AndFix源码分析之一

AndFix是阿里巴巴的一个开源热修复框架,该框架使用方便,结构简单。

开发时,首先使用eclipse打开该框架,在activity中添加如下代码就可以完成开发。

private static final String APATCH_PATH &＃61; "/fix.apatch";public static PatchManager mPatchManager;// 最好是单例模式public static String TAG &＃61; "AndFix";&＃64;Overridepublic void onCreate(Bundle savedInstanceState){super.onCreate(savedInstanceState); mPatchManager &＃61; new PatchManager(this);mPatchManager.init("1.0"); // version mPatchManager.loadPatch(); String patchFileString &＃61; Environment.getExternalStorageDirectory().getAbsolutePath() &＃43; APATCH_PATH;File apatchPath &＃61; new File(patchFileString);if (apatchPath.exists()) {try { mPatchManager.addPatch(patchFileString); //添加apatch文件} catch (IOException e) {e.printStackTrace();}} •••}

这里的修复包是直接放在本地的&＃xff0c;在实际操作中会从网上去下载;并且修复包的名字为fix.apatch,保存在SD卡目录中。

以下几个章节逐个分析PatchManager的方法。

PatchManager的构造方法如下,

public PatchManager(Context context) {mContext &＃61; context;mAndFixManager &＃61; new AndFixManager(mContext);// 初始化mPatchDir &＃61; new File(mContext.getFilesDir(), DIR);mPatchs &＃61; new ConcurrentSkipListSet();mLoaders &＃61; new ConcurrentHashMap();}主要为5个变量赋值。

private final Context mContext; //进程上下文
private final AndFixManager mAndFixManager; // 热修复管理类
private final File mPatchDir;//apk中patch文件的绝对路径
private final SortedSet mPatchs;// 保存patch文件
private final Map mLoaders;// ClassLoader哈希表


如果是第三方apk,那么mPatchDir路径一般是

/data/data/包名/files/apatch/

从网上下载好修复包apatch文件之后&＃xff0c;会调用addPatch方法&＃xff0c;这时候会把修复包复制到这个地方&＃xff0c;以后再次启动时就会遍历这个目录加载apatch文件。

AndFixManager初始化流程图如下,

AndFixManager的构造方法如下,

public AndFixManager(Context context) {mContext &＃61; context;mSupport &＃61; Compat.isSupport();if (mSupport) {mSecurityChecker &＃61; new SecurityChecker(mContext);mOptDir &＃61; new File(mContext.getFilesDir(), DIR);if (!mOptDir.exists() && !mOptDir.mkdirs()) {//make directory failmSupport &＃61; false;Log.e(TAG, "opt dir create error.");} else if (!mOptDir.isDirectory()) {// not directorymOptDir.delete();mSupport &＃61; false;}}}

该方法首先调用Compat的isSupport方法判断当前环境是否支持热修复,然后构造SecurityChecker对象,检查修复包的签名安全。

2.1 是否支持热修复

Compat的isSupport方法如下,

public static synchronized boolean isSupport() {if (isChecked) // 如果已经进行检查,直接返回上次检查的结果return isSupport;isChecked &＃61; true;// not support alibaba&＃39;s YunOsif (!isYunOS() && AndFix.setup() && isSupportSDKVersion()) {isSupport &＃61; true;}if (inBlackList()) { //黑名单,该方法返回falseisSupport &＃61; false;}return isSupport;}

可以进行热修复的条件:非YunOS系统&＃xff0c;Android2.3-7.0系统版本&＃xff0c;热修复native层设置是否成功. 

isYunOS和isSupportSDKVersion方法很简单,这里主要看AndFix的setup方法,该方法如下,

public static boolean setup() {try {final String vmVersion &＃61; System.getProperty("java.vm.version");boolean isArt &＃61; vmVersion !&＃61; null && vmVersion.startsWith("2");int apilevel &＃61; Build.VERSION.SDK_INT;return setup(isArt, apilevel);} catch (Exception e) {Log.e(TAG, "setup", e);return false;}}

Android 5.0及以后都是使用ART,而之前都是使用dalvik虚拟机。为了兼容不同的android系统,本地C/C&＃43;&＃43;使用了2种类。如下图,

带参数的setup方法通过JNI机制进行调用。AndFix.java 对应的C&＃43;&＃43;文件是andfix.cpp。

andfix.cpp的setup方法如下,

static jboolean setup(JNIEnv* env, jclass clazz, jboolean isart,jint apilevel) {isArt &＃61; isart;LOGD("vm is: %s , apilevel is: %i", (isArt ? "art" : "dalvik"),(int )apilevel);if (isArt) {return art_setup(env, (int) apilevel);} else {return dalvik_setup(env, (int) apilevel);}
}


首先看ART中art_method_replace.cpp的art_setup方法,该方法直接返回true。

extern jboolean __attribute__ ((visibility ("hidden"))) art_setup(JNIEnv* env,int level) {apilevel &＃61; level;return JNI_TRUE;
}


Dalvik中对应dalvik_method_replace.cpp的dalvik _setup方法如下,

extern jboolean __attribute__ ((visibility ("hidden"))) dalvik_setup(JNIEnv* env, int apilevel) {void* dvm_hand &＃61; dlopen("libdvm.so", RTLD_NOW);if (dvm_hand) {dvmDecodeIndirectRef_fnPtr &＃61; dvm_dlsym(dvm_hand,apilevel > 10 ?"_Z20dvmDecodeIndirectRefP6ThreadP8_jobject" :"dvmDecodeIndirectRef");if (!dvmDecodeIndirectRef_fnPtr) {return JNI_FALSE;}dvmThreadSelf_fnPtr &＃61; dvm_dlsym(dvm_hand,apilevel > 10 ? "_Z13dvmThreadSelfv" : "dvmThreadSelf");if (!dvmThreadSelf_fnPtr) {return JNI_FALSE;}jclass clazz &＃61; env->FindClass("java/lang/reflect/Method");jClassMethod &＃61; env->GetMethodID(clazz, "getDeclaringClass","()Ljava/lang/Class;");return JNI_TRUE;} else {return JNI_FALSE;}
}


这里主要做一些初始化操作&＃xff0c;获取一些函数指针&＃xff0c;准备后续的replaceMethod函数中使用&＃xff1a;

1、在libdvm.so动态获取dvmDecodeIndirectRef函数指针和获取dvmThreadSelf函数指针。

2、调用dest的 Method.getDeclaringClass方法获取method的类对象clazz。

2.2 SecurityChecker初始化

SecurityChecker的构造方法如下,

public SecurityChecker(Context context) {mContext &＃61; context;init(mContext); // 进行初始化}


Init方法主要是进行初始化变量,为后面的热修复做准备。

private void init(Context context) {try {PackageManager pm &＃61; context.getPackageManager();String packageName &＃61; context.getPackageName();PackageInfo packageInfo &＃61; pm.getPackageInfo(packageName,PackageManager.GET_SIGNATURES);CertificateFactory certFactory &＃61; CertificateFactory.getInstance("X.509");ByteArrayInputStream stream &＃61; new ByteArrayInputStream(packageInfo.signatures[0].toByteArray());X509Certificate cert &＃61; (X509Certificate) certFactory.generateCertificate(stream);mDebuggable &＃61; cert.getSubjectX500Principal().equals(DEBUG_DN);mPublicKey &＃61; cert.getPublicKey();} catch (NameNotFoundException e) {Log.e(TAG, "init", e);} catch (CertificateException e) {Log.e(TAG, "init", e);}}

3, PatchManager初始化

PatchManager的init方法调用流程图如下,

init方法如下,

public void init(String appVersion) {if (!mPatchDir.exists() && !mPatchDir.mkdirs()) {// make directory failLog.e(TAG, "patch dir create error.");return;} else if (!mPatchDir.isDirectory()) {// not directorymPatchDir.delete();return;}SharedPreferences sp &＃61; mContext.getSharedPreferences(SP_NAME,Context.MODE_PRIVATE);String ver &＃61; sp.getString(SP_VERSION, null);if (ver &＃61;&＃61; null || !ver.equalsIgnoreCase(appVersion)) {cleanPatch();sp.edit().putString(SP_VERSION, appVersion).commit();} else {initPatchs();}}


判断当前PatchManager的版本号是否发生变化&＃xff0c;如果发生变化就清空本地所有的修复包。

如果没有变化&＃xff0c;直接调用initPatchs方法初始化修复包。

private void initPatchs() {File[] files &＃61; mPatchDir.listFiles();for (File file : files) {addPatch(file);}}


逐个对该apk 路径  /data/data/包名/files/apatch/ 下的文件调用addPatch方法,该方法如下,

private static final String SUFFIX &＃61; ".apatch";

private Patch addPatch(File file) {Patch patch &＃61; null;if (file.getName().endsWith(SUFFIX)) { try {patch &＃61; new Patch(file);mPatchs.add(patch);} catch (IOException e) {Log.e(TAG, "addPatch", e);}}return patch;}


如果文件以.apatch结尾(文件是.apatch类型的文件),就创建Patch对象,然后添加到mPatchs集合中。

实际上就是把该目录下所有的修复包文件加到列表中。

Patch中的构造方法会调用init方法,

private void init() throws IOException {JarFile jarFile &＃61; null;InputStream inputStream &＃61; null;try {jarFile &＃61; new JarFile(mFile);JarEntry entry &＃61; jarFile.getJarEntry(ENTRY_NAME);inputStream &＃61; jarFile.getInputStream(entry);Manifest manifest &＃61; new Manifest(inputStream);Attributes main &＃61; manifest.getMainAttributes();mName &＃61; main.getValue(PATCH_NAME);mTime &＃61; new Date(main.getValue(CREATED_TIME));mClassesMap &＃61; new HashMap>();Attributes.Name attrName;String name;List strings;for (Iterator it &＃61; main.keySet().iterator(); it.hasNext();) {attrName &＃61; (Attributes.Name) it.next();name &＃61; attrName.toString();if (name.endsWith(CLASSES)) {strings &＃61; Arrays.asList(main.getValue(attrName).split(","));if (name.equalsIgnoreCase(PATCH_CLASSES)) {mClassesMap.put(mName, strings);} else {mClassesMap.put(name.trim().substring(0, name.length() - 8),// remove// "-Classes"strings);}}}} finally {if (jarFile !&＃61; null) {jarFile.close();}if (inputStream !&＃61; null) {inputStream.close();}}}

主要就是通过JarFile类解析修复包文件&＃xff0c;读取META-INF\PATCH.MF文件内容&＃xff0c;获取需要修复类的名称&＃xff0c;

多个修复类之间用逗号分隔。修复包的相关信息都存储在以下变量中,

private final File mFile; // 修复包文件对象
private String mName; // 修复包名字
private Date mTime; // 创建时间
private Map> mClassesMap; //修复包中包含的类名