获取应用自身获取所有Activity的方法。

方法一：PackageManager获取：

PackageManager packageManager = getPackageManager();
                PackageInfo packageInfo = null;
                try {
                    packageInfo = packageManager.getPackageInfo(
                            getPackageName(), PackageManager.GET_ACTIVITIES);

                    for (ActivityInfo activity : packageInfo.activities) {
                        Class<!--?--> aClass = Class.forName(activity.name);
                        Log.i("packageManager ","===========activityList======"+aClass);
                    }
                } catch (Exception e) {
                    e.printStackTrace();
                }

方法二：只能查询指定action

      Intent intent = new Intent(Intent.ACTION_MAIN, null);
        intent.setPackage(context.getPackageName());
        
        for (ResolveInfo info : context.getPackageManager().queryIntentActivities(intent, PackageManager.MATCH_ALL)) {

            Log.w("new_hijack","[activtiy]"+info.activityInfo.name+","+info.activityInfo.processName);
        }

方法三：只能查询已加载的

  List<activity> list = new ArrayList&lt;&gt;();
        try {
            Class<application> applicationClass = Application.class;
            Field mLoadedApkField = applicationClass.getDeclaredField("mLoadedApk");
            mLoadedApkField.setAccessible(true);
            Object mLoadedApk = mLoadedApkField.get(application);
            Class<!--?--> mLoadedApkClass = mLoadedApk.getClass();
            Field mActivityThreadField = mLoadedApkClass.getDeclaredField("mActivityThread");
            mActivityThreadField.setAccessible(true);
            Object mActivityThread = mActivityThreadField.get(mLoadedApk);
            Class<!--?--> mActivityThreadClass = mActivityThread.getClass();
            Field mActivitiesField = mActivityThreadClass.getDeclaredField("mActivities");
            mActivitiesField.setAccessible(true);
            // ActivityThread.ActivityClientRecord
            Object mActivities = mActivitiesField.get(mActivityThread);
            // 注意这里一定写成Map，低版本这里用的是HashMap，高版本用的是ArrayMap
            if (mActivities instanceof Map) {
                @SuppressWarnings("unchecked")
                Map<object, object> arrayMap = (Map<object, object>) mActivities;
                for (Map.Entry<object, object> entry : arrayMap.entrySet()) {
                    Object value = entry.getValue();
                    Class<!--?--> activityClientRecordClass = value.getClass();
                    Field activityField = activityClientRecordClass.getDeclaredField("activity");
                    activityField.setAccessible(true);

                    Object o = activityField.get(value);

                    Log.w("new_hijack","ACTIVITY"+o.getClass().getName());
                    list.add((Activity) o);
                }
            }
        } catch (Exception e) {
            e.printStackTrace();
            list = null;
        }

方法四：反射获取方法

    Class   packageParserClass = Class.forName("android.content.pm.PackageParser");
            Method parsePackageMethod = packageParserClass.getDeclaredMethod("parsePackage", File.class, int.class);
            Object packageParser = packageParserClass.newInstance();
            Object packageObj=  parsePackageMethod.invoke(packageParser, new File(application.getApplicationInfo().sourceDir), PackageManager.GET_ACTIVITIES);
            Field receiverField=packageObj.getClass().getDeclaredField("activities");
//            Field receiverField=packageObj.getClass().getDeclaredField("receivers");
            List receivers = (List) receiverField.get(packageObj);

            Class<!--?--> componentClass = Class.forName("android.content.pm.PackageParser$Component");
            Field intentsField = componentClass.getDeclaredField("intents");

            // 调用generateActivityInfo 方法, 把PackageParser.Activity 转换成
            Class<!--?--> packageParser$ActivityClass = Class.forName("android.content.pm.PackageParser$Activity");
//            generateActivityInfo方法
            Class<!--?--> packageUserStateClass = Class.forName("android.content.pm.PackageUserState");
            Object defaltUserState= packageUserStateClass.newInstance();
            Method generateReceiverInfo = packageParserClass.getDeclaredMethod("generateActivityInfo",
                    packageParser$ActivityClass, int.class, packageUserStateClass, int.class);
            Class<!--?--> userHandler = Class.forName("android.os.UserHandle");
            Method getCallingUserIdMethod = userHandler.getDeclaredMethod("getCallingUserId");
            int userId = (int) getCallingUserIdMethod.invoke(null);
            for (Object activity : receivers) {
                ActivityInfo info= (ActivityInfo) generateReceiverInfo.invoke(packageParser,  activity,0, defaltUserState, userId);
                Log.w("new_hijack","activtiy:"+info.name);

            }

有问题请在下方留言或者加入星球</object,></object,></object,></application></activity>

来源：oschina

链接：https://my.oschina.net/u/3886524/blog/3159259

标签

Activities

android

Entry

Hijack