[原创]FART:ART环境下基于主动调用的自动化脱壳方案
FART:ART环境下基于主动调用的自动化脱壳方案
一、App启动流程
这里以一张图说明App进程的创建流程:

通过Zygote进程到最终进入到app进程世界,我们可以看到ActivityThread.main()是进入App世界的大门,下面对该函数体进行简要的分析,具体分析请看文末的参考链接。
5379 public static void main(String[] args) {
5380 Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain");
5381 SamplingProfilerIntegration.start();
5382
5383 // CloseGuard defaults to true and can be quite spammy. We
5384 // disable it here, but selectively enable it later (via
5385 // StrictMode) on debug builds, but using DropBox, not logs.
5386 CloseGuard.setEnabled(false);
5387
5388 Environment.initForCurrentUser();
5389
5390 // Set the reporter for event logging in libcore
5391 EventLogger.setReporter(new EventLoggingReporter());
5392
5393 AndroidKeyStoreProvider.install();
5394
5395 // Make sure TrustedCertificateStore looks in the right place for CA certificates
5396 final File configDir = Environment.getUserConfigDirectory(UserHandle.myUserId());
5397 TrustedCertificateStore.setDefaultUserDirectory(configDir);
5398
5399 Process.setArgV0("<pre-initialized>");
5400
5401 Looper.prepareMainLooper();
5402
5403 ActivityThread thread = new ActivityThread();
5404 thread.attach(false);
5405
5406 if (sMainThreadHandler == null) {
5407 sMainThreadHandler = thread.getHandler();
5408 }
5409
5410 if (false) {
5411 Looper.myLooper().setMessageLogging(new
5412 LogPrinter(Log.DEBUG, "ActivityThread"));
5413 }
5414
5415 // End of event ActivityThreadMain.
5416 Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
5417 Looper.loop();
5418
5419 throw new RuntimeException("Main thread loop unexpectedly exited");
5420 }
5421}
注意:上传附件及图片大小不得大于30M。
⚠️ 版权声明:
本博客所有内容(含教程、源码、工具)仅供个人技术学习与研究交流使用,严禁商用、倒卖、二次分发及非法用途。
未经作者书面授权,任何组织或个人不得转载、复制或用于其他平台,违者将追究相关责任。
复制成功
