基本使用：http://www.jianshu.com/p/56d10037e116

基本原理
加载patch，使用DexFile读取其中的dex文件，根据注释，获得需要修改的类名和方法名，反射后得到bugMethod，在native层使用指针替换bug对象的属性；

Paste_Image.png

源码解析
在自定义Application类中，初始化PatchManager.

PatchManager mPatchManager = new PatchManager();

在源码中PatchManager的构造方法：

public PatchManager(Context context) {
  mContext = context;
  mAndFixManager = new AndFixManager(mContext);//初始化AndFxiManager
  mPatchDir = new File(mContext.getFilesDir(), DIR);//初始化存放patch的文件夹
  mPatchs = new ConcurrentSkipListSet<Patch>();//初始化存在patch类的集合，即需要修复类的集合
  mLoaders = new ConcurrentHashMap<String, ClassLoader>();//初始化类对应的classLoader集合
}

看AndFixManager的构造方法：

public AndFixManager(Context context) {
  mContext = context;
  mSupport = Compat.isSupport();//判断是否支持当前机型
  if (mSupport) {
    mSecurityChecker = new SecurityChecker(mContext);//
    mOptDir = new File(mContext.getFilesDir(), DIR);//初始化patch存放目录
    if (!mOptDir.exists() && !mOptDir.mkdirs()) {// make directory fail
      mSupport = false;
      Log.e(TAG, "opt dir create error.");
    } else if (!mOptDir.isDirectory()) {// not directory
      mOptDir.delete();
      mSupport = false;
    }
  }
}

其中，检查是否支持当前机型：

public static synchronized boolean isSupport() {
//isChecked保证只检查一次
if (isChecked)
  return isSupport;
  isChecked = true;
//判断是否为YunOs,是否已经初始化完成，是否为支持的sdk版本
if (!isYunOS() && AndFix.setup() && isSupportSDKVersion()) {
  isSupport = true;
}
//可自定义加入不予修复的名单中
if (inBlackList()) {
  isSupport = false;
}
  return isSupport;
}
@SuppressLint("DefaultLocale")
//判断是否为YunOS
private static boolean isYunOS() {
  String version = null;
  String vmName = null;
  try {
    Method m = Class.forName("android.os.SystemProperties").getMethod(
    "get", String.class);
    version = (String) m.invoke(null, "ro.yunos.version");
    vmName = (String) m.invoke(null, "java.vm.name");
    } catch (Exception e) {
    // nothing todo
    }
    if ((vmName != null && vmName.toLowerCase().contains("lemur"))
    || (version != null && version.trim().length() > 0)) {
    return true;
    }else {
      return false;
    }
}
//支持版本范围：2.3 to 6.0
private static boolean isSupportSDKVersion() {
  if (android.os.Build.VERSION.SDK_INT >= 8
  && android.os.Build.VERSION.SDK_INT <= 23) {
  return true;
}
  return false;
}
private static boolean inBlackList() {
  return false;
}

是否初始化：

public static boolean setup() {
  try {
    final String vmVersion = System.getProperty("java.vm.version");
    boolean isArt = vmVersion != null && vmVersion.startsWith("2");
      int apilevel = Build.VERSION.SDK_INT;//判断是Art or Dalvik
      return setup(isArt, apilevel);
  } catch (Exception e) {
    Log.e(TAG, "setup", e);
    return false;
   }
}

Art与Dalvik的区别：
Dalvik：即用于android的java虚拟机，与传统的JVM一样，是运行时编译；
Art：即Android run time，是在android4.4版本引入的安卓虚拟机。特点为在安装时编译，因此app只会在安装时编译一次，运行时不需要，提高了系统的运行效率。
使用中的初始化版本：

mPatchManager.init("version")

init源码：

public void init(String appVersion) {
  if (!mPatchDir.exists() && !mPatchDir.mkdirs()) {// make directory fail
  Log.e(TAG, "patch dir create error.");
  return;
  } else if (!mPatchDir.isDirectory()) {// not directory
  mPatchDir.delete();
  return;
  }
  //存储关于patch文件的信息
  SharedPreferences sp = mContext.getSharedPreferences(SP_NAME,
  Context.MODE_PRIVATE);
  String ver = sp.getString(SP_VERSION, null);
  //如果版本号与当前出入的版本号不同，则直接清空所有已加载的patch
  //否则进行初始化
  if (ver == null || !ver.equalsIgnoreCase(appVersion)) {
    cleanPatch();
    sp.edit().putString(SP_VERSION, appVersion).commit();
  } else {
    initPatchs();
  }
}

patch的初始化(通过JarFile来读取patch的内容)

private void init() throws IOException {
  JarFile jarFile = null;
  InputStream inputStream = null;
  try {
    jarFile = new JarFile(mFile);
    JarEntry entry = jarFile.getJarEntry(ENTRY_NAME);
    inputStream = jarFile.getInputStream(entry);
    Manifest manifest = new Manifest(inputStream);
    Attributes main = manifest.getMainAttributes();
    mName = main.getValue(PATCH_NAME);//获取META-INF/PATCH.MF
    mTime = new Date(main.getValue(CREATED_TIME));//
    mClassesMap = new HashMap<String, List<String>>();
    Attributes.Name attrName;
    String name;
    List<String> strings;
    for (Iterator<?> it = main.keySet().iterator(); it.hasNext();) {
      attrName = (Attributes.Name) it.next();
      name = attrName.toString();
      //判断name的后缀是否是-Classes，并把name对应的值加入到集合中，对应的值就是class类名的列表，在loadPatch的时候，会需要每个patch对应的类名集合
      if (name.endsWith(CLASSES)) {
        strings = Arrays.asList(main.getValue(attrName).split(","));
        if (name.equalsIgnoreCase(PATCH_CLASSES)) {//获取Patch-Name
          mClassesMap.put(mName, strings);
        } else {
          mClassesMap.put(name.trim().substring(0, name.length() - 8),//       remove
    strings);
     }
    }
  }
} finally {
  if (jarFile != null) {
    jarFile.close();
  }
  if (inputStream != null) {
    inputStream.close();
    }
  }
}

loadPatch

mPatchManager.loadPatch();

源码：

public void loadPatch() {
  mLoaders.put("*", mContext.getClassLoader());// wildcard
  Set<String> patchNames;
  List<String> classes;
  for (Patch patch : mPatchs) {
    patchNames = patch.getPatchNames();
    for (String patchName : patchNames) {
       classes = patch.getClasses(patchName);////获取patch对用的class类的集合List
       mAndFixManager.fix(patch.getFile(),mContext.getClassLoader(),classes);//bugFix
    }
  }
}

bugfix

public synchronized void fix(File file, ClassLoader classLoader,List<String> classes) {
  if (!mSupport) {
  return;
  }
  //检查patch的签名
  if (!mSecurityChecker.verifyApk(file)) {// security check fail
  return;
  }
  try {
    File optfile = new File(mOptDir, file.getName());
    boolean saveFingerprint = true;
    if (optfile.exists()) {
      if (mSecurityChecker.verifyOpt(optfile)) {
      saveFingerprint = false;
    } else if (!optfile.delete()) {
      return;
    }
  }
  //加载patch文件中的DexFile
  final DexFile dexFile = DexFile.loadDex(file.getAbsolutePath(),optfile.getAbsolutePath(), Context.MODE_PRIVATE);
  if (saveFingerprint) {
    mSecurityChecker.saveOptSig(optfile);
}
ClassLoader patchClassLoader = new ClassLoader(classLoader) {
//重写ClasLoader的findClass方法
@Override
protected Class<?> findClass(String className) throws ClassNotFoundException {
  Class<?> clazz = dexFile.loadClass(className, this);
  if (clazz == null&& className.startsWith("com.alipay.euler.andfix")) {
    return Class.forName(className);// annotation’s class
   }
  if (clazz == null) {
    throw new ClassNotFoundException(className);
   }
  return clazz;
  }
};

Enumeration<String> entrys = dexFile.entries();
Class<?> clazz = null;
while (entrys.hasMoreElements()) {
  String entry = entrys.nextElement();
  if (classes != null && !classes.contains(entry)) {
    continue;// skip, not need fix
    }
    clazz = dexFile.loadClass(entry, patchClassLoader);
    if (clazz != null) {
      fixClass(clazz, classLoader);
    }
  }
} catch (IOException e) {
Log.e(TAG, "pacth", e);
  }
}

private void fixClass(Class<?> clazz, ClassLoader classLoader) {
  Method[] methods = clazz.getDeclaredMethods();
  MethodReplace methodReplace;
  String clz;
  String meth;
  for (Method method : methods) {
  //获取此方法的注解
    methodReplace = method.getAnnotation(MethodReplace.class);
    if (methodReplace == null)
      continue;
    clz = methodReplace.clazz();//获取注解中clazz的值
    meth = methodReplace.method();//获取注解中method的值
    if (!isEmpty(clz) && !isEmpty(meth)) {
      replaceMethod(classLoader, clz, meth, method);
    }
  }
}

private void replaceMethod(ClassLoader classLoader, String clz,
String meth, Method method) {
  try {
    String key = clz + "@" + classLoader.toString();
    Class<?> clazz = mFixedClass.get(key);
    if (clazz == null) {// class not load
      Class<?> clzz = classLoader.loadClass(clz);
      // initialize target class
      clazz = AndFix.initTargetClass(clzz);
    }
    if (clazz != null) {// initialize class OK
      mFixedClass.put(key, clazz);
      Method src = clazz.getDeclaredMethod(meth, method.getParameterTypes());//获取有bug的method
      AndFix.addReplaceMethod(src, method);//native层中替换指针
     }
  } catch (Exception e) {
    Log.e(TAG, "replaceMethod", e);
  }
}

反编译dex文件

Paste_Image.png

可看到其中注释，包括类名+方法名