WebView-骚操作03-Hook

android5.0以上，webview所在进程如果是android.uid.system，运行则会直接崩溃。
解决方法：

1. 2个apk，由主apk做需要system权限的业务，拉起webview apk
2. 通过hook方式解决，参考android.webkit.WebViewFactory源码，详细代码如下

public class WebViewUtils {

    private static final String TAG = "WebViewUtils";

    public static void hookWebView() {
        final int uid = android.os.Process.myUid();
        if (uid != android.os.Process.SYSTEM_UID) {
            Log.e(TAG, "uid=" + uid + ";not SYSTEM_UID;need not hook");
            return;
        }
        int sdkInt = Build.VERSION.SDK_INT;
        try {
            Class<?> factoryClass = Class.forName("android.webkit.WebViewFactory");
            Field field = factoryClass.getDeclaredField("sProviderInstance");
            field.setAccessible(true);
            Object sProviderInstance = field.get(null);
            if (sProviderInstance != null) {
                Log.i(TAG, "sProviderInstance!=null;need not hook");
                return;
            } else {
                Log.i(TAG, "sProviderInstance==null;need hook");
            }

            Method getProviderClassMethod;
            if (sdkInt > 22) {
                getProviderClassMethod = factoryClass.getDeclaredMethod("getProviderClass");
            } else if (sdkInt == 22) {
                getProviderClassMethod = factoryClass.getDeclaredMethod("getFactoryClass");
            } else {
                Log.i(TAG, "sdkInt:" + sdkInt + ";need not Hook");
                return;
            }
            getProviderClassMethod.setAccessible(true);
            Class<?> factoryProviderClass = (Class<?>) getProviderClassMethod.invoke(factoryClass);
            Class<?> delegateClass = Class.forName("android.webkit.WebViewDelegate");
            Constructor<?> delegateConstructor = delegateClass.getDeclaredConstructor();
            delegateConstructor.setAccessible(true);
            if (sdkInt < 26) {
                //低于Android O版本
                Constructor<?> providerConstructor = factoryProviderClass.getConstructor(delegateClass);
                if (providerConstructor != null) {
                    providerConstructor.setAccessible(true);
                    sProviderInstance = providerConstructor.newInstance(delegateConstructor.newInstance());
                }
            } else {
                String chromiumMethodNameStr = null;
                try {
                    Field chromiumMethodName = factoryClass.getDeclaredField("CHROMIUM_WEBVIEW_FACTORY_METHOD");
                    chromiumMethodName.setAccessible(true);
                    chromiumMethodNameStr = (String) chromiumMethodName.get(null);
                } catch (Exception e) {
                    Log.e(TAG, "can not found CHROMIUM_WEBVIEW_FACTORY_METHOD;use create");
                }
                if (chromiumMethodNameStr == null) {
                    chromiumMethodNameStr = "create";
                }
                Method staticFactory = factoryProviderClass.getMethod(chromiumMethodNameStr, delegateClass);
                if (staticFactory != null) {
                    sProviderInstance = staticFactory.invoke(null, delegateConstructor.newInstance());
                }
            }
            if (sProviderInstance != null) {
                field.set("sProviderInstance", sProviderInstance);
                Log.i(TAG, "Hook success!");
            } else {
                Log.i(TAG, "Hook failed!");
            }
        } catch (Throwable e) {
            Log.w(TAG, e);
        }
    }
}