Java反射以及在Android中的特殊应用

public class Student {
    private int age;//年龄
    private String name;//姓名
    private String address;//地址
     private static String sTest;
    public Student() {
         throw new IllegalAccessError("Access to default Constructor Error!");
    }
    private Student(int age, String name, String address) {
        this.age = age;
        this.name = name;
        this.address = address;
         sTest = "测试反射";
    }
    private int getAge() {
        return age;
    }
    private void setAge(int age) {
        this.age = age;
    }
    private String getName() {
        return name;
    }
    private void setName(String name) {
        this.name = name;
    }
    private String getAddress() {
        return address;
    }
    private void setAddress(String address) {
        this.address = address;
    }
    private static String getTest() {
        return sTest;
    }
}

public class StudentClient {
    public static void main(String[] args) throws Exception{
        Class<?> clazz=Class.forName("ClassLoader.Student");
        Constructor constructors=clazz.getDeclaredConstructor(int.class,String.class,String.class);
        constructors.setAccessible(true);
        //利用构造器生成对象
        Object mStudent=constructors.newInstance(27,"小文","北京市海定区XX号");
        System.out.println(mStudent.toString());
        //获取隐藏的int属性
        Field mAgeField=clazz.getDeclaredField("age");
        mAgeField.setAccessible(true);
        int age= (int) mAgeField.get(mStudent);
        System.out.println("年龄为:"+age);
        //调用隐藏的方法
        Method getAddressMethod=clazz.getDeclaredMethod("getAge");
        getAddressMethod.setAccessible(true);
        int newage= (int) getAddressMethod.invoke(mStudent);
        System.out.println("年龄为:"+newage);
        //调用静态方法
        Method getTestMethod=clazz.getDeclaredMethod("getTest");
        getTestMethod.setAccessible(true);
        String result= (String) getTestMethod.invoke(null);
        System.out.println("调用静态方法:"+result);
    }
}

public void handleMessage(Message msg) {
    if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
    switch (msg.what) {
        case LAUNCH_ACTIVITY: {
            Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
            final ActivityClientRecord r = (ActivityClientRecord) msg.obj;
            r.packageInfo = getPackageInfoNoCheck(
                    r.activityInfo.applicationInfo, r.compatInfo);
            handleLaunchActivity(r, null, "LAUNCH_ACTIVITY");
            Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
        } 

private void handleLaunchActivity(ActivityClientRecord r, Intent customIntent, String reason) {
    // If we are getting ready to gc after going to the background, well
    // we are back active so skip it.
    unscheduleGcIdler();
    mSomeActivitiesChanged = true;
    if (r.profilerInfo != null) {
        mProfiler.setProfiler(r.profilerInfo);
        mProfiler.startProfiling();
    }
    // Make sure we are running with the most recent config.
    handleConfigurationChanged(null, null);
    if (localLOGV) Slog.v(
        TAG, "Handling launch of " + r);
    // Initialize before creating the activity
    WindowManagerGlobal.initialize();
    Activity a = performLaunchActivity(r, customIntent);
    ....
    }

Activity activity = null;
try {
//
    java.lang.ClassLoader cl = r.packageInfo.getClassLoader();
    //通过mInstrumentation.newActivity()方法创建了Activity,mInstrumentation是Instrumentation类的实例
    ，对象的类为:Instrumentation.java
    activity = mInstrumentation.newActivity(
            cl, component.getClassName(), r.intent);
    StrictMode.incrementExpectedActivityCount(activity.getClass());
    r.intent.setExtrasClassLoader(cl);
    r.intent.prepareToEnterProcess();
    if (r.state != null) {
        r.state.setClassLoader(cl);
    }
} catch (Exception e) {
    if (!mInstrumentation.onException(activity, e)) {
        throw new RuntimeException(
            "Unable to instantiate activity " + component
            + ": " + e.toString(), e);
    }
}

public Activity newActivity(Class<?> clazz, Context context, 
        IBinder token, Application application, Intent intent, ActivityInfo info, 
        CharSequence title, Activity parent, String id,
        Object lastNonConfigurationInstance) throws InstantiationException, 
        IllegalAccessException {
    Activity activity = (Activity)clazz.newInstance();
    ActivityThread aThread = null;
    activity.attach(context, aThread, this, token, 0, application, intent,
            info, title, parent, id,
            (Activity.NonConfigurationInstances)lastNonConfigurationInstance,
            new Configuration(), null, null, null);
    return activity;
}

public void dispatchMessage(Message msg) {
    if (msg.callback != null) {
        handleCallback(msg);
    } else {
        if (mCallback != null) {
            if (mCallback.handleMessage(msg)) {
                return;
            }
        }
        handleMessage(msg);
    }
}

public static void hookHandler(Context context) throws Exception {
    Class<?> activityThreadClass = Class.forName("android.app.ActivityThread");
    Method currentActivityThreadMethod = activityThreadClass.getDeclaredMethod("currentActivityThread");
    currentActivityThreadMethod.setAccessible(true);
    //获取主线程对象
    Object activityThread = currentActivityThreadMethod.invoke(null);
    //获取mH字段
    Field mH = activityThreadClass.getDeclaredField("mH");
    mH.setAccessible(true);
    //获取Handler
    Handler handler = (Handler) mH.get(activityThread);
    //获取原始的mCallBack字段
    Field mCallBack = Handler.class.getDeclaredField("mCallback");
    mCallBack.setAccessible(true);
    //这里设置了我们自己实现了接口的CallBack对象
    mCallBack.set(handler, new UserHandler(handler));
}

public class UserHandler  implements Callback {
    //这个100一般情况下最好也反射获取，当然了你也可以直接写死，跟系统的保持一致就好了
    public static final int LAUNCH_ACTIVITY = 100;
    private Handler origin;
    public UserHandler( Handler mHandler) {
        this.origin = mHandler;
    }
    @Override
    public boolean handleMessage(Message msg) {
        if (msg.what == LAUNCH_ACTIVITY) {
        //这样每次启动的时候可以做些额外的事情
            Log.d("[app]","做你想要的事情");
        }
        origin.handleMessage(msg);
        return false;
    }
}

public static void hookInstrumentation() throws Exception{
    Class<?> activityThread=Class.forName("android.app.ActivityThread");
    Method currentActivityThread=activityThread.getDeclaredMethod("currentActivityThread");
    currentActivityThread.setAccessible(true);
    //获取主线程对象
    Object activityThreadObject=currentActivityThread.invoke(null);
    //获取Instrumentation字段
    Field mInstrumentation=activityThread.getDeclaredField("mInstrumentation");
    mInstrumentation.setAccessible(true);
    Instrumentation instrumentation= (Instrumentation) mInstrumentation.get(activityThreadObject);
    CustomInstrumentation customInstrumentation=new CustomInstrumentation(instrumentation);
    //替换掉原来的,就是把系统的instrumentation替换为自己的Instrumentation对象
    mInstrumentation.set(activityThreadObject,CustomInstrumentation);
    Log.d("[app]","Hook Instrumentation成功");
}

public class CustomInstrumentation  extends Instrumentation{
    private Instrumentation base;
    public CustomInstrumentation(Instrumentation base) {
        this.base = base;
    }
    //重写创建Activity的方法
    @Override
    public Activity newActivity(ClassLoader cl, String className, Intent intent) throws InstantiationException, IllegalAccessException, ClassNotFoundException {
        Log.d("[app]","you are hook!,做自己想要的事情");
        Log.d("[app]","className="+className+" intent="+intent);
        return super.newActivity(cl, className, intent);
    }
}