// VPackageInstallerService
public synchronized InstallResult installPackage(String path, int flags, boolean notify) {
    ...
    File packageFile = new File(path);
    ...
    VPackage pkg = null;
    try {
        // 1. 反射创建android.pm.PackageParser对象，解析出apk包的四大组件以及其他相关信息
        // 保存在VPackage对象中
        pkg = PackageParserEx.parsePackage(packageFile);
    } catch (Throwable e) {
        e.printStackTrace();
    }
    ...
    // 2. 把so库复制到/data/data/io.virtualapp/virtual/$packageName/lib 目录下
    File appDir = VEnvironment.getDataAppPackageDirectory(pkg.packageName);
    File libDir = new File(appDir, "lib");
    NativeLibraryHelperCompat.copyNativeBinaries(new File(path), libDir);
    ...
    // 3. 保存前面通过android.pm.PackageParser解析出来的信息
    PackageParserEx.savePackageCache(pkg);
    PackageCacheManager.put(pkg, ps);
    ...
    // 4. 把apk文件复制到/data/data/io.virtualapp/virtual/$packageName 目录下
    File privatePackageFile = new File(appDir, "base.apk");
    FileUtils.copyFile(packageFile, privatePackageFile);
}

// HCallbackStub.java
public class HCallbackStub implements Handler.Callback, IInjector {
    @Override
    public void inject() throws Throwable {
        otherCallback = getHCallback();
        // 将this，也就是HCallbackStub注入到ActivityThread的mH实例的mCallback字段中
        mirror.android.os.Handler.mCallback.set(getH(), this);
    }
    
    private static Handler getH() {
        // 获取单例ActivityThread的mH实例
        return ActivityThread.mH.get(VirtualCore.mainThread());
    }

    private static Handler.Callback getHCallback() {
        try {
            Handler handler = getH();
            // 获取单例ActivityThread的mH实例中的mCallack实例
            return mirror.android.os.Handler.mCallback.get(handler);
        } catch (Throwable e) {
            e.printStackTrace();
        }
        return null;
    }
    
    @Override
    public boolean handleMessage(Message msg) {
        ...
    }
}

// Handler.java
public void dispatchMessage(@NonNull Message msg) {
    if (msg.callback != null) {
        handleCallback(msg);
    } else {
        if (mCallback != null) {
            if (mCallback.handleMessage(msg)) {
               // 通过callback 的 handleMessage返回值，可以决定是否转发给Handler
                return;
            }
        }
        handleMessage(msg);
    }
}

// MethodProxies.java
class MethodProxies {
    static class StartActivity extends MethodProxy {

        @Override
        public String getMethodName() {
            return "startActivity";
        }
        
        public Object call(Object who, Method method, Object... args) throws Throwable {
            ...
            int res = VActivityManager.get().startActivity(intent, activityInfo, resultTo, options, resultWho, requestCode, VUserHandle.myUserId());
            ...
            return res;
        }
    }
}

// ActivityManagerStub.java
// runtime级别的注解，运行时会把MethodProxies内所有的类实例化，并加到一个表里面
@Inject(MethodProxies.class)
public class ActivityManagerStub extends MethodInvocationProxy<MethodInvocationStub<IInterface>> {
    @Override
    public void inject() throws Throwable {
        if (BuildCompat.isOreo()) {
            //Android Oreo(8.X)
            // 拿到ActivityManager中的IActivityManagerSingleton对象
            Object singleton = ActivityManagerOreo.IActivityManagerSingleton.get();
            // 将这个对象的mInstance，替换成我们自己的代理对象，即ProxyInterface
            Singleton.mInstance.set(singleton, getInvocationStub().getProxyInterface());
        } else {
            if (ActivityManagerNative.gDefault.type() == IActivityManager.TYPE) {
                // 同理
                ActivityManagerNative.gDefault.set(getInvocationStub().getProxyInterface());
            } else if (ActivityManagerNative.gDefault.type() == Singleton.TYPE) {
                // 同理
                Object gDefault = ActivityManagerNative.gDefault.get();
                Singleton.mInstance.set(gDefault, getInvocationStub().getProxyInterface());
            }
        }
    }
}

<activity
    android:name="com.lody.virtual.client.stub.StubActivity$C0"
    android:configChanges="mcc|mnc|locale|touchscreen|keyboard|keyboardHidden|navigation|orientation|screenLayout|uiMode|screenSize|smallestScreenSize|fontScale"
    android:process=":p0"
    android:taskAffinity="com.lody.virtual.vt"
    android:theme="@style/VATheme" />

<activity
    android:name="com.lody.virtual.client.stub.StubActivity$C1"
    android:configChanges="mcc|mnc|locale|touchscreen|keyboard|keyboardHidden|navigation|orientation|screenLayout|uiMode|screenSize|smallestScreenSize|fontScale"
    android:process=":p1"
    android:taskAffinity="com.lody.virtual.vt"
    android:theme="@style/VATheme" />
    
    ...
    
<provider
    android:name="com.lody.virtual.client.stub.StubContentProvider$C0"
    android:authorities="${applicationId}.virtual_stub_0"
    android:exported="false"
    android:process=":p0" />

<provider
    android:name="com.lody.virtual.client.stub.StubContentProvider$C1"
    android:authorities="${applicationId}.virtual_stub_1"
    android:exported="false"
    android:process=":p1" />
    
    ...

public void launchTargetApp(String packageName, int userId) {
    Intent targetIntent = VirtualCore.get().getLaunchIntent(packageName, userId)
    if (targetIntent != null) {
        VirtualCore.get().startActivity(intent)
    }
}

public List<ResolveInfo> queryIntentActivities(Intent intent, String resolvedType, int flags, int userId) {
    ...
    // 尝试从intent内获取ComponentName
    ComponentName comp = intent.getComponent();
    ...
    if (comp != null) {
        final List<ResolveInfo> list = new ArrayList<ResolveInfo>(1);
        //     1. 在这里会通过VPMS内部维护的包列表，以component.packageName为key
        // 获取对应activityInfo并返回
        final ActivityInfo ai = getActivityInfo(comp, flags, userId);
        if (ai != null) {
            final ResolveInfo ri = new ResolveInfo();
            ri.activityInfo = ai;
            list.add(ri);
        }
        return list;
    }
    ...
    final String pkgName = intent.getPackage();
    if (pkgName == null) {
        // 2. 通过intent-filter，获取category为LAUNCHER的activityInfoList
        return mActivities.queryIntent(intent, resolvedType, flags, userId);
    }
    final VPackage pkg = mPackages.get(pkgName);
    if (pkg != null) {
        // 3. 同样也是通过intent-filter，获取category为LAUNCHER的activityInfoList，只不过增加了包名的过滤条件
        return mActivities.queryIntentForPackage(intent, resolvedType, flags, pkg.activities, userId);
    }
    return Collections.emptyList();
}

// VActivityManagerService.java
int startActivityLocked(int userId, Intent intent, ActivityInfo info, IBinder resultTo, Bundle options,
                        String resultWho, int requestCode) {
    TaskRecord reuseTask = null;
    // 通过启动模式、Intent中所带的flags来确定可以在现有的哪个任务栈启动
    ...
    if (reuseTask == null) {
        // 没有可用的任务栈，就在新的任务栈中启动
        startActivityInNewTaskLocked(userId, intent, info, options);
    } else {
        // 把可用的任务栈移动到前台
        mAM.moveTaskToFront(reuseTask.taskId, 0);
        ...
        // 根据ActivityInfo的processName，分配一个对应进程的桩activity
        // 再将intent内的component替换成桩activity
        // 启动桩activity所对应的进程
        destIntent = startActivityProcess(userId, sourceRecord, intent, info);
        // 在对应进程启动桩activity
        // 最终调到realStartActivityLocked中
        startActivityFromSourceTask(reuseTask, destIntent, info, resultWho, requestCode, options);
    }
    return 0;
}

private Intent startActivityProcess(int userId, ActivityRecord sourceRecord, Intent intent, ActivityInfo info) {
    // 根据activity的进程，分配一个进程
    ProcessRecord targetApp = mService.startProcessIfNeedLocked(info.processName, userId, info.packageName);
    ...
    Intent targetIntent = new Intent();
    // 根据进程的vpid，找到对应的桩activity
    targetIntent.setClassName(VirtualCore.get().getHostPkg(), fetchStubActivity(targetApp.vpid, info));
    ...
    // 把原始的activityInfo保存到桩activity对应的intent中，这里是targetIntent
    StubActivityRecord saveInstance = new StubActivityRecord(intent, info,
            sourceRecord != null ? sourceRecord.component : null, userId);
    saveInstance.saveToIntent(targetIntent);
    return targetIntent;
}

private void realStartActivitiesLocked(IBinder resultTo, Intent[] intents, String[] resolvedTypes, Bundle options) {
    Class<?>[] types = IActivityManager.startActivities.paramList();
    Object[] args = new Object[types.length];
    ...
    // 直接走本地的ActivityManager启动桩activity
    IActivityManager.startActivities.call(ActivityManagerNative.getDefault.call(),
                (Object[]) args);
}

// HCallbackStub.java
@Override
public boolean handleMessage(Message msg) {
    if (LAUNCH_ACTIVITY == msg.what) {
        if (!handleLaunchActivity(msg)) {
            return true;
        }
    }
    return false;
}

private boolean handleLaunchActivity(Message msg) {
    Object r = msg.obj;
    Intent stubIntent = ActivityThread.ActivityClientRecord.intent.get(r);
    // 反序列化真正需要启动的activity信息
    StubActivityRecord saveInstance = new StubActivityRecord(stubIntent);
    Intent intent = saveInstance.intent;
    ActivityInfo info = saveInstance.info;
    ...
    if (!VClientImpl.get().isBound()) {
        // apk的application还没有初始化，先初始化
        // 主要是创建一个application实例，修改进程名，以及回调一些生命周期，等等；
        VClientImpl.get().bindApplication(info.packageName, info.processName);
        // 把这个消息插入到消息队列头部
        getH().sendMessageAtFrontOfQueue(Message.obtain(msg));
        // 不让Handler处理
        return false;
    }
    ...
    // 将classloader设置进去
    ClassLoader appClassLoader = VClientImpl.get().getClassLoader(info.applicationInfo);
    intent.setExtrasClassLoader(appClassLoader);
    // 替换intent
    ActivityThread.ActivityClientRecord.intent.set(r, intent);
    // 替换需要启动的Activity
    ActivityThread.ActivityClientRecord.activityInfo.set(r, info);
    return true;
}

// VClientImpl.java
private void bindApplicationNoCheck(String packageName, String processName, ConditionVariable lock) {
    AppBindData data = new AppBindData();
    // 初始化applicationInfo
    data.appInfo = VPackageManager.get().getApplicationInfo(packageName, 0, getUserId(vuid));
    // 初始化进程名
    data.processName = processName;
    ...
    mBoundApplication = data;
    // 获取包的context，这个context的classloader，能加载apk中的类
    Context context = createPackageContext(data.appInfo.packageName);
    ...
    Object boundApp = fixBoundApp(mBoundApplication);
    mBoundApplication.info = ContextImpl.mPackageInfo.get(context);
    // 注入LoadedApk，
    // data.info就是mBoundApplication.info，
    // mBoundApplication.info就是context的mPackageInfo
    mirror.android.app.ActivityThread.AppBindData.info.set(boundApp, data.info);
    ...
    // 初始化apk内的application
    mInitialApplication = LoadedApk.makeApplication.call(data.info, false, null);
    // 注入到ActivityThread中的mInitialApplication字段
    mirror.android.app.ActivityThread.mInitialApplication.set(mainThread, mInitialApplication);
    ...
}

private Context createPackageContext(String packageName) {
    try {
        Context hostContext = VirtualCore.get().getContext();
        // CONTEXT_INCLUDE_CODE 代表包括代码
        // CONTEXT_IGNORE_SECURITY 代表忽略安全警告
        return hostContext.createPackageContext(packageName, Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY);
    } catch (PackageManager.NameNotFoundException e) {
        e.printStackTrace();
        VirtualRuntime.crash(new RemoteException());
    }
    throw new RuntimeException();
}

private boolean handleLaunchActivity(Message msg) {
    ActivityInfo info = saveInstance.info;
    ...
    // 这里把activityInfo给设置进去了
    ActivityThread.ActivityClientRecord.activityInfo.set(r, info);
    // 把这个message转发给mH处理
    return true;
}

/**  Core implementation of activity launch. */
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    ActivityInfo aInfo = r.activityInfo;
    if (r.packageInfo == null) {
        r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                Context.CONTEXT_INCLUDE_CODE);
    }
    ...
    ContextImpl appContext = createBaseContextForActivity(r);
    Activity activity = null;
    java.lang.ClassLoader cl = appContext.getClassLoader();
    // 通过classloader加载对应的activity类，然后反射创建
    activity = mInstrumentation.newActivity(
            cl, component.getClassName(), r.intent);
}

 /**  Core implementation of activity launch. */
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    ActivityInfo aInfo = r.activityInfo;
    if (r.packageInfo == null) {
        r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                Context.CONTEXT_INCLUDE_CODE);
    }
    ...
    ContextImpl appContext = createBaseContextForActivity(r);
    ...
}

private ContextImpl createBaseContextForActivity(ActivityClientRecord r) {
    ContextImpl appContext = ContextImpl.createActivityContext(
        this, r.packageInfo, r.activityInfo, r.token, displayId, r.overrideConfig);
    ...
    return appContext;
}

static ContextImpl createActivityContext(ActivityThread mainThread,
        LoadedApk packageInfo, ActivityInfo activityInfo, IBinder activityToken, int displayId,
        Configuration overrideConfiguration) {
    ...
    // Create the base resources for which all configuration contexts for this Activity
    // will be rebased upon.
    context.setResources(resourcesManager.createBaseTokenResources(activityToken,
            packageInfo.getResDir(),
            splitDirs,
            packageInfo.getOverlayDirs(),
            packageInfo.getApplicationInfo().sharedLibraryFiles,
            displayId,
            overrideConfiguration,
            compatInfo,
            classLoader,
            packageInfo.getApplication() == null ? null
                    : packageInfo.getApplication().getResources().getLoaders()));
    context.mDisplay = resourcesManager.getAdjustedDisplay(displayId,
            context.getResources());
    return context;
}

private fun isAmProxy(): Boolean {
    val clazz = Class.forName("android.app.ActivityManager")
    val field = clazz.getDeclaredField("IActivityManagerSingleton")
    field.isAccessible = true
    val singleton = field.get(null)
    val singletonClazz = Class.forName("android.util.Singleton")
    val get = singletonClazz.getDeclaredMethod("get")
    val am = get.invoke(singleton)
    return am is Proxy
}

private fun runningBadEnvironment(): Boolean {
    val am = getSystemService(ACTIVITY_SERVICE) as ActivityManager
    val runningProcesses = am.runningAppProcesses
    runningProcesses.forEach {
        // 这里可以加个白名单，防止误伤
        if (!it.processName.contains(packageName)) {
            return true
        }
    }
    return false
}

private fun appDirAccessible() {
    var parent = File(dataDir.parent ?: "")
    var accessible = false
    while (parent.absolutePath != File.separator) {
        accessible = accessible or parent.canRead()
        parent = File(parent.parent ?: File.separator)
    }
    return accessible
}