1.什么是Hook今天我们就详细分析下(5)

Ok，有了代理对象，我们要做的就是偷梁换柱！代码比较简单，采用反射直接修改：
public static void attactContext() throws Exception{ // 先获取到当前的ActivityThread对象 Class<?> activityThreadClass = Class.forName("android.app.ActivityThread"); Field currentActivityThreadField = activityThreadClass.getDeclaredField("sCurrentActivityThread"); currentActivityThreadField.setAccessible(true); Object currentActivityThread = currentActivityThreadField.get(null); // 拿到原始的 mInstrumentation字段 Field mInstrumentationField = activityThreadClass.getField("mInstrumentation"); mInstrumentationField.setAccessible(true); Instrumentation mInstrumentation = (Instrumentation) mInstrumentationField.get(currentActivityThread); // 创建代理对象 Instrumentation evilInstrumentation = new EvilInstrumentation(mInstrumentation); // 偷梁换柱 mInstrumentationField.set(currentActivityThread, evilInstrumentation); }
好了，我们启动一个Activity测试一下，结果如下：