#include <android/log.h>

#include <stdio.h>

#include <jni.h>

#include <dlfcn.h>

#include <stdarg.h>

#include <errno.h>

typedef int bool;

#define TRUE 1

#define FALSE 0

#define LOG_TAG "hack"

#define LOGI(fmt, args...) __android_log_print(ANDROID_LOG_INFO, LOG_TAG, fmt, ##args)

#define LOGD(fmt, args...) __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, fmt, ##args)

#define LOGE(fmt, args...) _LOGE(fmt, ##args)

#define _LOGE(fmt, args...) \

do { \

__android_log_print(ANDROID_LOG_ERROR, LOG_TAG, "line:[%d]", __LINE__); \

__android_log_print(ANDROID_LOG_ERROR, LOG_TAG, fmt, ##args); \

} while(0)

#define MAIN_CLASS "com/zhouat/hellojni/MainActivity"

static jclass myFindClass(JNIEnv* env, const char* className);

static bool g_attach_flag=FALSE;

int test()

{

JNIEnv *env;

JavaVM *jvm;

void *handle = dlopen("/system/lib/libandroid_runtime.so", RTLD_NOW);

if(handle==NULL){

const char *dlopen_error = dlerror();

LOGE("cannt load runtime.so:[%s]",dlopen_error);

return -1;

}

void *getJNIEnv = (int (*)(void))dlsym(handle, "_ZN7android14AndroidRuntime9getJNIEnvEv");

if(getJNIEnv==NULL){

const char *dlsym_error = dlerror();

LOGE("cannt resolve symbol getJNIEnv:[%s]",dlsym_error);

return -1;

}

// get env

env = (void*)((int (*)(void))getJNIEnv)();

if(env==NULL){

LOGE("get env failed");

return -1;

}

//through env -> get jvm

(*env)->GetJavaVM(env, &jvm);

if(jvm==NULL){

LOGE("get jvm failed");

return -1;

}

int status=(*jvm)->GetEnv(jvm, (void**)&env, JNI_VERSION_1_6);

if (status != JNI_OK) {

status=(*jvm)-> AttachCurrentThread(jvm, &env, NULL);

if(status<0){

LOGE("GetEnv failed");

return -1;

}

g_attach_flag=TRUE;

}

jclass father = (*env)->FindClass(env, MAIN_CLASS);

if(father == NULL){

LOGE("Find Class failed by BootClassLoader\n");

if((*env)->ExceptionOccurred(env)){

(*env)->ExceptionDescribe(env);

(*env)->ExceptionClear(env);

}

father = myFindClass(env, MAIN_CLASS);

if(father == NULL)

{

LOGE("Find Class failed\n");

}

}

jmethodID truthMethod = (*env)->GetMethodID(env, father, "truth", "()Ljava/lang/String;");

jmethodID fakeMethod = (*env)->GetMethodID(env, father, "fake", "()Ljava/lang/String;");

// jmethodID 是一个ClassObject 的指针类型，

// ClassObject 对象的偏移地址32位处为insns字段。

*(int *)((int)truthMethod+32) = *(int *)((int)fakeMethod + 32);

if(g_attach_flag){

(*jvm)-> DetachCurrentThread(jvm);

g_attach_flag=FALSE;

}

int result = JNI_OK;

return ( ( result != JNI_OK ) ? result : JNI_VERSION_1_6);

}

static jclass myFindClass(JNIEnv* env, const char* className){

jclass AppClassLoader = (*env)->FindClass(env,"android/app/ApplicationLoaders");

if(AppClassLoader == NULL){

LOGE("Exception, no class: [ApplicationLoaders]");

return NULL;

}

jfieldID AppFieldLoader = (*env)->GetStaticFieldID(env,AppClassLoader,"gApplicationLoaders","Landroid/app/ApplicationLoaders;");

if(AppFieldLoader == NULL){

LOGE("Exception, no static failed:[gApplicationLoaders]");

return NULL;

}

jobject AppObjLoader = (*env)->GetStaticObjectField(env,AppClassLoader, AppFieldLoader);

if(AppObjLoader == NULL){

LOGE("Exception, [GetStaticObjectField] failed");

return NULL;

}

jfieldID mLoaders = (*env)->GetFieldID(env,AppClassLoader, "mLoaders", "Ljava/util/Map;");

if(mLoaders == NULL){

LOGE("Exception, [GetFieldID] mLoaders failed");

return NULL;

}

jobject ObjLoaders = (*env)->GetObjectField(env,AppObjLoader, mLoaders);

if(ObjLoaders == NULL){

LOGE("Exception, [GetObjectField] failed");

return NULL;

}

jclass HashMapClass =(*env)->GetObjectClass(env,ObjLoaders);

if(HashMapClass == NULL){

LOGE("Exception, [GetObjectClass] failed");

return NULL;

}

jmethodID methodValues = (*env)->GetMethodID(env,HashMapClass, "values", "()Ljava/util/Collection;");

if(methodValues == NULL){

LOGE("Exception, [GetMethodID] failed");

return NULL;

}

jobject values = (*env)->CallObjectMethod(env,ObjLoaders, methodValues);

if(values == NULL){

LOGE("Exception, [CallObjectMethod] failed");

return NULL;

}

jclass clazzValues = (*env)->GetObjectClass(env,values);

if(clazzValues == NULL){

LOGE("Exception, [GetObjectClass] failed");

return NULL;

}

jmethodID methodToArray = (*env)->GetMethodID(env,clazzValues,"toArray","()[Ljava/lang/Object;");

if(methodToArray == NULL){

LOGE("Exception, [GetMethodID failed");

return NULL;

}

jobjectArray classLoaders = (jobjectArray)(*env)->CallObjectMethod(env,values,methodToArray);

if(classLoaders == NULL){

LOGE("Exception, [CallObjectMethod] failed");

return NULL;

}

int length = (*env)->GetArrayLength(env,classLoaders);

int i;

for (i = 0; i < length; ++ i) {

jobject t_loader = (*env)->GetObjectArrayElement(env,classLoaders, i);

jclass t_class = (*env)->GetObjectClass(env,t_loader);

jmethodID t_method = (*env)->GetMethodID(env,t_class, "loadClass", "(Ljava/lang/String;)Ljava/lang/Class;");

jstring param = (*env)->NewStringUTF(env,className);

jclass ret_class = (jclass) (*env)->CallObjectMethod(env,t_loader, t_method, param);

if (ret_class == NULL) {

continue;

}

return ret_class;

}

return NULL;

}