最近在適配Android Q，發(fā)現(xiàn)用的Hook框架不好用了，于是在同事大佬的幫助下拿到源碼，翻了一下，以下是區(qū)別

Android 8

public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {
        //.....省略不重要的
        try {
            intent.migrateExtraStreamToClipData();
            intent.prepareToLeaveProcess(who);
           int result = ActivityManager.getService()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target != null ? target.mEmbeddedID : null,
                        requestCode, 0, null, options);
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

重點是這一句

ActivityManager.getService().startActivity();

這是通過ActivityManagerService啟動的。

Android Q

@UnsupportedAppUsage
public ActivityResult execStartActivity(Context paramContext, IBinder paramIBinder1, IBinder paramIBinder2, Activity paramActivity, Intent paramIntent, int paramInt, Bundle paramBundle)
  {
    //.....省略不重要的
    try{
      paramIntent.migrateExtraStreamToClipData();
      paramIntent.prepareToLeaveProcess(paramContext);
      localIActivityTaskManager = ActivityTaskManager.getService();
      paramIBinder1 = paramContext.getBasePackageName();
      ??? = paramIntent.resolveTypeIfNeeded(paramContext.getContentResolver());
      if (paramActivity != null) {
        try{
          paramContext = paramActivity.mEmbeddedID;
        }
        catch (RemoteException paramContext){
          break label287;
        }
      } else {
        paramContext = null;
      }
      try{
        checkStartActivityResult(localIActivityTaskManager.startActivity(localIApplicationThread, paramIBinder1, paramIntent, (String)???, paramIBinder2, paramContext, paramInt, 0, null, paramBundle), paramIntent);
        return null;
      }
      catch (RemoteException paramContext) {}
      throw new RuntimeException("Failure from system", paramContext);
    }
    catch (RemoteException paramContext) {}
  }

可以看到重點是這里

localIActivityTaskManager = ActivityTaskManager.getService();
localIActivityTaskManager.startActivity();

這里是通過ActivityTaskManagerService來啟動的。
因為啟動類變了，所以Hook失效。