插件化so库加载原理及实现

当我们调用当调用 System#loadLibrary(“xxx” ) 后，Android Framework 都干了些了啥?

static { System.loadLibrary("ymm_log"); }

在看下System类的实现：

public static void loadLibrary(String libname) { Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), libname); }

synchronized void loadLibrary0(ClassLoader loader, String libname) { if (libname.indexOf((int)File.separatorChar) != -1) { throw new UnsatisfiedLinkError( "Directory separator should not appear in library name: " + libname); } String libraryName = libname; if (loader != null) { String filename = loader.findLibrary(libraryName); if (filename == null) { // It's not necessarily true that the ClassLoader used // System.mapLibraryName, but the default setup does, and it's // misleading to say we didn't find "libMyLibrary.so" when we // actually searched for "liblibMyLibrary.so.so". throw new UnsatisfiedLinkError(loader + " couldn't find "" + System.mapLibraryName(libraryName) + """); } String error = doLoad(filename, loader); if (error != null) { throw new UnsatisfiedLinkError(error); } return; } String filename = System.mapLibraryName(libraryName); List candidates = new ArrayList(); String lastError = null; for (String directory : getLibPaths()) { String candidate = directory + filename; candidates.add(candidate); if (IoUtils.canOpenReadOnly(candidate)) { String error = doLoad(candidate, loader); if (error == null) { return; // We successfully loaded the library. Job done. } lastError = error; } } if (lastError != null) { throw new UnsatisfiedLinkError(lastError); } throw new UnsatisfiedLinkError("Library " + libraryName + " not found; tried " + candidates); } private String doLoad(String name, ClassLoader loader) { // Android apps are forked from the zygote, so they can't have a custom LD_LIBRARY_PATH, // which means that by default an app's shared library directory isn't on LD_LIBRARY_PATH. // The PathClassLoader set up by frameworks/base knows the appropriate path, so we can load // libraries with no dependencies just fine, but an app that has multiple libraries that // depend on each other needed to load them in most-dependent-first order. // We added API to Android's dynamic linker so we can update the library path used for // the currently-running process. We pull the desired path out of the ClassLoader here // and pass it to nativeLoad so that it can call the private dynamic linker API. // We didn't just change frameworks/base to update the LD_LIBRARY_PATH once at the // beginning because multiple apks can run in the same process and third party code can // use its own BaseDexClassLoader. // We didn't just add a dlopen_with_custom_LD_LIBRARY_PATH call because we wanted any // dlopen(3) calls made from a .so's JNI_OnLoad to work too. // So, find out what the native library search path is for the ClassLoader in question... String librarySearchPath = null; if (loader != null && loader instanceof BaseDexClassLoader) { BaseDexClassLoader dexClassLoader = (BaseDexClassLoader) loader; librarySearchPath = dexClassLoader.getLdLibraryPath(); } // nativeLoad should be synchronized so there's only one LD_LIBRARY_PATH in use regardless // of how many ClassLoaders are in the system, but dalvik doesn't support synchronized // internal natives. synchronized (this) { return nativeLoad(name, loader, librarySearchPath); } }

获取so文件名的方式，就是从classLoader中获取，最终加载时通过本地方法nativeLoad实现

String filename = loader.findLibrary(libraryName)

其实现在BaseDexClassLoader

@Override public String findLibrary(String name) { return pathList.findLibrary(name); } 方案分析:

1. JNI 代码内置方案

代码隔离方案比较适合新增的 Native 模块，一开始就奔着动态化、延迟加载的方向去。

2. 插件化方案

单独把 so 文件单独打包进插件包，JNI 代码保留在宿主代码内部

由于 nativeLibraryDirectories 的具体实现是一个 ArrayList 实例，其元素读写操作自身是不保证线程安全的

1. 安全性问题

所有可执行代码在拷贝安装到安全路径（比如 Android 的 data/data 内部路径）之前，都有被劫持或者破坏的风险。

最好的做法是每次加载 so 库之前都对其做一次安全性校验。

最简单的方式是记录 so 文件的 MD5 或者 CRC 等 Hash 信息（粒度可以是每个单独的 so 文件，或者一批 so 文件的压缩包）

如果本地下载目录中的 so 文件总数目，少于预定义在集合里 so 文件数目,说明不完整

2. 版本控制问题

通过版本控制流程，我们可以在服务端禁用这个版本的 so 插件，从而使客户端进入“so 插件不可用”的逻辑，而不至于执行有问题的代码。

3. abi 兼容性判断

检查 so 插件包里的 so 库 abi 信息是否与宿主目前运行时的 abi 一致。

直接指定你 so 下载的路径,通过反射获取 android.os.SystemProperties 私有方法 get ro.product.cpu.abi 可以动态获取 CPU 架构

/** * 获取设备的cpu架构类型 */ public static String getCpuArchType() { if (!TextUtils.isEmpty(cpuArchType)) { return cpuArchType; } try { Class> clazz = Class.forName("android.os.SystemProperties"); Method get = clazz.getDeclaredMethod("get", new Class[]{String.class}); cpuArchType = (String) get.invoke(clazz, new Object[]{"ro.product.cpu.abi"}); } catch (Exception e) { } try { if (TextUtils.isEmpty(cpuArchType)) { cpuArchType = Build.CPU_ABI;//获取不到，重新获取，可能不准确？ } } catch (Exception e) { } if (TextUtils.isEmpty(cpuArchType)) { cpuArchType = "armeabi-v7a"; } cpuArchType = cpuArchType.toLowerCase(); return cpuArchType; }

4. System#load 加载代码侵入问题

通过 System#loadLibrary(“xxx” ) 加载 so 库， Android Framework 会遍历当前上下文的 ClassLoader 实例里的 nativeLibraryDirectories 数组，在数组里所有的文件路径下查找文件名为 libxxx.so 的文件，所以我们的解决思路就是在安装好 so 插件之后，将其所在的内部安全路径注入到这个 nativeLibraryDirectories 数组里，即可实现通过 System#loadLibrary 加载,代码如下:

第一步: 通过反射，注入 so 文件注入到 nativeLibraryDirectories 路径

private static final class V14 { private static void install(ClassLoader classLoader, File folder) throws Throwable { // 反射宿主 APK 的 ClassLoader 的 pathList成员变量 Field pathListField = MkReflectUtil.findField(classLoader, "pathList"); // 获取这个成员变量 在 宿主 APK 的 ClassLoader 对象的取值 Object dexPathList = pathListField.get(classLoader); // 将被加载的 被加载的 so 实例存储到 dexPathList MkReflectUtil.expandArray(dexPathList, "nativeLibraryDirectories", new File[]{folder}); } }

private static final class V23 { private static void install(ClassLoader classLoader, File folder) throws Throwable { Field pathListField = MkReflectUtil.findField(classLoader, "pathList"); Object dexPathList = pathListField.get(classLoader); Field nativeLibraryDirectories = MkReflectUtil.findField(dexPathList, "nativeLibraryDirectories"); List libDirs = (List) nativeLibraryDirectories.get(dexPathList); //去重 if (libDirs == null) { libDirs = new ArrayList(2); } final Iterator libDirIt = libDirs.iterator(); while (libDirIt.hasNext()) { final File libDir = libDirIt.next(); if (folder.equals(libDir)) { libDirIt.remove(); Log.d(TAG, "dq libDirIt.remove() " + folder.getAbsolutePath()); break; } } libDirs.add(0, folder); Field systemNativeLibraryDirectories = MkReflectUtil.findField(dexPathList, "systemNativeLibraryDirectories"); List systemLibDirs = (List) systemNativeLibraryDirectories.get(dexPathList); //判空 if (systemLibDirs == null) { systemLibDirs = new ArrayList(2); } //Log.d(TAG, "dq systemLibDirs,size=" + systemLibDirs.size()); // 获得Element[] 数组 Method makePathElements = MkReflectUtil.findMethod(dexPathList, "makePathElements", List.class, File.class, List.class); ArrayList suppressedExceptiOns= new ArrayList(); libDirs.addAll(systemLibDirs); // 输出调用对象,插件APK所在目录,插件APK的全路径,和用于存储IO异常的List,获得Element[] 返回 Object[] elements = (Object[]) makePathElements.invoke(dexPathList, libDirs, null, suppressedExceptions); Field nativeLibraryPathElements = MkReflectUtil.findField(dexPathList, "nativeLibraryPathElements"); nativeLibraryPathElements.setAccessible(true); nativeLibraryPathElements.set(dexPathList, elements); } }

private static final class V25 { private static void install(ClassLoader classLoader, File folder) throws Throwable { Field pathListField = MkReflectUtil.findField(classLoader, "pathList"); Object dexPathList = pathListField.get(classLoader); Field nativeLibraryDirectories = MkReflectUtil.findField(dexPathList, "nativeLibraryDirectories"); List libDirs = (List) nativeLibraryDirectories.get(dexPathList); //去重 if (libDirs == null) { libDirs = new ArrayList(2); } final Iterator libDirIt = libDirs.iterator(); while (libDirIt.hasNext()) { final File libDir = libDirIt.next(); if (folder.equals(libDir)) { libDirIt.remove(); Log.d(TAG, "dq libDirIt.remove()" + folder.getAbsolutePath()); break; } } libDirs.add(0, folder); //system/lib Field systemNativeLibraryDirectories = MkReflectUtil.findField(dexPathList, "systemNativeLibraryDirectories"); List systemLibDirs = (List) systemNativeLibraryDirectories.get(dexPathList); //判空 if (systemLibDirs == null) { systemLibDirs = new ArrayList(2); } //Log.d(TAG, "dq systemLibDirs,size=" + systemLibDirs.size()); Method makePathElements = MkReflectUtil.findMethod(dexPathList, "makePathElements", List.class); libDirs.addAll(systemLibDirs); Object[] elements = (Object[]) makePathElements.invoke(dexPathList, libDirs); Field nativeLibraryPathElements = MkReflectUtil.findField(dexPathList, "nativeLibraryPathElements"); nativeLibraryPathElements.setAccessible(true); nativeLibraryPathElements.set(dexPathList, elements); } }

注入 so 路径的逻辑如下:

1. APK 的 ClassLoader 的 pathList 的成员变量,
2. pathList 实际上是 SoPathList, 类的实例 的内部 成员变量 List 实例
3. 这个 List 存储的是 被加载的 so 文件实例

/** * 1. 通过反射拿到dexElements的取值 * 2. 将 findField 方法获取到的 object[] 插入到数组的最前面。 * 3. 被插入的 object[] 数组就是外部修复包存储路径集合编译后形成的队列 * 即外部修复包的资源和 .class 队列 * @param instance 宿主 APK 的 ClassLoader实例的成员变量 pathList(DexPathList类似) * @param fieldName 需要被反射和替换的 DexPathList 类对象的成员变量 "dexElements", 用于存储 .dex 加载对象dex * @param extraElements 被加载的插件 apk 的 .dex实例列表 */ public static void expandFieldArray(Object instance, String fieldName, Object[] extraElements) throws NoSuchFieldException, IllegalArgumentException, IllegalAccessException { // 1 通过反射获取 classLoader 实例的成员变量 pathList(DexPathList类的实例)的成员变量dexElements Field jlrField = findField(instance, fieldName); // 2 获取当前dexElements 这个成员变量在classLoader 实例的成员变量 pathList(DexPathList类的实例)中的取值 Object[] original = (Object[]) jlrField.get(instance); // 3 新建一个数组,这个数组用来容纳 宿主 apk .dex 文件加载出来的elements[] 和 插件apk .dex 文件加载出来的 elements[] Object[] combined = (Object[]) Array.newInstance(original.getClass().getComponentType(), original.length + extraElements.length); // 4 先把插件 apk 中获取的elements[] 以及 dexFileArr复制到数组里面,方便我们动态加载 System.arraycopy(extraElements, 0, combined, 0, extraElements.length); // 5 再把apk所有的 dexElements 成员变量取值复制到数组里面 System.arraycopy(original, 0, combined, extraElements.length, original.length); // 6 覆盖 dexElements 成员变量取值 jlrField.set(instance, combined); } 参考

App极限瘦身: 动态下发so
插件化so库加载原理及实现