【Android 安全】DEX 加密 ( Application 替换 | 分析 ContentProvider 组件中调用 getApplication() 获取的 Application 二 )（一）

// ★ 反射创建 ContentProvider 
localProvider = (ContentProvider)cl.
    loadClass(info.name).newInstance();

// XXX Need to create the correct context for this provider.
// ★ 创建 ContentProvider 之后 , 调用了 attachInfo 函数 
// 注意此处与 Activity , Service , BrocastReceiver 不同 , 
// 这三个组件创建后调用的是 attach 函数
localProvider.attachInfo(c, info);

// ★ 该上下文对象很重要 
Context c = null;

// 该 ApplicationInfo 是 AndroidManifest.xml 中配置的 application 节点信息
ApplicationInfo ai = info.applicationInfo;

// ★ 该上下文对象很重要 
            Context c = null;
    // 该 ApplicationInfo 是 AndroidManifest.xml 中配置的 application 节点信息
            ApplicationInfo ai = info.applicationInfo;
    // 该 context 是 ProxyApplication , 代理 Application 
            if (context.getPackageName().equals(ai.packageName)) {
    // 在应用中配置的代理 Application 包名与真实 Application 包名都是相等的
    // 该分支是命中的 
                c = context;
            } else if (mInitialApplication != null &&
                    mInitialApplication.getPackageName().equals(ai.packageName)) {
    // 该分支中 mInitialApplication 就是 Context context 参数 , 肯定不为空 
    // 该分支无法命中 
                c = mInitialApplication;
            } else {
    // 上述两个分支都无法命中 , 才进入该分支 
    // 需要将代理 Application 的包名 与 真实应用的包名设置成不同的
    // 此时上面两个分支都无法命中 
                try {
                    c = context.createPackageContext(ai.packageName,
                            Context.CONTEXT_INCLUDE_CODE);
                } catch (PackageManager.NameNotFoundException e) {
                    // Ignore
                }
            }

public final class ActivityThread {
    /**
     * Installs the provider.
     *
     * Providers that are local to the process or that come from the system server
     * may be installed permanently which is indicated by setting noReleaseNeeded to true.
     * Other remote providers are reference counted.  The initial reference count
     * for all reference counted providers is one.  Providers that are not reference
     * counted do not have a reference count (at all).
     *
     * This method detects when a provider has already been installed.  When this happens,
     * it increments the reference count of the existing provider (if appropriate)
     * and returns the existing provider.  This can happen due to concurrent
     * attempts to acquire the same provider.
     */
    private ContentProviderHolder installProvider(Context context,
            ContentProviderHolder holder, ProviderInfo info,
            boolean noisy, boolean noReleaseNeeded, boolean stable) {
  // ★ 声明 ContentProvider 
        ContentProvider localProvider = null;
        IContentProvider provider;
        if (holder == null || holder.provider == null) {
            if (DEBUG_PROVIDER || noisy) {
                Slog.d(TAG, "Loading provider " + info.authority + ": "
                        + info.name);
            }
    // 该上下文对象很重要 
            Context c = null;
            ApplicationInfo ai = info.applicationInfo;
    // 该 context 是 ProxyApplication , 代理 Application 
            if (context.getPackageName().equals(ai.packageName)) {
    // 在应用中配置的代理 Application 包名与真实 Application 包名都是相等的
    // 该分支是命中的 
                c = context;
            } else if (mInitialApplication != null &&
                    mInitialApplication.getPackageName().equals(ai.packageName)) {
    // 该分支中 mInitialApplication 就是 Context context 参数 , 肯定不为空 
    // 该分支无法命中 
                c = mInitialApplication;
            } else {
    // 上述两个分支都无法命中 , 才进入该分支 
    // 需要将代理 Application 的包名 与 真实应用的包名设置成不同的
    // 此时上面两个分支都无法命中 
                try {
                    c = context.createPackageContext(ai.packageName,
                            Context.CONTEXT_INCLUDE_CODE);
                } catch (PackageManager.NameNotFoundException e) {
                    // Ignore
                }
            }
            if (c == null) {
                Slog.w(TAG, "Unable to get context for package " +
                      ai.packageName +
                      " while loading content provider " +
                      info.name);
                return null;
            }
            try {
                final java.lang.ClassLoader cl = c.getClassLoader();
    // ★ 反射创建 ContentProvider 
                localProvider = (ContentProvider)cl.
                    loadClass(info.name).newInstance();
                provider = localProvider.getIContentProvider();
                if (provider == null) {
                    Slog.e(TAG, "Failed to instantiate class " +
                          info.name + " from sourceDir " +
                          info.applicationInfo.sourceDir);
                    return null;
                }
                if (DEBUG_PROVIDER) Slog.v(
                    TAG, "Instantiating local provider " + info.name);
                // XXX Need to create the correct context for this provider.
    // ★ 创建 ContentProvider 之后 , 调用了 attachInfo 函数 
    // 注意此处与 Activity , Service , BrocastReceiver 不同 , 
    // 这三个组件创建后调用的是 attach 函数
                localProvider.attachInfo(c, info);
            } catch (java.lang.Exception e) {
                return null;
            }
        } else {
        }
        return retHolder;
  }
}