1. 说明
Android 7.0 后使用 dlopen 函数无法获取 soinfo 对应，因此也无法使用 dlsym 函数去调用第三方的 so 内的函数。这里给出 dlopen() 函数的源码分析。
不同点可参考：https://blog.csdn.net/u011247544/article/details/75262360
2. 源码分析
1. dlopen 函数
函数调用会首先走到 dlfcn.cpp 类内的 dlopen 函数（/bionic/linker/dlfcn.cpp）
85void* dlopen(const char* filename, int flags) {
86 void* caller_addr = __builtin_return_address(0);
87 return dlopen_ext(filename, flags, nullptr, caller_addr);
88}
69static void* dlopen_ext(const char* filename, int flags,
70 const android_dlextinfo* extinfo, void* caller_addr) {
71 ScopedPthreadMutexLocker locker(&g_dl_mutex);
72 void* result = do_dlopen(filename, flags, extinfo, caller_addr); // 调到 linker.cpp 类内
73 if (result == nullptr) {
74 __bionic_format_dlerror("dlopen failed", linker_get_error_buffer());
75 return nullptr;
76 }
77 return result;
78}
2. do_dlopen() 函数
这个函数实现在 linker.cpp 类内。do_dlopen 函数会调用 find_library 函数返回 soinfo 对象，并最终调用 si->to_handle() 函数返回 handle_。（/bionic/linker/linker.cpp）
2333void* do_dlopen(const char* name, int flags, const android_dlextinfo* extinfo,
2334 void* caller_addr) {
2335 soinfo* const caller = find_containing_library(caller_addr);
2336
2337 if ((flags & ~(RTLD_NOW|RTLD_LAZY|RTLD_LOCAL|RTLD_GLOBAL|RTLD_NODELETE|RTLD_NOLOAD)) != 0) {
2338 DL_ERR("invalid flags to dlopen: %x", flags);
2339 return nullptr;
2340 }
2341
2342 android_namespace_t* ns = get_caller_namespace(caller);
2343
2344 if (extinfo != nullptr) {
2345 if ((extinfo->flags & ~(ANDROID_DLEXT_VALID_FLAG_BITS)) != 0) {
2346 DL_ERR("invalid extended flags to android_dlopen_ext: 0x%" PRIx64, extinfo->flags);
2347 return nullptr;
2348 }
2349
2350 if ((extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD) == 0 &&
2351 (extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET) != 0) {
2352 DL_ERR("invalid extended flag combination (ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET without "
2353 "ANDROID_DLEXT_USE_LIBRARY_FD): 0x%" PRIx64, extinfo->flags);
2354 return nullptr;
2355 }
2356
2357 if ((extinfo->flags & ANDROID_DLEXT_LOAD_AT_FIXED_ADDRESS) != 0 &&
2358 (extinfo->flags & (ANDROID_DLEXT_RESERVED_ADDRESS | ANDROID_DLEXT_RESERVED_ADDRESS_HINT)) != 0) {
2359 DL_ERR("invalid extended flag combination: ANDROID_DLEXT_LOAD_AT_FIXED_ADDRESS is not "
2360 "compatible with ANDROID_DLEXT_RESERVED_ADDRESS/ANDROID_DLEXT_RESERVED_ADDRESS_HINT");
2361 return nullptr;
2362 }
2363
2364 if ((extinfo->flags & ANDROID_DLEXT_USE_NAMESPACE) != 0) {
2365 if (extinfo->library_namespace == nullptr) {
2366 DL_ERR("ANDROID_DLEXT_USE_NAMESPACE is set but extinfo->library_namespace is null");
2367 return nullptr;
2368 }
2369 ns = extinfo->library_namespace;
2370 }
2371 }
2372
2373 ProtectedDataGuard guard;
2374 soinfo* si = find_library(ns, name, flags, extinfo, caller); // 这里往下调用返回 soinfo 对象
2375 if (si != nullptr) {
2376 si->call_constructors();
2377 return si->to_handle(); // 这里返回的是 调用 to_handle() 函数
2378 }
2379
2380 return nullptr;
2381}
下面给处 find_library 函数的追踪：
首先是 find_library 函数
2159static soinfo* find_library(android_namespace_t* ns,
2160 const char* name, int rtld_flags,
2161 const android_dlextinfo* extinfo,
2162 soinfo* needed_by) {
2163 soinfo* si;
2164
2165 if (name == nullptr) {
2166 si = somain;
2167 } else if (!find_libraries(ns, needed_by, &name, 1, &si, nullptr, 0, rtld_flags,
2168 extinfo, /* add_as_children */ false)) {
2169 return nullptr;
2170 }
2171
2172 return si;
2173}
接着是 find_libraries 函数，源码分析知道这个函数分为 4 步，暂未做具体分析
1994static bool find_libraries(android_namespace_t* ns,
1995 soinfo* start_with,
1996 const char* const library_names[],
1997 size_t library_names_count, soinfo* soinfos[],
1998 std::vector<soinfo*>* ld_preloads,
1999 size_t ld_preloads_count, int rtld_flags,
2000 const android_dlextinfo* extinfo,
2001 bool add_as_children) {
2002 // Step 0: prepare.
2003 LoadTaskList load_tasks;
2004 std::unordered_map<const soinfo*, ElfReader> readers_map;
...
2053 if(!find_library_internal(ns, task, &zip_archive_cache, &load_tasks, rtld_flags)) {
2054 return false;
2055 }
...
2156 return linked;
2157}
然后是 find_library_internal 函数
1896static bool find_library_internal(android_namespace_t* ns,
1897 LoadTask* task,
1898 ZipArchiveCache* zip_archive_cache,
1899 LoadTaskList* load_tasks,
1900 int rtld_flags) {
1901 soinfo* candidate;
1902
1903 if (find_loaded_library_by_soname(ns, task->get_name(), &candidate)) {
1904 task->set_soinfo(candidate);
1905 return true;
1906 }
1907
1908 if (ns != &g_default_namespace) {
1909 // check public namespace
1910 candidate = g_public_namespace.find_if([&](soinfo* si) {
1911 return strcmp(task->get_name(), si->get_soname()) == 0;
1912 });
1913
1914 if (candidate != nullptr) {
1915 ns->add_soinfo(candidate);
1916 task->set_soinfo(candidate);
1917 return true;
1918 }
1919 }
1920
1921 // Library might still be loaded, the accurate detection
1922 // of this fact is done by load_library.
1923 TRACE("[ \"%s\" find_loaded_library_by_soname failed (*candidate=%s@%p). Trying harder...]",
1924 task->get_name(), candidate == nullptr ? "n/a" : candidate->get_realpath(), candidate);
1925
1926 if (load_library(ns, task, zip_archive_cache, load_tasks, rtld_flags)) {
1927 return true;
1928 } else {
1929 // In case we were unable to load the library but there
1930 // is a candidate loaded under the same soname but different
1931 // sdk level - return it anyways.
1932 if (candidate != nullptr) {
1933 task->set_soinfo(candidate);
1934 return true;
1935 }
1936 }
1937
1938 return false;
1939}
3. soinfo::to_handle() 函数
（/bionic/linker/linker.cpp）
do_dlopen 函数的最终返回是这个函数的返回，看下 这个函数的实现：
3442void* soinfo::to_handle() {
3443 if (get_application_target_sdk_version() <= 23 || !has_min_version(3)) {
3444 return this;
3445 }
3446
3447 return reinterpret_cast<void*>(get_handle());
3448}
然后调用了 get_handle() 函数。这个函数就是返回了 handle_
3436uintptr_t soinfo::get_handle() const {
3437 CHECK(has_min_version(3));
3438 CHECK(handle_ != 0);
3439 return handle_;
3440}
那 handle_ 的生成是在哪里呢？是在同目录下的 generate_handle 函数
3450void soinfo::generate_handle() {
3451 CHECK(has_min_version(3));
3452 CHECK(handle_ == 0); // Make sure this is the first call
3453
3454 // Make sure the handle is unique and does not collide
3455 // with special values which are RTLD_DEFAULT and RTLD_NEXT.
3456 do {
3457 arc4random_buf(&handle_, sizeof(handle_));
3458 // the least significant bit for the handle is always 1
3459 // making it easy to test the type of handle passed to
3460 // dl* functions.
3461 handle_ = handle_ | 1;
3462 } while (handle_ == reinterpret_cast<uintptr_t>(RTLD_DEFAULT) ||
3463 handle_ == reinterpret_cast<uintptr_t>(RTLD_NEXT) ||
3464 g_soinfo_handles_map.find(handle_) != g_soinfo_handles_map.end());
3465
3466 g_soinfo_handles_map[handle_] = this;
3467}
由上可以看出， handle_ 是 arc4random_buf(&handle_, sizeof(handle_)); 函数生成的随机值。并将这个值放到 static std::unordered_map<uintptr_t, soinfo*> g_soinfo_handles_map 内，这个值与 soinfo 对应。
4. soinfo 结构体
soinfo 结构体就是 so 文件解析后的数据信息，解析处的 节信息，等等等等~~
176struct soinfo {
177 public:
178 typedef LinkedList<soinfo, SoinfoListAllocator> soinfo_list_t;
179 typedef LinkedList<android_namespace_t, NamespaceListAllocator> android_namespace_list_t;
180#if defined(__work_around_b_24465209__)
181 private:
182 char old_name_[SOINFO_NAME_LEN];
183#endif
184 public:
185 const ElfW(Phdr)* phdr;
186 size_t phnum;
187 ElfW(Addr) entry;
188 ElfW(Addr) base;
189 size_t size;
190
191#if defined(__work_around_b_24465209__)
192 uint32_t unused1; // DO NOT USE, maintained for compatibility.
193#endif
194
195 ElfW(Dyn)* dynamic;
196
197#if defined(__work_around_b_24465209__)
198 uint32_t unused2; // DO NOT USE, maintained for compatibility
199 uint32_t unused3; // DO NOT USE, maintained for compatibility
200#endif
201
202 soinfo* next;
203 private:
204 uint32_t flags_;
205
206 const char* strtab_;
207 ElfW(Sym)* symtab_;
208
209 size_t nbucket_;
210 size_t nchain_;
211 uint32_t* bucket_;
212 uint32_t* chain_;
213
214#if defined(__mips__) || !defined(__LP64__)
215 // This is only used by mips and mips64, but needs to be here for
216 // all 32-bit architectures to preserve binary compatibility.
217 ElfW(Addr)** plt_got_;
218#endif
219
220#if defined(USE_RELA)
221 ElfW(Rela)* plt_rela_;
222 size_t plt_rela_count_;
223
224 ElfW(Rela)* rela_;
225 size_t rela_count_;
226#else
227 ElfW(Rel)* plt_rel_;
228 size_t plt_rel_count_;
229
230 ElfW(Rel)* rel_;
231 size_t rel_count_;
232#endif
233
234 linker_function_t* preinit_array_;
235 size_t preinit_array_count_;
236
237 linker_function_t* init_array_;
238 size_t init_array_count_;
239 linker_function_t* fini_array_;
240 size_t fini_array_count_;
241
242 linker_function_t init_func_;
243 linker_function_t fini_func_;
244
245#if defined(__arm__)
246 public:
247 // ARM EABI section used for stack unwinding.
248 uint32_t* ARM_exidx;
249 size_t ARM_exidx_count;
250 private:
251#elif defined(__mips__)
252 uint32_t mips_symtabno_;
253 uint32_t mips_local_gotno_;
254 uint32_t mips_gotsym_;
255 bool mips_relocate_got(const VersionTracker& version_tracker,
256 const soinfo_list_t& global_group,
257 const soinfo_list_t& local_group);
258#if !defined(__LP64__)
259 bool mips_check_and_adjust_fp_modes();
260#endif
261#endif
262 size_t ref_count_;
263 public:
264 link_map link_map_head;
265
266 bool constructors_called;
267
268 // When you read a virtual address from the ELF file, add this
269 // value to get the corresponding address in the process' address space.
270 ElfW(Addr) load_bias;
271
272#if !defined(__LP64__)
273 bool has_text_relocations;
274#endif
275 bool has_DT_SYMBOLIC;
276
277 public:
278 soinfo(android_namespace_t* ns, const char* name, const struct stat* file_stat,
279 off64_t file_offset, int rtld_flags);
280 ~soinfo();
281
282 void call_constructors();
283 void call_destructors();
284 void call_pre_init_constructors();
285 bool prelink_image();
286 bool link_image(const soinfo_list_t& global_group, const soinfo_list_t& local_group,
287 const android_dlextinfo* extinfo);
288 bool protect_relro();
289
290 void add_child(soinfo* child);
291 void remove_all_links();
292
293 ino_t get_st_ino() const;
294 dev_t get_st_dev() const;
295 off64_t get_file_offset() const;
296
297 uint32_t get_rtld_flags() const;
298 uint32_t get_dt_flags_1() const;
299 void set_dt_flags_1(uint32_t dt_flags_1);
300
301 soinfo_list_t& get_children();
302 const soinfo_list_t& get_children() const;
303
304 soinfo_list_t& get_parents();
305
306 bool find_symbol_by_name(SymbolName& symbol_name,
307 const version_info* vi,
308 const ElfW(Sym)** symbol) const;
309
310 ElfW(Sym)* find_symbol_by_address(const void* addr);
311 ElfW(Addr) resolve_symbol_address(const ElfW(Sym)* s) const;
312
313 const char* get_string(ElfW(Word) index) const;
314 bool can_unload() const;
315 bool is_gnu_hash() const;
316
317 bool inline has_min_version(uint32_t min_version __unused) const {
318#if defined(__work_around_b_24465209__)
319 return (flags_ & FLAG_NEW_SOINFO) != 0 && version_ >= min_version;
320#else
321 return true;
322#endif
323 }
325 bool is_linked() const;
326 bool is_linker() const;
327 bool is_main_executable() const;
328
329 void set_linked();
330 void set_linker_flag();
331 void set_main_executable();
332 void set_nodelete();
333
334 void increment_ref_count();
335 size_t decrement_ref_count();
336
337 soinfo* get_local_group_root() const;
338
339 void set_soname(const char* soname);
340 const char* get_soname() const;
341 const char* get_realpath() const;
342 const ElfW(Versym)* get_versym(size_t n) const;
343 ElfW(Addr) get_verneed_ptr() const;
344 size_t get_verneed_cnt() const;
345 ElfW(Addr) get_verdef_ptr() const;
346 size_t get_verdef_cnt() const;
347
348 bool find_verdef_version_index(const version_info* vi, ElfW(Versym)* versym) const;
349
350 uint32_t get_target_sdk_version() const;
351
352 void set_dt_runpath(const char *);
353 const std::vector<std::string>& get_dt_runpath() const;
354 android_namespace_t* get_primary_namespace();
355 void add_secondary_namespace(android_namespace_t* secondary_ns);
356
357 void set_mapped_by_caller(bool reserved_map);
358 bool is_mapped_by_caller() const;
359
360 uintptr_t get_handle() const;
361 void generate_handle();
362 void* to_handle();
363
364 private:
365 bool elf_lookup(SymbolName& symbol_name, const version_info* vi, uint32_t* symbol_index) const;
366 ElfW(Sym)* elf_addr_lookup(const void* addr);
367 bool gnu_lookup(SymbolName& symbol_name, const version_info* vi, uint32_t* symbol_index) const;
368 ElfW(Sym)* gnu_addr_lookup(const void* addr);
369
370 bool lookup_version_info(const VersionTracker& version_tracker, ElfW(Word) sym,
371 const char* sym_name, const version_info** vi);
372
373 void call_array(const char* array_name, linker_function_t* functions, size_t count, bool reverse);
374 void call_function(const char* function_name, linker_function_t function);
375 template<typename ElfRelIteratorT>
376 bool relocate(const VersionTracker& version_tracker, ElfRelIteratorT&& rel_iterator,
377 const soinfo_list_t& global_group, const soinfo_list_t& local_group);
378
379 private:
380 // This part of the structure is only available
381 // when FLAG_NEW_SOINFO is set in this->flags.
382 uint32_t version_;
383
384 // version >= 0
385 dev_t st_dev_;
386 ino_t st_ino_;
387
388 // dependency graph
389 soinfo_list_t children_;
390 soinfo_list_t parents_;
391
392 // version >= 1
393 off64_t file_offset_;
394 uint32_t rtld_flags_;
395 uint32_t dt_flags_1_;
396 size_t strtab_size_;
397
398 // version >= 2
399
400 size_t gnu_nbucket_;
401 uint32_t* gnu_bucket_;
402 uint32_t* gnu_chain_;
403 uint32_t gnu_maskwords_;
404 uint32_t gnu_shift2_;
405 ElfW(Addr)* gnu_bloom_filter_;
406
407 soinfo* local_group_root_;
408
409 uint8_t* android_relocs_;
410 size_t android_relocs_size_;
411
412 const char* soname_;
413 std::string realpath_;
414
415 const ElfW(Versym)* versym_;
416
417 ElfW(Addr) verdef_ptr_;
418 size_t verdef_cnt_;
419
420 ElfW(Addr) verneed_ptr_;
421 size_t verneed_cnt_;
422
423 uint32_t target_sdk_version_;
424
425 // version >= 3
426 std::vector<std::string> dt_runpath_;
427 android_namespace_t* primary_namespace_;
428 android_namespace_list_t secondary_namespaces_;
429 uintptr_t handle_;
430
431 friend soinfo* get_libdl_info();
432};
