一：Hook AMS

1.1 理論基礎
ActivityManagerNative是ActivityManagerService這個遠程對象的Binder代理對象；每次需要與AMS打交道的時候，需要借助這個代理對象通過驅動進而完成IPC調用。
比如啟動一個Activity時，通過ActivityManagerNative.getDefault()
.startActivity()將啟動Activity的請求轉發給ActivityManagerService

public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    // ... 省略無關代碼
    try {
        intent.migrateExtraStreamToClipData();
        intent.prepareToLeaveProcess();
        // ----------------look here!!!!!!!!!!!!!!!!!!!
        int result = ActivityManagerNative.getDefault()
            .startActivity(whoThread, who.getBasePackageName(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()),
                    token, target != null ? target.mEmbeddedID : null,
                    requestCode, 0, null, null, options);
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
    }
    return null;
}

ActivityManagerNative.getDefault()： 調用了gDefault.get()

static public IActivityManager getDefault()
 {
     return gDefault.get();
 }

gDefault ： gDefault是一個單例。 里面保存的對象是IActivityManager單例。實際返回的是ActivityManagerProxy。
IBinder b 為裸Binder對象，是遠程的Binder對象經過Binder驅動轉化后返回給App 進程的對象。

private static final Singleton<IActivityManager> gDefault = new Singleton<IActivityManager>() {
      protected IActivityManager create() {
           IBinder b = ServiceManager.getService("activity");
     // IBinder b 為裸Binder對象，是遠程的Binder對象經過Binder驅動轉化后返回給App 進程的對象。
            if (false) {
                Log.v("ActivityManager", "default service binder = " + b);
          }
            IActivityManager am = asInterface(b);
            //轉換成ActivityManagerProxy
           if (false) {
               Log.v("ActivityManager", "default service = " + am);
           }
            return am;
       }
    };
}

1.2 Hook AMS
我們使用的AMS實際上ActivityManagerProxy，要Hook掉AMS只需Hook掉gDefault里面保存單例對象。使的通過gDefault獲取到的單例為我們的Hook 對象，這就需要把Singleton里面的mInstance字段置為Hook 對象。

Class<?> activityManagerNativeClass = Class.forName("android.app.ActivityManagerNative");

// 獲取 gDefault 這個字段, 想辦法替換它
Field gDefaultField = activityManagerNativeClass.getDeclaredField("gDefault");
gDefaultField.setAccessible(true);
Object gDefault = gDefaultField.get(null);

// 4.x以上的gDefault是一個 android.util.Singleton對象; 我們取出這個單例里面的字段
Class<?> singleton = Class.forName("android.util.Singleton");
Field mInstanceField = singleton.getDeclaredField("mInstance");
mInstanceField.setAccessible(true);

// ActivityManagerNative 的gDefault對象里面原始的 IActivityManager對象
Object rawIActivityManager = mInstanceField.get(gDefault);

// 創建一個這個對象的代理對象, 然后替換這個字段, 讓我們的代理對象幫忙干活
Class<?> iActivityManagerInterface = Class.forName("android.app.IActivityManager");
Object proxy = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(),
        new Class<?>[] { iActivityManagerInterface }, new IActivityManagerHandler(rawIActivityManager));
mInstanceField.set(gDefault, proxy);

二：Hook PMS

ContextImpl.getPackageManager()
PMS的獲取是通過ContextImpl.getPackageManager來獲取的，mPackageManager是不是一個靜態字段。所以這不是一個好的Hook點
這個方法返回的是包裝對象ApplicationPackageManager

public PackageManager getPackageManager() {
    if (mPackageManager != null) {
        return mPackageManager;
    }

    IPackageManager pm = ActivityThread.getPackageManager();
    if (pm != null) {
        // Doesn't matter if we make more than one instance.
        return (mPackageManager = new ApplicationPackageManager(this, pm));
    }
    return null;
}

ActivityThread.getPackageManager()
使用了ServiceManager來獲取IPackagerManager
sPackageManager 是ActivityThead里面的一個靜態字段， Hook掉這個靜態字段來達到Hook掉PMS的目的。
通過Context類的getPackageManager方法獲取到的ApplicationPackageManager對象里面的mPM字段同樣需要Hook掉。

public static IPackageManager getPackageManager() {
    if (sPackageManager != null) {
        return sPackageManager;
    }
    IBinder b = ServiceManager.getService("package");
    sPackageManager = IPackageManager.Stub.asInterface(b);
    return sPackageManager;
}

Hook代碼

// 獲取全局的ActivityThread對象
Class<?> activityThreadClass = Class.forName("android.app.ActivityThread");
Method currentActivityThreadMethod = activityThreadClass.getDeclaredMethod("currentActivityThread");
Object currentActivityThread = currentActivityThreadMethod.invoke(null);

// 獲取ActivityThread里面原始的 sPackageManager
Field sPackageManagerField = activityThreadClass.getDeclaredField("sPackageManager");
sPackageManagerField.setAccessible(true);
Object sPackageManager = sPackageManagerField.get(currentActivityThread);

// 準備好代理對象, 用來替換原始的對象
Class<?> iPackageManagerInterface = Class.forName("android.content.pm.IPackageManager");
Object proxy = Proxy.newProxyInstance(iPackageManagerInterface.getClassLoader(),
        new Class<?>[] { iPackageManagerInterface },
        new HookHandler(sPackageManager));

// 1. 替換掉ActivityThread里面的 sPackageManager 字段
sPackageManagerField.set(currentActivityThread, proxy);

// 2. 替換 ApplicationPackageManager里面的 mPM對象
PackageManager pm = context.getPackageManager();
Field mPmField = pm.getClass().getDeclaredField("mPM");
mPmField.setAccessible(true);
mPmField.set(pm, proxy);