import android.app.ActivityThread; //导入依赖的package包/类
private void hookIContentProviderAsNeeded() {
    Uri uri = Uri.parse(PluginContentResolver.getUri(mContext));
    mContext.getContentResolver().call(uri, "wakeup", null, null);
    try {
        Field authority = null;
        Field mProvider = null;
        ActivityThread activityThread = (ActivityThread) ReflectUtil.getActivityThread(mContext);
        Map mProviderMap = (Map) ReflectUtil.getField(activityThread.getClass(), activityThread, "mProviderMap");
        Iterator iter = mProviderMap.entrySet().iterator();
        while (iter.hasNext()) {
            Map.Entry entry = (Map.Entry) iter.next();
            Object key = entry.getKey();
            Object val = entry.getValue();
            String auth;
            if (key instanceof String) {
                auth = (String) key;
            } else {
                if (authority == null) {
                    authority = key.getClass().getDeclaredField("authority");
                    authority.setAccessible(true);
                }
                auth = (String) authority.get(key);
            }
            if (auth.equals(PluginContentResolver.getAuthority(mContext))) {
                if (mProvider == null) {
                    mProvider = val.getClass().getDeclaredField("mProvider");
                    mProvider.setAccessible(true);
                }
                IContentProvider rawProvider = (IContentProvider) mProvider.get(val);
                IContentProvider proxy = IContentProviderProxy.newInstance(mContext, rawProvider);
                mIContentProvider = proxy;
                Log.d(TAG, "hookIContentProvider succeed : " + mIContentProvider);
                break;
            }
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}
 

import android.app.ActivityThread; //导入依赖的package包/类
static void sendBroadcast(Intent intent) {
  try {

    ActivityThread.currentApplication().sendBroadcast(intent);
  } catch (Exception e) {
    e.printStackTrace();
    FLog.log(e);
  }
}
 

import android.app.ActivityThread; //导入依赖的package包/类
@Override
    protected void attachBaseContext(Context base) {
        super.attachBaseContext(base);
        //从PackageManager里拿取全部的Activity桩
        initStub();
        mainThread = ActivityThread.currentActivityThread();
// 主进程名
        mainProcessName = base.getApplicationInfo().processName;
        // 当前进程名
        processName = mainThread.getProcessName();
        if (processName.equals(mainProcessName)) {
            processType = ProcessType.Main;
        } else if (isAppProcess(processName)) {
            processType = ProcessType.VAppClient;
        } else {
            processType = ProcessType.CHILD;
        }
        mOriginPackageManager = this.getPackageManager();
        //此处注入补丁
        try {
            PatchManager.getInstance().injectAll();
            PatchManager.getInstance().checkEnv();
        } catch (Throwable throwable) {
            throwable.printStackTrace();
        }

    }
 

import android.app.ActivityThread; //导入依赖的package包/类
private CallerResult callClass(ClassCaller caller){
  CallerResult result = new CallerResult();
  try {
    ActivityThread activityThread = ActivityThread.currentActivityThread();
    Context context = activityThread.getSystemContext();
    Context packageContext = null;

    //create or from cache get context
    WeakReference<Context> contextWeakReference = sLocalContext.get(caller.getPackageName());
    if (contextWeakReference != null && contextWeakReference.get() != null) {
      packageContext = contextWeakReference.get();
    }
    if (packageContext == null) {
      packageContext = context.createPackageContext(caller.getPackageName(), Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY);
      sLocalContext.put(caller.getPackageName(), new WeakReference<Context>(packageContext));
    }

    //load class
    Class<?> aClass = sClassCache.get(caller.getClassName());
    Constructor<?> aConstructor = sConstructorCache.get(caller.getClassName());
    if (aClass == null || aConstructor == null) {

      aClass = Class.forName(caller.getClassName(), false, packageContext.getClassLoader());
      Class<?> processer=Class.forName(ClassCallerProcessor.class.getName(),false,packageContext.getClassLoader());

      if (processer.isAssignableFrom(aClass)) {
        sClassCache.put(caller.getClassName(), aClass);
        sConstructorCache.put(caller.getClassName(),aClass.getConstructor(Context.class,Context.class,byte[].class));
      }else {
        throw new ClassCastException("class "+aClass.getName()+"  need extends ClassCallerProcessor !");
      }
    }

    //if found class,invoke proxyInvoke method
    if (aClass != null) {

      Object o = null;
      if(aConstructor != null){

        o = aConstructor.newInstance(packageContext,context,ParcelableUtil.marshall(LifecycleAgent.serverRunInfo));
      }

      Object[] params = caller.getParams();
      if(params != null){
        for (Object param : params) {
          if(param instanceof Bundle){
            ((Bundle) param).setClassLoader(packageContext.getClassLoader());
          }
        }
      }

      FLog.log("------new object "+o+"  params "+Arrays.toString(params)+"    "+aClass);

      Object ret = MethodUtils.invokeExactMethod(o, "proxyInvoke", params,new Class[]{Bundle.class});
      if (ret != null && ret instanceof Bundle) {
        writeResult(result, ret);
      } else {
        writeResult(result, Bundle.EMPTY);
      }

    } else {
      throw new ClassNotFoundException("not found class " + caller.getClassName() + "  in package: " + caller.getPackageName());
    }

  } catch (Throwable e) {
    e.printStackTrace();
    FLog.log(e);
    result.setThrowable(e);
  }

  return result;
}
 

import android.app.ActivityThread; //导入依赖的package包/类
public static Context getSystemContext() {
    return ActivityThread.currentActivityThread().getSystemContext();
}
 

import android.app.ActivityThread; //导入依赖的package包/类
public static List<String> runCommand(boolean su, String command) {
    return runCommand(su, ActivityThread.currentActivityThread().getApplication().getPackageCodePath(), command);
}
 

import android.app.ActivityThread; //导入依赖的package包/类
public static Thread runCommandInBackground(boolean su, String command) {
    return runCommandInBackground(su, ActivityThread.currentActivityThread().getApplication().getPackageCodePath(), command);
}
 

import android.app.ActivityThread; //导入依赖的package包/类
/**
 * Get the activity thread for the current process
 * @return
 */
protected ActivityThread getActivityThread() {
    return thisActivityThread;
}
 

import android.app.ActivityThread; //导入依赖的package包/类
public void setActivityThread(ActivityThread thread) {thisActivityThread = thread;}