package dalvik.system;

/**
 * A class loader that loads classes from {@code .jar} and {@code .apk} files
 * containing a {@code classes.dex} entry. This can be used to execute code not
 * installed as part of an application.
 */
public class DexClassLoader extends BaseDexClassLoader {
    /**
     * Creates a {@code DexClassLoader} that finds interpreted and native
     * code.  Interpreted classes are found in a set of DEX files contained
     * in Jar or APK files.
     *
     * @param dexPath the list of jar/apk files containing classes and
     *     resources, delimited by {@code File.pathSeparator}, which
     *     defaults to {@code ":"} on Android
     * @param optimizedDirectory directory where optimized dex files
     *     should be written; must not be {@code null}
     * @param librarySearchPath the list of directories containing native
     *     libraries, delimited by {@code File.pathSeparator}; may be
     *     {@code null}
     * @param parent the parent class loader
     */
    public DexClassLoader(String dexPath, String optimizedDirectory,
            String librarySearchPath, ClassLoader parent) {
        super(dexPath, new File(optimizedDirectory), librarySearchPath, parent);
    }
}

package com.fashare.dl

/**
 * 动态加载（门面类）
 */
object DL {
    lateinit var dexClassLoader: DexClassLoader
    
    /**
     * 加载 sdcard 上的 未安装的 apk
     */
    fun loadApk(context: Context, pluginUri: Uri) {
        dexClassLoader = DexClassLoader(
                pluginUri.path,
                context.cacheDir.path,
                null,
                context.classLoader)
    }
   
    ...
}

package com.fashare.app

class App: Application(){
    override fun onCreate() {
        super.onCreate()

        val pluginFile = File(Environment.getExternalStorageDirectory(), "testapk-with-res.apk")
        copyTestApkToSdcard(pluginFile)
        DL.loadApk(this, Uri.fromFile(pluginFile))
    }
}

package android.app;

public class Instrumentation { 
    ...
	public Activity newActivity(ClassLoader cl, String className, Intent intent)
            throws InstantiationException, IllegalAccessException, ClassNotFoundException {
        return (Activity)cl.loadClass(className).newInstance();
    }
}

package android.app;

public final class ActivityThread {
    // 单例
    private static volatile ActivityThread sCurrentActivityThread;
    public static ActivityThread currentActivityThread() {
        return sCurrentActivityThread;
    }
    
    Instrumentation mInstrumentation;
    
    public static void main(String[] args) {
        ...
        // 我们常说的 Looper 的初始化
        Looper.prepareMainLooper();

        ActivityThread thread = new ActivityThread();
        // 在 attach() 里，new 出了 Instrumentation，也是进程级别唯一的
        thread.attach(false);
        
        ...
        Looper.loop();
    }
    
    private void attach(boolean system) {
        sCurrentActivityThread = this;
        
        if (!system) {
            ...
        } else {
            ...
            mInstrumentation = new Instrumentation();
        }
        ...
    }
}

package com.fashare.dl

object DL {
    lateinit var dexClassLoader: DexClassLoader
    internal lateinit var instrumentation: Instrumentation

    fun loadApk(context: Context, uri: Uri) {...}

    /**
     * 替换 ActivityThread.mInstrumentation
     */
    fun replaceInstrumentation() {
        // 反射伪代码：
        val base = ActivityThread.currentActivityThread().mInstrumentation
        
        ActivityThread.currentActivityThread().mInstrumentation = InstrumentationProxy(base)
    }
}

package com.fashare.dl

/**
 * Instrumentation 代理类
 */
internal class InstrumentationProxy(val base: Instrumentation) : Instrumentation() {

    override fun newActivity(cl: ClassLoader?, className: String?, intent: Intent?): Activity? {
        // 不用默认的 cl，而是用事先准备好的 DL.dexClassLoader 来加载 Activity。
        return base.newActivity(DL.dexClassLoader, className, intent)
    }
}

package com.fashare.dl

/**
 * Intent 代理类，替换 component.className 为 StubActivity
 */
internal class IntentProxy(var base: Intent?) : Intent() {
    init {
        component = ComponentName(base?.component?.packageName, StubActivity::class.java.name)
    }
}

/**
 * 占坑用 Activity
 */
internal class StubActivity : AppCompatActivity()

internal class InstrumentationProxy(val base: Instrumentation) : Instrumentation() {
    var mIntentProxy: IntentProxy? = null

    /**
     * new 之前，取出原始的 intent 来 new Activity实例
     */
    override fun newActivity(cl: ClassLoader?, className: String?, intent: Intent?): Activity? {
        return (mIntentProxy?.base ?: intent)?.let {
            mIntentProxy = null
            base.newActivity(DL.dexClassLoader, it.component?.className, it)
        }
    }

    /**
     * start 之前，替换 Intent 为 已注册的 StubActivity, 以绕过 系统对 manifest 的检查
     *
     * 注: 这里其实也是 override, 只是 super.execStartActivity(...) 为 @hide, 所以看起来比较奇怪.
     */
    fun execStartActivity(
            who: Context?, contextThread: IBinder?, token: IBinder?, target: Activity?,
            intent: Intent?, requestCode: Int, options: Bundle?): ActivityResult? {
            
        mIntentProxy = IntentProxy(intent)

        return try {
            Reflect.on(base).call("execStartActivity",
                    who, contextThread, token, target,
                    mIntentProxy, requestCode, options).get<ActivityResult?>()
        } catch (e: Exception) {
            null
        }
    }
}