handle = dlopen(pathName, RTLD_LAZY); //获得指定库文件的句柄,
//这个库文件就是System.loadLibrary(pathName)传递的参数
…..
vonLoad = dlsym(handle, "JNI_OnLoad"); //获取该文件的JNI_OnLoad函数的地址
   if (vonLoad == NULL) { //如果找不到JNI_OnLoad，就说明这是用javah风格的代码了，那么就推迟解析
 LOGD("No JNI_OnLoad found in %s %p, skipping init",pathName, classLoader); //这句话我们在logcat中经常看见！
}else{
….
}

/*callQihooSo.c*/

#include <string.h>
#include <stdio.h>
#include <jni.h>
#include <dlfcn.h>  //使用dlopen等函数的头文件
#include <android/log.h>

#define LOG_TAG "360TEST2"
#define LOGI(...) __android_log_print(ANDROID_LOG_INFO, LOG_TAG, __VA_ARGS__)

/*这里我直接使用javah的方式编写native代码*/
JNIEXPORT  Java_com_qihoo_crack_StubApplication_MainActivity_packageNameCheck( JNIEnv* env,  jobject obj){
void* filehandle =dlopen("/data/data/com.qihoo.crack.StubApplication/lib/libqihooTest.so", RTLD_LAZY ); //获取libqihooTest.so的句柄
	  if(filehandle){
	    void (*packageNameCheck)(JNIEnv *,jobject);
	    packageNameCheck = (void (*)(JNIEnv *,jobject)) dlsym(filehandle, "packageNameCheck"); //找到.so文件中的函数
	    if(packageNameCheck){
	      packageNameCheck(env, obj); //传递参数	    }
	    else{
	      LOGI("get packageNameCheck func failed!");
	    }
	    LOGI("success!");
	  }else{
		  LOGI("get file handle failed!");
	  }
	 return ;
}

JNIEXPORT   Java_com_qihoo_crack_StubApplication_MainActivity_applicatioNameCheck( JNIEnv* env,
                                                  jobject obj){
	  void*  filehandle = dlopen("/data/data/com.qihoo.crack.StubApplication/lib/libqihooTest.so", RTLD_LAZY );
	  if(filehandle){
	    void (*applicatioNameCheck)(JNIEnv *,jobject);
	    applicatioNameCheck = (void (*)(JNIEnv *,jobject)) dlsym(filehandle, "applicatioNameCheck"); //找到.so文件中的函数
	    if(applicatioNameCheck){
	    	applicatioNameCheck(env, obj); //传递参数
	      return ;
	    }
	    else{
                  LOGI("get applicatioNameCheck func failed! ");
	    }
	    LOGI("success!");
	  }else{
		  LOGI("get file handle failed!");
	  }
	return ; 
}

LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)
LOCAL_LDLIBS := -L . -ldl -llog  #一定要加入ldl这个库，dyopen等函数需要
LOCAL_MODULE := callQihooSo
include $(BUILD_SHARED_LIBRARY)

package com.qihoo.crack.StubApplication;

import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.ArrayList;

import android.app.Application;
import android.content.Context;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.os.Bundle;
import android.text.InputFilter.AllCaps;
import android.util.Log;

public abstract class ProxyApplication extends Application{
	protected abstract void initProxyApplication();
	private static Context pContext = null; //保存ProxyApp的mContext,后面有用
	private static String TAG = "proxy";
	@Override
	public void onCreate() {
		// TODO Auto-generated method stub
		super.onCreate();
		String className = "android.app.Application"; //默认的Application名		   String key = "DELEGATE_APPLICATION_CLASS_NAME";
		try {
			ApplicationInfo appInfo = getPackageManager().getApplicationInfo(super.getPackageName(), PackageManager.GET_META_DATA);
			Bundle bundle = appInfo.metaData;
			if(bundle != null && bundle.containsKey(key)){
				className = bundle.getString(key);
				if(className.startsWith(".")){
					className = super.getPackageName() + className;
				}
			}
			
			Class delegateClass = Class.forName(className, true, getClassLoader());
			Application delegate = (Application) delegateClass.newInstance();
			
          //获取当前Application的applicationContext
Application proxyApplication = (Application)getApplicationContext();
			
/*使用反射一一替换proxyApplicationContext，这是本程序的重难点*/
			//首先更改proxy的mbaseContext中的成员mOuterContext
			Class contextImplClass = Class.forName("android.app.ContextImpl");
			Field mOuterContext = contextImplClass.getDeclaredField("mOuterContext");
			mOuterContext.setAccessible(true);
			mOuterContext.set(pContext, delegate);
			
			//再获取context的mPackageInfo变量对象
			Field mPackageInfoField = contextImplClass.getDeclaredField("mPackageInfo");
			mPackageInfoField.setAccessible(true);
			Object mPackageInfo = mPackageInfoField.get(pContext);
			Log.d(TAG, "mPackageInfo: "+ mPackageInfo);
			
			//修改mPackageInfo中的成员变量mApplication
			Class loadedApkClass = Class.forName("android.app.LoadedApk");  //mPackageInfo是android.app.LoadedApk类
			Field mApplication = loadedApkClass.getDeclaredField("mApplication");
			mApplication.setAccessible(true);
			mApplication.set(mPackageInfo, delegate);
			
			//然后再获取mPackageInfo中的成员对象mActivityThread
			Class activityThreadClass = Class.forName("android.app.ActivityThread");
			Field mAcitivityThreadField = loadedApkClass.getDeclaredField("mActivityThread");
			mAcitivityThreadField.setAccessible(true);
			Object mActivityThread = mAcitivityThreadField.get(mPackageInfo);
			
			//设置mActivityThread对象中的mInitialApplication
			Field mInitialApplicationField = activityThreadClass.getDeclaredField("mInitialApplication");
			mInitialApplicationField.setAccessible(true);
			mInitialApplicationField.set(mActivityThread, delegate);
			
			//最后是mActivityThread对象中的mAllApplications，注意这个是List
			Field mAllApplicationsField = activityThreadClass.getDeclaredField("mAllApplications");
			mAllApplicationsField.setAccessible(true);
			ArrayList<Application> al = (ArrayList<Application>)mAllApplicationsField.get(mActivityThread);
			al.add(delegate);
			al.remove(proxyApplication);
			
			
			//设置baseContext并调用onCreate
			Method attach = Application.class.getDeclaredMethod("attach", Context.class);
			attach.setAccessible(true);
			attach.invoke(delegate, pContext);
			delegate.onCreate();
								
						
		} catch (NameNotFoundException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (ClassNotFoundException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (InstantiationException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (IllegalAccessException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (NoSuchFieldException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (NoSuchMethodException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (IllegalArgumentException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (InvocationTargetException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}	
	}

	@Override
	public String getPackageName() {
		// TODO Auto-generated method stub
		return "Learning And Sharing!";
	}
	@Override
	protected void attachBaseContext(Context base) {
		// TODO Auto-generated method stub
		super.attachBaseContext(base);
		pContext = base;
		Log.d(TAG, "attachBaseContext");
		initProxyApplication();
	}
}

//修改mPackageInfo中的成员变量mApplication
			Class loadedApkClass = Class.forName("android.app.LoadedApk");  //mPackageInfo是android.app.LoadedApk类

package com.qihoo.crack.StubApplication;

import android.app.Application;
import android.content.Context;
import android.content.ContextWrapper;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.os.Bundle;
import android.util.Log;

public class MyProxyApplication extends ProxyApplication{
	@Override
	protected void initProxyApplication() {
		// TODO Auto-generated method stub
		//在这里替换surrounding，实现自定义的classloader等功能
		Log.d("proxy", "initProxyApplication");	
	}
}

<application
        android:name="com.qihoo.crack.StubApplication.MyProxyApplication"
        android:allowBackup="true"
        android:icon="@drawable/ic_launcher"
        android:label="@string/app_name"
        android:theme="@style/AppTheme" >
        <meta-data
            android:name="DELEGATE_APPLICATION_CLASS_NAME"
            android:value="@string/app_name" >
        </meta-data>
        <activity
            android:name="com.qihoo.crack.StubApplication.MainActivity"
            android:label="@string/app_name" >
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>

[课程]Android-CTF解题方法汇总！