDir("dex", Context.MODE_PRIVATE).getAbsolutePath(), null, context.getClassLoader());
Class<?> clazz = null;
try {
clazz = rightClassLoader.loadClass("com.wind.cache.andfixproject.RightMethodClass");
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
return clazz;
}

    target->declaring_class_ = meth->declaring_class_;
target->access_flags_ = meth->access_flags_;
target->dex_code_item_offset_ = meth->dex_code_item_offset_;
target->dex_method_index_ = meth->dex_method_index_;
target->method_index_ = meth->method_index_;
target->hotness_count_ = meth->hotness_count_;
...

 memcpy(target,meth, sizeof(ArtMethod));

public class NativeArtMethodCalculator {
public static void method1(){}
public static void method2(){}
}

size_t art_method_length = 0;
Java_com_wind_cache_andfixproject_AndFixManager_getArtMethoLength(JNIEnv *env, jobject instance, jobject method1, jobject method2) {
if (art_method_length != 0) {
return art_method_length;
}
size_t method1Ptr =  (size_t)env->FromReflectedMethod(method1);
size_t method2Ptr =  (size_t)env->FromReflectedMethod(method2);
art_method_length = method2Ptr - method1Ptr;
return art_method_length;
}

Java_com_wind_cache_andfixproject_AndFixManager_hotFixMethod(JNIEnv *env, jobject instance,
jobject srcMethod, jobject dstMethod) {
jmethodID meth = env->FromReflectedMethod(srcMethod);
jmethodID target = env->FromReflectedMethod(dstMethod);
memcpy(target, meth, art_method_length);
}

public class MemoryWrapper {
private static final String UNSAFE_CLASS = "sun.misc.Unsafe";
private static Object THE_UNSAFE;
private static boolean is64Bit;
static {
THE_UNSAFE = Reflection.get(null, UNSAFE_CLASS, "THE_ONE", null);
Object runtime = Reflection.call(null, "dalvik.system.VMRuntime", "getRuntime", null, null, null);
is64Bit = (Boolean) Reflection.call(null, "dalvik.system.VMRuntime", "is64Bit", runtime, null, null);
}
// libcode.io.Memory#peekByte
private static byte peekByte(long address) {
return (Byte) Reflection.call(null, "libcore.io.Memory", "peekByte", null, new Class[]{long.class}, new Object[]{address});
}
static void pokeByte(long address, byte value) {
Reflection.call(null, "libcore.io.Memory", "pokeByte", null, new Class[]{long.class, byte.class}, new Object[]{address, value});
}
public static void memcpy(long dst, long src, long length) {
for (long i = 0; i < length; i++) {
pokeByte(dst, peekByte(src));
dst++;
src++;
}
}
public static long getMethodAddress(Method method) {
Object mirrorMethod = Reflection.get(Method.class.getSuperclass(), null, "artMethod", method);
return (Long) mirrorMethod;
}
}

 memcpy(target,meth, sizeof(ArtMethod));

public static void memcpy(long dst, long src, long length) {
for (long i = 0; i < length; i++) {
pokeByte(dst, peekByte(src));
dst++;
src++;
}
}

    //原理：同一个类中ArtMethod在内存地址是按顺序紧密排列的
Method method1 = NativeArtMethodCalculator.class.getMethod("method1");
Method method2 = NativeArtMethodCalculator.class.getMethod("method2");
long method1Address = MemoryWrapper.getMethodAddress(method1);
long method2Address = MemoryWrapper.getMethodAddress(method2);
long sizeOfArtMethod = method2Address - method1Address;

   //通过Java方法来操作内存，将ArtMethod的Native指针进行替换
public static void startFixByJava(Context context) {
try {
Method method1 = NativeArtMethodCalculator.class.getMethod("method1");
Method method2 = NativeArtMethodCalculator.class.getMethod("method2");
long method1Address = MemoryWrapper.getMethodAddress(method1);
long method2Address = MemoryWrapper.getMethodAddress(method2);
long sizeOfArtMethod = method2Address - method1Address;  //等同于调用JNI方法：sizeOfArtMethod = getArtMethoLength(method1, method2);
Class<?> clazz = loadRightMethodClass(context);
Method srcMethod = clazz.getMethod("fixGet", int.class, int.class);
Method dstMethod = WrongMethodClass.class.getMethod("get", int.class, int.class);
long dstAddress = MemoryWrapper.getMethodAddress(dstMethod);
long srcAddress = MemoryWrapper.getMethodAddress(srcMethod);
MemoryWrapper.memcpy(dstAddress, srcAddress, sizeOfArtMethod); //等同于调用JNI方法： memcpy(dstAddress, srcAddress, art_method_length);
} catch (NoSuchMethodException e) {
e.printStackTrace();
}
}