Hook Activity 的 startActivity 方法（Activity startActivity）

先定义一个 InstrumentationProxy 继承 Instrumentation ，然后完善里面的 execStartActivity 方法。

public class InstrumentationProxy extends Instrumentation {

    private static final String TAG = "InstrumentationProxy";

    Instrumentation mInstrumentation;

    public InstrumentationProxy(Instrumentation instrumentation) {
        mInstrumentation = instrumentation;
    }

    public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {
        Log.d(TAG, "Hook 成功" + " who :" + who);
        // 开始调用原始的方法, 调不调用随你,但是不调用的话, 所有的startActivity都失效了.
        // 由于这个方法是隐藏的,因此需要使用反射调用;首先找到这个方法
        Class[] pareTyples = {Context.class, IBinder.class, IBinder.class,
                Activity.class, Intent.class, int.class, Bundle.class};
        Object[] pareVaules = {who, contextThread, token, target,
                intent, requestCode, options};
        String methodName = "execStartActivity";
        try {
            Method execStartActivity = mInstrumentation.getClass().getDeclaredMethod(methodName, pareTyples);
            execStartActivity.setAccessible(true);
            return (ActivityResult) execStartActivity.invoke(mInstrumentation, pareVaules);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

}

public class HookMainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_hook_main);
        Class clazz = Activity.class;
        try {
            Field field = clazz.getDeclaredField("mInstrumentation");//通过Activity.class 拿到 mInstrumentation字段
            field.setAccessible(true);
            Instrumentation mInstrumentation = (Instrumentation) field.get(this); //根据activity内mInstrumentation字段 获取Instrumentation对象
            Instrumentation instrumentationProxy = new InstrumentationProxy(mInstrumentation); ////创建代理对象
            field.set(this, instrumentationProxy); //进行替换
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Hook Context 的 startActivity 方法 （getApplicationContext startActivity）

public class HookMainActivity extends AppCompatActivity {

    @Override
    protected void attachBaseContext(Context context) {
        super.attachBaseContext(context);
        try {
            // 在这里进行Hook
            String className = "android.app.ActivityThread";
            String methodName = "currentActivityThread";
            Class[] pareTyples = new Class[]{};
            Object[] pareVaules = new Object[]{};
            // 先获取到当前的ActivityThread对象
            Class clazz = Class.forName(className);
            Method method = clazz.getDeclaredMethod(methodName, pareTyples);
            method.setAccessible(true);
            Object currentActivityThread = method.invoke(null, pareVaules);// 先获取到当前的ActivityThread对象
            String filedName = "mInstrumentation";
            // 拿到原始的 mInstrumentation字段
            Field field = clazz.getDeclaredField(filedName);
            field.setAccessible(true);
            Instrumentation mInstrumentation = (Instrumentation) field.get(currentActivityThread); // 拿到原始的 mInstrumentation字段
            // 创建代理对象
            Instrumentation instrumentationProxy = new InstrumentationProxy(mInstrumentation);
            // 偷梁换柱
            field.set(currentActivityThread, instrumentationProxy);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_hook_main);
    }
}

Hook startActivity 总结

Hook Context 的 startActivity 方法和 Hook Activity 的 startActivity 方法最大的区别就是替换的 Instrumentation 不同 ， 前者是 ActivityThread 中的 Instrumentation ，后者是Activity 中的 Instrumentation。另外有一点需要注意的是，在 MainActivity 的onCreate 方法中进行Instrumentation替换的，未必是最佳的替换时间点 ，所以在 Activity 的 attachBaseContext 方法中进行 Instrumentation 替换，因为这个方法要先于 Activity 的 onCreate 方法被调用。讲到这里，我们知道了如何使用代理来 Hook startActivity 方法，简单说就是找到 Hook 点，再用代理对象来替换 Hook 点 。

Hook 的要点

• Hook 的选择点：静态变量和单例，因为一旦创建对象，它们不容易变化，非常容易定位。
• Hook 的过程：
  1.寻找 Hook 点，原则是静态变量或者单例对象，尽量 Hook public 的对象和方法。
  2.选择合适的代理方式，如果是接口可以用动态代理。
  3.偷梁换柱——用代理对象替换原始对象。
• Android 的 API 版本比较多，方法和类可能不一样，所以要做好 API 的兼容工作。

我们来梳理下 Activity startActivity 方法的调用流程。

@Override
public void startActivity(Intent intent, @Nullable Bundle options) {
    if (options != null) {
        startActivityForResult(intent, -1, options);
    } else {
        // Note we want to go through this call for compatibility with
        // applications that may have overridden the method.
        startActivityForResult(intent, -1);
    }
}

    public void startActivityForResult(Intent intent, int requestCode) {
        startActivityForResult(intent, requestCode, null);
    }

    /**
     * Launch an activity for which you would like a result when it finished.
     * When this activity exits, your
     * onActivityResult() method will be called with the given requestCode.
     * Using a negative requestCode is the same as calling
     * {@link #startActivity} (the activity is not launched as a sub-activity).
     *
     * <p>Note that this method should only be used with Intent protocols
     * that are defined to return a result.  In other protocols (such as
     * {@link Intent#ACTION_MAIN} or {@link Intent#ACTION_VIEW}), you may
     * not get the result when you expect.  For example, if the activity you
     * are launching uses {@link Intent#FLAG_ACTIVITY_NEW_TASK}, it will not
     * run in your task and thus you will immediately receive a cancel result.
     *
     * <p>As a special case, if you call startActivityForResult() with a requestCode
     * >= 0 during the initial onCreate(Bundle savedInstanceState)/onResume() of your
     * activity, then your window will not be displayed until a result is
     * returned back from the started activity.  This is to avoid visible
     * flickering when redirecting to another activity.
     *
     * <p>This method throws {@link android.content.ActivityNotFoundException}
     * if there was no Activity found to run the given Intent.
     *
     * @param intent The intent to start.
     * @param requestCode If >= 0, this code will be returned in
     *                    onActivityResult() when the activity exits.
     * @param options Additional options for how the Activity should be started.
     * See {@link android.content.Context#startActivity(Intent, Bundle)}
     * Context.startActivity(Intent, Bundle)} for more details.
     *
     * @throws android.content.ActivityNotFoundException
     *
     * @see #startActivity
     */
    public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);
            if (ar != null) {
                mMainThread.sendActivityResult(
                    mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                    ar.getResultData());
            }
            if (requestCode >= 0) {
                // If this start is requesting a result, we can avoid making
                // the activity visible until the result is received.  Setting
                // this code during onCreate(Bundle savedInstanceState) or onResume() will keep the
                // activity hidden during this time, to avoid flickering.
                // This can only be done when a result is requested because
                // that guarantees we will get information back when the
                // activity is finished, no matter what happens to it.
                mStartedActivity = true;
            }

            cancelInputsAndStartExitTransition(options);
            // TODO Consider clearing/flushing other event sources and events for child windows.
        } else {
            if (options != null) {
                mParent.startActivityFromChild(this, intent, requestCode, options);
            } else {
                // Note we want to go through this method for compatibility with
                // existing applications that may have overridden it.
                mParent.startActivityFromChild(this, intent, requestCode);
            }
        }
    }

首先，我们先来看一下 startActivityForResult 方法，当 mParent 为 null 的时候，会调用到 mInstrumentation.execStartActivity 方法。当 mParent 不为 null 时，都会调用到 mParent.startActivityFromChild 方法。而 mParent 为 Activity 实例，接下来我们一起看一下 startActivityFromChild 方法。

    /**
     * This is called when a child activity of this one calls its
     * {@link #startActivity} or {@link #startActivityForResult} method.
     *
     * <p>This method throws {@link android.content.ActivityNotFoundException}
     * if there was no Activity found to run the given Intent.
     *
     * @param child The activity making the call.
     * @param intent The intent to start.
     * @param requestCode Reply request code.  < 0 if reply is not requested.
     * @param options Additional options for how the Activity should be started.
     * See {@link android.content.Context#startActivity(Intent, Bundle)}
     * Context.startActivity(Intent, Bundle)} for more details.
     *
     * @throws android.content.ActivityNotFoundException
     *
     * @see #startActivity
     * @see #startActivityForResult
     */
    public void startActivityFromChild(@NonNull Activity child, @RequiresPermission Intent intent,
            int requestCode, @Nullable Bundle options) {
        options = transferSpringboardActivityOptions(options);
        Instrumentation.ActivityResult ar =
            mInstrumentation.execStartActivity(
                this, mMainThread.getApplicationThread(), mToken, child,
                intent, requestCode, options);
        if (ar != null) {
            mMainThread.sendActivityResult(
                mToken, child.mEmbeddedID, requestCode,
                ar.getResultCode(), ar.getResultData());
        }
        cancelInputsAndStartExitTransition(options);
    }

可以看到 startActivityFromChild 中也会调用 mInstrumentation.execStartActivity 方法。因此，即我们通过 Activity startActivity 的方法启动 activity，最终都会调用到 mInstrumentation.execStartActivity 方法。因此，如果我们想要拦截的话，可以 hook 住 mInstrumentation。

由于 mInstrumentation 是类，不是 interface，不能使用动态代理的方式，因此，这里我们使用静态代理的方式。

ok，这里我们重新理一下 Activity 大概的启动流程：

app 调用 startActivity 方法 -> Instrumentation 类通过 ActivityManagerNative 或者 ActivityManager（ API 26以后）将启动请求发送给 AMS -> AMS 进行一系列检查并将此请求通过 Binder 派发给所属 app -> app 通过 Binder 收到这个启动请求 -> ActivityThread 中的实现将收到的请求进行封装后送入 Handler -> 从 Handler 中取出这个消息，开始 app 本地的 Activity 初始化和启动逻辑。