...

Android p introduces restrictions on the use of non-SDK interfaces (commonly known as hidden APIs). This is another major adjustment after the link restriction on private libraries in NDK on Android N.

from now on, whether it's NDK in native layer or SDK in Java layer, we can only use the open standard interface provided by Google. This is of course a good thing for developers, users and even the entire Android ecosystem.

But it also means that all kinds of black technologies on Android may gradually die out.

public *** SDK interfaces are those recorded in the package index of Android framework

Since Android Pie, access to some hidden classes, methods and fields is limited before Pie, so it is very easy to use these hidden non-SDK components by simply using reflection.

however, now when trying to access, applications oriented to API 28 (Pie) or later will encounter ClassNotFoundException, NoSuchMethodError or nosuchfieldexception activity # createdialog ().

first, let's see how the system achieves this limitation.

when accessing a non-public interface through reflection or JNI, warnings/exceptions will be triggered, so you might as well follow the process of reflection to see at which step the system makes restrictions.

let's take a look at java.lang.class.getdeclaredmethod (string):

Let's take a look at the call of ShouldBlockAccessToMember. If it returns false, then it returns nullptr directly, and the upper layer will throw a NoSuchMethodXXX exception; It also triggers the limitation of the system.

The source code is as follows:

Continue to track the GetMemberAction method:

Continue to track the GetMemberActionImpl method:

Among them, it is called

As long as the IsExempted method returns true, even if this method is blacklisted, it will still be released and allowed to be called.

isexcepted method:

continue to trace the passed parameter runtime-> GetHiddenApiExemptions () discovery is also a parameter in the runtime.

In this way, hidden _ API _ exceptions _ bypass restrictions can be modified directly.

in the Java layer, there is a corresponding vmruntime. sethiddenaapiexceptions method. By setting the exemption condition, you can use reflection happily.

the DoesPrefixMatch method is called in the isexcepted method. DoesPrefixMatch is prefix matching for method signatures. All the signatures of Java method classes start with L, so you can pass an L directly in, and all the hidden APIs are pardoned!

another way to bypass the restrictions of non-public API above Android p.