"android.os.BinderProxy"->transact

/**
     * Perform a binder transaction on a proxy.
     *
     * @param code The action to perform.  This should
     * be a number between {@link #FIRST_CALL_TRANSACTION} and
     * {@link #LAST_CALL_TRANSACTION}.
     * @param data Marshalled data to send to the target.  Must not be null.
     * If you are not sending any data, you must create an empty Parcel
     * that is given here.
     * @param reply Marshalled data to be received from the target.  May be
     * null if you are not interested in the return value.
     * @param flags Additional operation flags.  Either 0 for a normal
     * RPC, or {@link #FLAG_ONEWAY} for a one-way RPC.
     *
     * @return
     * @throws RemoteException
     */
    public boolean transact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {
            ...
    }

getPackageManager().getPackageInfo("aaa",0);
getPackageManager().getPackageInfo("aaa",PackageManager.GET_SIGNATURES);

public String getAndroidId5(Context context) {
        try {
            // Acquire the ContentProvider
            Class<?> activityThreadClass = Class.forName("android.app.ActivityThread");
            Method currentActivityThreadMethod = activityThreadClass.getMethod("currentActivityThread");
            Object currentActivityThread = currentActivityThreadMethod.invoke(null);
            Method acquireProviderMethod = activityThreadClass.getMethod("acquireProvider", Context.class, String.class, int.class, boolean.class);
            Object provider = acquireProviderMethod.invoke(currentActivityThread, context, "settings", 0, true);
            // Get the Binder
            Class<?> iContentProviderClass = Class.forName("android.content.IContentProvider");
            Field mRemoteField = provider.getClass().getDeclaredField("mRemote");
            mRemoteField.setAccessible(true);
            IBinder binder = (IBinder) mRemoteField.get(provider);
            // Create the Parcel for the arguments
            Parcel data = Parcel.obtain();
            data.writeInterfaceToken("android.content.IContentProvider");
            if (android.os.Build.VERSION.SDK_INT
                    >= android.os.Build.VERSION_CODES.S) {
                context.getAttributionSource().writeToParcel(data, 0);
                data.writeString("settings"); //authority
                data.writeString("GET_secure"); //method
                data.writeString("android_id"); //stringArg
                data.writeBundle(Bundle.EMPTY);
            } else if (android.os.Build.VERSION.SDK_INT
                    == android.os.Build.VERSION_CODES.R) {
                //android 11
                data.writeString(context.getPackageName());
                data.writeString(null); //featureId
                data.writeString("settings"); //authority
                data.writeString("GET_secure"); //method
                data.writeString("android_id"); //stringArg
                data.writeBundle(Bundle.EMPTY);
            } else if (android.os.Build.VERSION.SDK_INT
                    == android.os.Build.VERSION_CODES.Q) {
                //android 10
                data.writeString(context.getPackageName());
                data.writeString("settings"); //authority
                data.writeString("GET_secure"); //method
                data.writeString("android_id"); //stringArg
                data.writeBundle(Bundle.EMPTY);
            } else {
                data.writeString(context.getPackageName());
                data.writeString("GET_secure"); //method
                data.writeString("android_id"); //stringArg
                data.writeBundle(Bundle.EMPTY);
            }
            Parcel reply = Parcel.obtain();
            binder.transact((int) iContentProviderClass.getDeclaredField("CALL_TRANSACTION").get(null), data, reply, 0);
            reply.readException();
            Bundle bundle = reply.readBundle();
            reply.recycle();
            data.recycle();
            return bundle.getString("value");
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
    }

public static int TRANSACTION_getPackageInfo() {
    if(TRANSACTION_getPackageInfo == -1) {
         try {
                Field field = null;
                try {
                    Class<?> pkmIPCClazz = Class.forName("android.content.pm.IPackageManager$Stub");
                    field = pkmIPCClazz.getDeclaredField("TRANSACTION_getPackageInfo");
                } catch (Throwable e) {
                    CLog.e(">>>>>>>>>> getTranscationId forName error " + e.getMessage());
                }
                assert field != null;
                field.setAccessible(true);
                TRANSACTION_getPackageInfo = field.getInt(null);
            } catch (Throwable e) {
                e.printStackTrace();
                CLog.e(">>>>>>>>>> getTranscationId error " + e.getMessage());
            }
        }
        return TRANSACTION_getPackageInfo;
}
    try {
    PackageManager packageManager = getBaseContext().getPackageManager();
    Object IPC_PM_Obj = RposedHelpers.getObjectField(packageManager, "mPM");
    //取binder
    IBinder mRemote = (IBinder) RposedHelpers.getObjectField(IPC_PM_Obj, "mRemote");
    Parcel _data = Parcel.obtain();
    Parcel _reply = Parcel.obtain();
    _data.writeInterfaceToken("android.content.pm.IPackageManager");
    _data.writeString(getPackageName());
    _data.writeLong(PackageManager.GET_SIGNATURES);
    _data.writeInt(android.os.Process.myUid());
    boolean _status = mRemote.transact(TransactCase.TRANSACTION_getPackageInfo(), _data, _reply, 0);
    _reply.readException();
    PackageInfo packageInfo = _reply.readTypedObject(PackageInfo.CREATOR);
    _data.recycle();
    _reply.recycle();
    CLog.e("签名信息: "+packageInfo.signatures[0].toCharsString());
} catch (Throwable e) {
    CLog.i("IPC_TEST_getPackageInfo error "+e);
}

    
//call art method register
    if (!RegisterNativeMethod(env, NativeEngine,
                              SignatureFixMethods,
                              sizeof(SignatureFixMethods) / sizeof(SignatureFixMethods[0]))) {
        LOG(ERROR) << "JNI_OnLoad call art method register fail ,start env register natives! ";
        env->RegisterNatives(NativeEngine,
                             SignatureFixMethods,
                             sizeof(SignatureFixMethods) / sizeof(SignatureFixMethods[0]));
    }

//
// Created by Zhenxi on 2022/8/22.
//
#include <jni.h>
#include "../include/logging.h"
#include "../include/libpath.h"
#include "../include/dlfcn_compat.h"
#include "../include/version.h"
#include "../include/main.h"
static void *art_method_register = nullptr;
static void *class_linker_ = nullptr;
size_t OffsetOfJavaVm(bool has_small_irt, int SDK_INT) {
    if (has_small_irt) {
        switch (SDK_INT) {
            case ANDROID_T:
            case ANDROID_SL:
            case ANDROID_S:
                return sizeof(void *) == 8 ? 624 : 300;
            case ANDROID_R:
            case ANDROID_Q:
                return sizeof(void *) == 8 ? 528 : 304;
            default:
                LOGE("OffsetOfJavaVM Unexpected android version %d", SDK_INT);
                abort();
        }
    } else {
        switch (SDK_INT) {
            case ANDROID_T:
            case ANDROID_SL:
            case ANDROID_S:
                return sizeof(void *) == 8 ? 520 : 300;
            case ANDROID_R:
            case ANDROID_Q:
                return sizeof(void *) == 8 ? 496 : 288;
            default:
                LOGE("OffsetOfJavaVM Unexpected android version %d", SDK_INT);
                abort();
        }
    }
}
template<typename T>
int findOffset(void *start, size_t len, size_t step, T value) {
    if (nullptr == start) {
        return -1;
    }
    for (int i = 0; i <= len; i += step) {
        T current_value = *reinterpret_cast<T *>((size_t) start + i);
        if (value == current_value) {
            return i;
        }
    }
    return -1;
}
/**
* 根据runtime获取class_linker
* https://github.com/magician8520/BlackBox/blob/99f26925aa303fd0a71543e3713ef3fc57a08e81/Bcore/pine-core/src/main/cpp/android.h#L36
*/
void *getClassLinker() {
    if (class_linker_ != nullptr) {
        return class_linker_;
    }
    int SDK_INT = get_sdk_level();
    // If SmallIrtAllocator symbols can be found, then the ROM has merged commit "Initially allocate smaller local IRT"
    // This commit added a pointer member between `class_linker_` and `java_vm_`. Need to calibrate offset here.
    // https://android.googlesource.com/platform/art/+/4dcac3629ea5925e47b522073f3c49420e998911
    // https://github.com/crdroidandroid/android_art/commit/aa7999027fa830d0419c9518ab56ceb7fcf6f7f1
    bool has_smaller_irt = getSymCompat(getlibArtPath(),
                                        "_ZN3art17SmallIrtAllocator10DeallocateEPNS_8IrtEntryE") !=
                           nullptr;
    size_t jvm_offset = OffsetOfJavaVm(has_smaller_irt, SDK_INT);
    auto runtime_instance_ = *reinterpret_cast<void **>
    (getSymCompat(getlibArtPath(), "_ZN3art7Runtime9instance_E"));
    auto val = jvm_offset
               ? reinterpret_cast<std::unique_ptr<JavaVM> *>(
                       reinterpret_cast<uintptr_t>(runtime_instance_) + jvm_offset)->get()
               : nullptr;
    if (val == getVm()) {
        LOGD("JavaVM offset matches the default offset");
    } else {
        LOGW("JavaVM offset mismatches the default offset, try search the memory of Runtime");
        int offset = findOffset(runtime_instance_, 1024, 4, getVm());
        if (offset == -1) {
            LOGE("Failed to find java vm from Runtime");
            return nullptr;
        }
        jvm_offset = offset;
        LOGW("Found JavaVM in Runtime at %zu", jvm_offset);
    }
    const size_t kDifference = has_smaller_irt
                               ? sizeof(std::unique_ptr<void>) + sizeof(void *) * 3
                               : SDK_INT == ANDROID_Q
                                 ? sizeof(void *) * 2
                                 : sizeof(std::unique_ptr<void>) + sizeof(void *) * 2;
    class_linker_ = *reinterpret_cast<void **>(reinterpret_cast<uintptr_t>(runtime_instance_) +
                                               jvm_offset - kDifference);
    return class_linker_;
}
bool call_MethodRegister(JNIEnv *env, void *art_method, void *native_method) {
    if (art_method_register == nullptr) {
        if (get_sdk_level() < ANDROID_S) {
            //android 11
            art_method_register = getSymCompat(getlibArtPath(),
                                               "_ZN3art9ArtMethod14RegisterNativeEPKv");
            if (art_method_register == nullptr) {
                art_method_register = getSymCompat(getlibArtPath(),
                                                   "_ZN3art9ArtMethod14RegisterNativeEPKvb");
            }
        } else {
            //12以上还是在libart里面,但是在linker里面实现,符号名称存在变化
            art_method_register = getSymCompat(getlibArtPath(),
                                               "_ZN3art11ClassLinker14RegisterNativeEPNS_6ThreadEPNS_9ArtMethodEPKv");
        }
        if (art_method_register == nullptr) {
            LOG(ERROR) << "register native method  get art_method_register = null  ";
            return false;
        }
    }
    if (get_sdk_level() >= ANDROID_S) {
        //12以上
        //const void* RegisterNative(Thread* self, ArtMethod* method, const void* native_method)
        auto call = reinterpret_cast<void *(*)(void *, void *, void *,
                                               void *)>(art_method_register);
        //get self thread
        void *self = getSymCompat(getlibArtPath(), "_ZN3art6Thread14CurrentFromGdbEv");
        if (self == nullptr) {
            LOG(ERROR) << "register native method  get CurrentFromGdb = null  ";
            return false;
        }
        //手动计算一下linker实例地址
        void *classLinker = getClassLinker();
        if (classLinker == nullptr) {
            LOG(ERROR) << "register native method  get getClassLinker = null  ";
            return false;
        }
        call(classLinker, self, art_method, native_method);
        //LOG(ERROR) << "register native method  get getClassLinker success!  ";
    } else if (get_sdk_level() >= ANDROID_R) {
        auto call = reinterpret_cast<void *(*)(void *, void *)>(art_method_register);
        call(art_method, native_method);
    } else {
        auto call = reinterpret_cast<void *(*)(void *, void *, bool)>(art_method_register);
        call(art_method, native_method, true);
    }
    return true;
}
inline static bool IsIndexId(jmethodID mid) {
    return ((reinterpret_cast<uintptr_t>(mid) % 2) != 0);
}
static jfieldID field_art_method = nullptr;
bool RegisterNativeMethod(JNIEnv *env,
                          jclass clazz,
                          const JNINativeMethod *methods,
                          size_t nMethods) {
    if (env == nullptr) {
        LOG(ERROR) << "register native method  JNIEnv = null  ";
        return false;
    }
    void *arm_method = nullptr;
    for (int i = 0; i < nMethods; i++) {
        jmethodID methodId = env->GetMethodID(clazz, methods[i].name, methods[i].signature);
        if (methodId == nullptr) {
            //maybe static
            env->ExceptionClear();
            methodId = env->GetStaticMethodID(clazz, methods[i].name, methods[i].signature);
            if (methodId == nullptr) {
                LOG(ERROR) << "register native method  get orig method  == null  "
                           << methods[i].signature;
                env->ExceptionClear();
                return false;
            }
        }
        if (get_sdk_level() >= ANDROID_R) {
            if (field_art_method == nullptr) {
                jclass pClazz = env->FindClass("java/lang/reflect/Executable");
                field_art_method = env->GetFieldID(pClazz, "artMethod", "J");
            }
            if (field_art_method == nullptr) {
                LOG(ERROR) << "register native method  get artMethod  == null  ";
                return false;
            }
            if (IsIndexId(methodId)) {
                jobject method = env->ToReflectedMethod(clazz, methodId, true);
                arm_method = reinterpret_cast<void *>(env->GetLongField(method, field_art_method));
                //LOG(ERROR) << "arm_method   "<<arm_method ;
            }
        } else {
            arm_method = methodId;
        }
        if (arm_method == nullptr) {
            LOG(ERROR) << "register native method art method  == null  ";
            return false;
        }
        if (!call_MethodRegister(env, arm_method, methods[i].fnPtr)) {
            LOG(ERROR) << "register native method fail  " <<
                       methods[i].name << "  " << methods[i].signature;
            return false;
        }
//        LOG(INFO) << "register native method success  " << methods[i].name << "  "
//                  << methods[i].signature;
    }
    return true;
}

# 往期推荐

1、CUDA程序之逆向

2、微信小程序逆向分析

3、Qiling框架分析实战：从 QilingLab 详解到 Qiling 源码分析

4、看开水团与 ARM 花指令构造与静态Patch

5、什么是去除花指令的最高境界

6、VX小程序逆向分析