系统加载 so 库的工作流程

当我们调用当调用 System#loadLibrary("xxx" ) 后，Android Framework 都干了些了啥?

static {
    System.loadLibrary("ymm_log");
}

在看下System类的实现：

public static void loadLibrary(String libname) {
    Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), libname);
}

synchronized void loadLibrary0(ClassLoader loader, String libname) {
    if (libname.indexOf((int)File.separatorChar) != -1) {
        throw new UnsatisfiedLinkError(
"Directory separator should not appear in library name: " + libname);
    }
    String libraryName = libname;
    if (loader != null) {
        String filename = loader.findLibrary(libraryName);
        if (filename == null) {
            // It's not necessarily true that the ClassLoader used
            // System.mapLibraryName, but the default setup does, and it's
            // misleading to say we didn't find "libMyLibrary.so" when we
            // actually searched for "liblibMyLibrary.so.so".
            throw new UnsatisfiedLinkError(loader + " couldn't find \"" +
                                           System.mapLibraryName(libraryName) + "\"");
        }
        String error = doLoad(filename, loader);
        if (error != null) {
            throw new UnsatisfiedLinkError(error);
        }
        return;
    }

    String filename = System.mapLibraryName(libraryName);
    List<String> candidates = new ArrayList<String>();
    String lastError = null;
    for (String directory : getLibPaths()) {
        String candidate = directory + filename;
        candidates.add(candidate);

        if (IoUtils.canOpenReadOnly(candidate)) {
            String error = doLoad(candidate, loader);
            if (error == null) {
                return; // We successfully loaded the library. Job done.
            }
            lastError = error;
        }
    }

    if (lastError != null) {
        throw new UnsatisfiedLinkError(lastError);
    }
    throw new UnsatisfiedLinkError("Library " + libraryName + " not found; tried " + candidates);
}

 private String doLoad(String name, ClassLoader loader) {
        // Android apps are forked from the zygote, so they can't have a custom LD_LIBRARY_PATH,
        // which means that by default an app's shared library directory isn't on LD_LIBRARY_PATH.

        // The PathClassLoader set up by frameworks/base knows the appropriate path, so we can load
        // libraries with no dependencies just fine, but an app that has multiple libraries that
        // depend on each other needed to load them in most-dependent-first order.

        // We added API to Android's dynamic linker so we can update the library path used for
        // the currently-running process. We pull the desired path out of the ClassLoader here
        // and pass it to nativeLoad so that it can call the private dynamic linker API.

        // We didn't just change frameworks/base to update the LD_LIBRARY_PATH once at the
        // beginning because multiple apks can run in the same process and third party code can
        // use its own BaseDexClassLoader.

        // We didn't just add a dlopen_with_custom_LD_LIBRARY_PATH call because we wanted any
        // dlopen(3) calls made from a .so's JNI_OnLoad to work too.

        // So, find out what the native library search path is for the ClassLoader in question...
        String librarySearchPath = null;
        if (loader != null && loader instanceof BaseDexClassLoader) {
            BaseDexClassLoader dexClassLoader = (BaseDexClassLoader) loader;
            librarySearchPath = dexClassLoader.getLdLibraryPath();
        }
        // nativeLoad should be synchronized so there's only one LD_LIBRARY_PATH in use regardless
        // of how many ClassLoaders are in the system, but dalvik doesn't support synchronized
        // internal natives.
        synchronized (this) {
            return nativeLoad(name, loader, librarySearchPath);
        }
    }

获取so文件名的方式，就是从classLoader中获取，最终加载时通过本地方法nativeLoad实现

 String filename = loader.findLibrary(libraryName)

其实现在BaseDexClassLoader

@Override    
public String findLibrary(String name) {
  return pathList.findLibrary(name);   
 }

方案分析:

1. JNI 代码内置方案

代码隔离方案比较适合新增的 Native 模块，一开始就奔着动态化、延迟加载的方向去。

2. 插件化方案

单独把 so 文件单独打包进插件包，JNI 代码保留在宿主代码内部

由于 nativeLibraryDirectories 的具体实现是一个 ArrayList 实例，其元素读写操作自身是不保证线程安全的

急需解决的问题

1. 安全性问题

所有可执行代码在拷贝安装到安全路径（比如 Android 的 data/data 内部路径）之前，都有被劫持或者破坏的风险。

最好的做法是每次加载 so 库之前都对其做一次安全性校验。

最简单的方式是记录 so 文件的 MD5 或者 CRC 等 Hash 信息（粒度可以是每个单独的 so 文件，或者一批 so 文件的压缩包）

如果本地下载目录中的 so 文件总数目，少于预定义在集合里 so 文件数目,说明不完整

2. 版本控制问题

通过版本控制流程，我们可以在服务端禁用这个版本的 so 插件，从而使客户端进入“so 插件不可用”的逻辑，而不至于执行有问题的代码。

3. abi 兼容性判断

检查 so 插件包里的 so 库 abi 信息是否与宿主目前运行时的 abi 一致。

直接指定你 so 下载的路径,通过反射获取 android.os.SystemProperties 私有方法 get ro.product.cpu.abi 可以动态获取 CPU 架构

    /**
     * 获取设备的cpu架构类型
     */
    public static String getCpuArchType() {
        if (!TextUtils.isEmpty(cpuArchType)) {
            return cpuArchType;
        }
        try {
            Class<?> clazz = Class.forName("android.os.SystemProperties");
            Method get = clazz.getDeclaredMethod("get", new Class[]{String.class});
            cpuArchType = (String) get.invoke(clazz, new Object[]{"ro.product.cpu.abi"});
        } catch (Exception e) {
        }

        try {
            if (TextUtils.isEmpty(cpuArchType)) {
                cpuArchType = Build.CPU_ABI;//获取不到，重新获取，可能不准确？
            }
        } catch (Exception e) {
        }
        if (TextUtils.isEmpty(cpuArchType)) {
            cpuArchType = "armeabi-v7a";
        }
        cpuArchType = cpuArchType.toLowerCase();
        return cpuArchType;
    }

4. System#load 加载代码侵入问题

通过 System#loadLibrary("xxx" ) 加载 so 库， Android Framework 会遍历当前上下文的 ClassLoader 实例里的 nativeLibraryDirectories 数组，在数组里所有的文件路径下查找文件名为 libxxx.so 的文件，所以我们的解决思路就是在安装好 so 插件之后，将其所在的内部安全路径注入到这个 nativeLibraryDirectories 数组里，即可实现通过 System#loadLibrary 加载,代码如下:

第一步: 通过反射，注入 so 文件注入到 nativeLibraryDirectories 路径

    private static final class V14 {
        private static void install(ClassLoader classLoader, File folder) throws Throwable {
           // 反射宿主 APK 的 ClassLoader 的 pathList成员变量
            Field pathListField = MkReflectUtil.findField(classLoader, "pathList");
            // 获取这个成员变量 在 宿主 APK 的 ClassLoader 对象的取值
            Object dexPathList = pathListField.get(classLoader);
            // 将被加载的 被加载的 so 实例存储到 dexPathList
            MkReflectUtil.expandArray(dexPathList, "nativeLibraryDirectories", new File[]{folder});
        }
    }

 private static final class V23 {
        private static void install(ClassLoader classLoader, File folder) throws Throwable {
            Field pathListField = MkReflectUtil.findField(classLoader, "pathList");
            Object dexPathList = pathListField.get(classLoader);

            Field nativeLibraryDirectories = MkReflectUtil.findField(dexPathList, "nativeLibraryDirectories");
            List<File> libDirs = (List<File>) nativeLibraryDirectories.get(dexPathList);

            //去重
            if (libDirs == null) {
                libDirs = new ArrayList<>(2);
            }
            final Iterator<File> libDirIt = libDirs.iterator();
            while (libDirIt.hasNext()) {
                final File libDir = libDirIt.next();
                if (folder.equals(libDir)) {
                    libDirIt.remove();
                    Log.d(TAG, "dq libDirIt.remove() " + folder.getAbsolutePath());
                    break;
                }
            }

            libDirs.add(0, folder);
            Field systemNativeLibraryDirectories =
                    MkReflectUtil.findField(dexPathList, "systemNativeLibraryDirectories");
            List<File> systemLibDirs = (List<File>) systemNativeLibraryDirectories.get(dexPathList);

            //判空
            if (systemLibDirs == null) {
                systemLibDirs = new ArrayList<>(2);
            }
            //Log.d(TAG, "dq systemLibDirs,size=" + systemLibDirs.size());

            // 获得Element[] 数组
            Method makePathElements = MkReflectUtil.findMethod(dexPathList, "makePathElements", List.class, File.class, List.class);
            ArrayList<IOException> suppressedExceptions = new ArrayList<>();
            libDirs.addAll(systemLibDirs);
           // 输出调用对象,插件APK所在目录,插件APK的全路径,和用于存储IO异常的List,获得Element[] 返回
            Object[] elements = (Object[]) makePathElements.invoke(dexPathList, libDirs, null, suppressedExceptions);
            Field nativeLibraryPathElements = MkReflectUtil.findField(dexPathList, "nativeLibraryPathElements");
            nativeLibraryPathElements.setAccessible(true);
            nativeLibraryPathElements.set(dexPathList, elements);
        }
    }

 private static final class V25 {
        private static void install(ClassLoader classLoader, File folder) throws Throwable {
            Field pathListField = MkReflectUtil.findField(classLoader, "pathList");
            Object dexPathList = pathListField.get(classLoader);
            Field nativeLibraryDirectories = MkReflectUtil.findField(dexPathList, "nativeLibraryDirectories");

            List<File> libDirs = (List<File>) nativeLibraryDirectories.get(dexPathList);
            //去重
            if (libDirs == null) {
                libDirs = new ArrayList<>(2);
            }
            final Iterator<File> libDirIt = libDirs.iterator();
            while (libDirIt.hasNext()) {
                final File libDir = libDirIt.next();
                if (folder.equals(libDir)) {
                    libDirIt.remove();
                    Log.d(TAG, "dq libDirIt.remove()" + folder.getAbsolutePath());
                    break;
                }
            }

            libDirs.add(0, folder);
            //system/lib
            Field systemNativeLibraryDirectories = MkReflectUtil.findField(dexPathList, "systemNativeLibraryDirectories");
            List<File> systemLibDirs = (List<File>) systemNativeLibraryDirectories.get(dexPathList);

            //判空
            if (systemLibDirs == null) {
                systemLibDirs = new ArrayList<>(2);
            }
            //Log.d(TAG, "dq systemLibDirs,size=" + systemLibDirs.size());

            Method makePathElements = MkReflectUtil.findMethod(dexPathList, "makePathElements", List.class);
            libDirs.addAll(systemLibDirs);

            Object[] elements = (Object[]) makePathElements.invoke(dexPathList, libDirs);
            Field nativeLibraryPathElements = MkReflectUtil.findField(dexPathList, "nativeLibraryPathElements");
            nativeLibraryPathElements.setAccessible(true);
            nativeLibraryPathElements.set(dexPathList, elements);
        }
    }

注入 so 路径的逻辑如下:

1. APK 的 ClassLoader 的 pathList 的成员变量,
2. pathList 实际上是 SoPathList, 类的实例 的内部 成员变量 List 实例
3. 这个 List 存储的是 被加载的 so 文件实例

    /**
     * 1. 通过反射拿到dexElements的取值
     * 2. 将 findField 方法获取到的 object[] 插入到数组的最前面。
     * 3. 被插入的 object[] 数组就是外部修复包存储路径集合编译后形成的队列
     *    即外部修复包的资源和 .class 队列
     * @param instance 宿主 APK 的 ClassLoader实例的成员变量 pathList(DexPathList类似)
     * @param fieldName 需要被反射和替换的 DexPathList 类对象的成员变量 "dexElements", 用于存储 .dex 加载对象dex
     * @param extraElements 被加载的插件 apk 的 .dex实例列表
     */
    public static void expandFieldArray(Object instance, String fieldName, Object[] extraElements)
            throws NoSuchFieldException, IllegalArgumentException, IllegalAccessException {
        // 1 通过反射获取 classLoader 实例的成员变量 pathList(DexPathList类的实例)的成员变量dexElements
        Field jlrField = findField(instance, fieldName);
        // 2 获取当前dexElements 这个成员变量在classLoader 实例的成员变量 pathList(DexPathList类的实例)中的取值
        Object[] original = (Object[]) jlrField.get(instance);
        // 3 新建一个数组,这个数组用来容纳 宿主 apk .dex 文件加载出来的elements[] 和 插件apk .dex 文件加载出来的 elements[]
        Object[] combined = (Object[]) Array.newInstance(original.getClass().getComponentType(), original.length + extraElements.length);
      // 4 先把插件 apk 中获取的elements[] 以及 dexFileArr复制到数组里面,方便我们动态加载
        System.arraycopy(extraElements, 0, combined, 0, extraElements.length);
       // 5 再把apk所有的 dexElements 成员变量取值复制到数组里面
        System.arraycopy(original, 0, combined, extraElements.length, original.length);
         // 6 覆盖 dexElements 成员变量取值
        jlrField.set(instance, combined);
    }

参考

App极限瘦身: 动态下发so
插件化so库加载原理及实现