查看binder調(diào)用信息

http://aospxref.com/android-12.0.0_r3/xref/frameworks/base/core/java/android/os/BinderProxy.java

部分APP不會(huì)使用常規(guī)的framework api調(diào)用系統(tǒng)的一些函數(shù)獲取信息，但是如果他自己構(gòu)建binder調(diào)用的信息獲取，最后都會(huì)跑到這個(gè)函數(shù)中去。

關(guān)鍵函數(shù)transact

打印調(diào)用信息關(guān)鍵函數(shù)：

public boolean transact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {


}

進(jìn)入native層監(jiān)控：

595publicnativebooleantransactNative(intcode,Parceldata,Parcelreply,
596intflags)throwsRemoteException;

對(duì)應(yīng)native代碼：

http://aospxref.com/android-12.0.0_r3/xref/frameworks/base/core/jni/android_util_Binder.cpp
#1553

1548  static const JNINativeMethod gBinderProxyMethods[] = {
1549       /* name, signature, funcPtr */
1550      {"pingBinder",          "()Z", (void*)android_os_BinderProxy_pingBinder},
1551      {"isBinderAlive",       "()Z", (void*)android_os_BinderProxy_isBinderAlive},
1552      {"getInterfaceDescriptor", "()Ljava/lang/String;", (void*)android_os_BinderProxy_getInterfaceDescriptor},
1553      這里{"transactNative",      "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},
1554      {"linkToDeath",         "(Landroid/os/IBinder$DeathRecipient;I)V", (void*)android_os_BinderProxy_linkToDeath},
1555      {"unlinkToDeath",       "(Landroid/os/IBinder$DeathRecipient;I)Z", (void*)android_os_BinderProxy_unlinkToDeath},
1556      {"getNativeFinalizer",  "()J", (void*)android_os_BinderProxy_getNativeFinalizer},
1557      {"getExtension",        "()Landroid/os/IBinder;", (void*)android_os_BinderProxy_getExtension},
1558  };

上面是函數(shù)綁定，具體實(shí)現(xiàn)是：

1382  static jboolean android_os_BinderProxy_transact(JNIEnv* env, jobject obj,
1383          jint code, jobject dataObj, jobject replyObj, jint flags)

發(fā)現(xiàn)一個(gè)好東西，把java的對(duì)象轉(zhuǎn)c++中對(duì)象，也就是對(duì)象中的一些字段信息轉(zhuǎn)到c++中的class中去。

Parcel* data = parcelForJavaObject(env, dataObj);

發(fā)現(xiàn)這里模塊有l(wèi)og工具的

1405ALOGV("Javacodecallingtransacton%pinJavaobject%pwithcode%"PRId32"
",
1406  target,obj,code);

http://aospxref.com/android-12.0.0_r3/xref/frameworks/ex/framesequence/jni/utils/log.h

如果編譯user版本，log關(guān)閉的，通常為了規(guī)避檢測，我們都會(huì)編譯user版本的系統(tǒng)。

28  /*
29   * Normally we strip ALOGV (VERBOSE messages) from release builds.
30   * You can modify this (for example with "#define LOG_NDEBUG 0"
31   * at the top of your source file) to change that behavior.
32   */
33  #ifndef LOG_NDEBUG
34  #ifdef NDEBUG
35  #define LOG_NDEBUG 1
36  #else
37  #define LOG_NDEBUG 0
38  #endif
39  #endif

LOG_NDEBUG==1表示不打印VERBOSE日志

LOG_NDEBUG==0表示打印VERBOSE日志

在這個(gè)頭文件頂部，增加

#define LOG_NDEBUG 0

主動(dòng)激活打印日志，或者再增加一個(gè)開關(guān)來控制是否打印，增加pid過濾也可以的。

審核編輯：劉清