简书链接:获取应用自身获取所有activity研究。
文章字数：72,阅读全文大约需要1分钟
只能查询指定action

1
2
3
4
5
6
7
8
Intent intent = new Intent(Intent.ACTION_MAIN, null);
  intent.setPackage(context.getPackageName());
  
  for (ResolveInfo info : context.getPackageManager().queryIntentActivities(intent, PackageManager.MATCH_ALL)) {

      Log.w("new_hijack","[activtiy]"+info.activityInfo.name+","+info.activityInfo.processName);
  }

只能查询已加载的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
List<Activity> list = new ArrayList<>();
      try {
          Class<Application> applicationClass = Application.class;
          Field mLoadedApkField = applicationClass.getDeclaredField("mLoadedApk");
          mLoadedApkField.setAccessible(true);
          Object mLoadedApk = mLoadedApkField.get(application);
          Class<?> mLoadedApkClass = mLoadedApk.getClass();
          Field mActivityThreadField = mLoadedApkClass.getDeclaredField("mActivityThread");
          mActivityThreadField.setAccessible(true);
          Object mActivityThread = mActivityThreadField.get(mLoadedApk);
          Class<?> mActivityThreadClass = mActivityThread.getClass();
          Field mActivitiesField = mActivityThreadClass.getDeclaredField("mActivities");
          mActivitiesField.setAccessible(true);
          // ActivityThread.ActivityClientRecord
          Object mActivities = mActivitiesField.get(mActivityThread);
          // 注意这里一定写成Map，低版本这里用的是HashMap，高版本用的是ArrayMap
          if (mActivities instanceof Map) {
              @SuppressWarnings("unchecked")
              Map<Object, Object> arrayMap = (Map<Object, Object>) mActivities;
              for (Map.Entry<Object, Object> entry : arrayMap.entrySet()) {
                  Object value = entry.getValue();
                  Class<?> activityClientRecordClass = value.getClass();
                  Field activityField = activityClientRecordClass.getDeclaredField("activity");
                  activityField.setAccessible(true);

                  Object o = activityField.get(value);

                  Log.w("new_hijack","ACTIVITY"+o.getClass().getName());
                  list.add((Activity) o);
              }
          }
      } catch (Exception e) {
          e.printStackTrace();
          list = null;
      }

最靠谱的方法

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
    Class   packageParserClass = Class.forName("android.content.pm.PackageParser");
            Method parsePackageMethod = packageParserClass.getDeclaredMethod("parsePackage", File.class, int.class);
            Object packageParser = packageParserClass.newInstance();
            Object packageObj=  parsePackageMethod.invoke(packageParser, new File(application.getApplicationInfo().sourceDir), PackageManager.GET_ACTIVITIES);
            Field receiverField=packageObj.getClass().getDeclaredField("activities");
//            Field receiverField=packageObj.getClass().getDeclaredField("receivers");
            List receivers = (List) receiverField.get(packageObj);

            Class<?> componentClass = Class.forName("android.content.pm.PackageParser$Component");
            Field intentsField = componentClass.getDeclaredField("intents");

            // 调用generateActivityInfo 方法, 把PackageParser.Activity 转换成
            Class<?> packageParser$ActivityClass = Class.forName("android.content.pm.PackageParser$Activity");
//            generateActivityInfo方法
            Class<?> packageUserStateClass = Class.forName("android.content.pm.PackageUserState");
            Object defaltUserState= packageUserStateClass.newInstance();
            Method generateReceiverInfo = packageParserClass.getDeclaredMethod("generateActivityInfo",
                    packageParser$ActivityClass, int.class, packageUserStateClass, int.class);
            Class<?> userHandler = Class.forName("android.os.UserHandle");
            Method getCallingUserIdMethod = userHandler.getDeclaredMethod("getCallingUserId");
            int userId = (int) getCallingUserIdMethod.invoke(null);
            for (Object activity : receivers) {
                ActivityInfo info= (ActivityInfo) generateReceiverInfo.invoke(packageParser,  activity,0, defaltUserState, userId);
                Log.w("new_hijack","activtiy:"+info.name);

            }