807      public ClassLoader getClassLoader() {
808          synchronized (this) {
809              if (mClassLoader == null) {
810                  createOrUpdateClassLoaderLocked(null /*addedPaths*/);
811              }
812              return mClassLoader;
813          }
814      }

181        ReflectionHelpers.setField(activityThread, "mBoundApplication", data);
182  
183        LoadedApk loadedApk = activityThread.getPackageInfo(applicationInfo, null, Context.CONTEXT_INCLUDE_CODE);

private ClassLoader getRealClassLoader(XC_LoadPackage.LoadPackageParam lpparam) {
    try {
        Class<?> atClass = Class.forName("android.app.ActivityThread");
        Object at = atClass.getMethod("currentActivityThread").invoke(null);
        if (at == null)
            throw new RuntimeException("ActivityThread is null");

        Object boundApp = XposedHelpers.getObjectField(at, "mBoundApplication");
        if (boundApp == null)
            throw new RuntimeException("mBoundApplication is null");

        Object loadedApk = XposedHelpers.getObjectField(boundApp, "info");
        if (loadedApk == null)
            throw new RuntimeException("LoadedApk is null");

        ClassLoader cl = (ClassLoader) XposedHelpers.callMethod(loadedApk, "getClassLoader");
        if (cl != null) {
            Log.e(TAG, "Got real ClassLoader: " + cl);
            Log.e(TAG, "ClassLoader type: " + cl.getClass().getName());
            return cl;
        }
    } catch (Throwable t) {
        Log.e(ErrTAG, "getRealClassLoader failed", t);
    }
    Log.w(TAG, "Fallback to lpparam.classLoader");
    return lpparam.classLoader;
}

46      private final DexPathList pathList;

64      private Element[] dexElements;

// 
static class Element {
607          /**
608           * A file denoting a zip file (in case of a resource jar or a dex jar), or a directory
609           * (only when dexFile is null).
610           */
611          private final File path;
612  
613          private final DexFile dexFile;
614  
615          private ClassPathURLStreamHandler urlHandler;
616          private boolean initialized;
......

41  public final class DexFile {
42    /**
43     * If close is called, mCookie becomes null but the internal cookie is preserved if the close
44     * failed so that we can free resources in the finalizer.
45     */
46      @ReachabilitySensitive
47      private Object mCookie;
48  
49      private Object mInternalCookie;

/**
 * 遍历 ClassLoader 的所有 dexElements 并全部 dump
 */
private List<DexFile> getAllDexFiles(ClassLoader loader) {
    List<DexFile> dexFiles = new ArrayList<>();
    try {
        if (!(loader instanceof BaseDexClassLoader)) {
            Log.e(TAG, "Not BaseDexClassLoader: " + loader.getClass().getName());
            return dexFiles;
        }
        Object pathList = XposedHelpers.getObjectField(loader, "pathList");
        Object[] dexElements = (Object[]) XposedHelpers
                .getObjectField(pathList, "dexElements");
        Log.e(TAG, "dexElements count: " + dexElements.length);

        for (Object element : dexElements) {
            // 某些 element 本身也可能是 null
            if (element == null)
                continue;
            Object dexFileObj = XposedHelpers.getObjectField(element, "dexFile");
            if (dexFileObj instanceof DexFile) {
                dexFiles.add((DexFile) dexFileObj);
            }
        }
        Log.e(TAG, "Valid DexFile count: " + dexFiles.size());

    } catch (Throwable t) {
        Log.e(ErrTAG, "getAllDexFiles failed", t);
    }
    return dexFiles;
}

private void dumpDex(DexFile dexFile, String outDir) {
    // 防止重复dump，减少性能开销
    synchronized (dumpedDexFiles) {
        if (dumpedDexFiles.contains(dexFile))
            return;
        dumpedDexFiles.add(dexFile);
    }
    try {
        // 通过mCookie去拿到指针进行Dump
        Object cookie = XposedHelpers.getObjectField(dexFile, "mCookie");
        if (cookie instanceof long[]) {
            long[] c = (long[]) cookie;
            dumpDexByCookie(c, outDir);
        }
    } catch (Throwable t) {
        Log.e(ErrTAG, "dumpDex failed", t);
    }
}

395      private static native String[] getClassNameList(Object cookie);

136      public Class<?>[] getParameterTypes() {
137          // Android-changed: getParameterTypes() partly implemented using Executable.
138          Class<?>[] paramTypes = super.getParameterTypesInternal();
139          if (paramTypes == null) {
140              return EmptyArray.CLASS;
141          }
142  
143          return paramTypes;
144      }

private Object[] makeDefaultArgs(Class<?>[] paramTypes) {
    Object[] args = new Object[paramTypes.length];
    for (int i = 0; i < paramTypes.length; i++) {
        Class<?> t = paramTypes[i];
        // 对于引用类型，传入null是合法的（没必要再去构造对应类型参数）
        if (t == boolean.class)
            args[i] = false;
        else if (t == byte.class)
            args[i] = (byte) 0;
        else if (t == char.class)
            args[i] = (char) 0;
        else if (t == short.class)
            args[i] = (short) 0;
        else if (t == int.class)
            args[i] = 0;
        else if (t == long.class)
            args[i] = 0L;
        else if (t == float.class)
            args[i] = 0.0f;
        else if (t == double.class)
            args[i] = 0.0;
        else
            args[i] = null;
    }
    return args;
}

    // 在类级别定义一个共享实例，避免每次循环都创建新对象
    private static final XC_MethodHook BLOCK_CONSTRUCTOR = new XC_MethodHook() {
        @Override
        protected void beforeHookedMethod(MethodHookParam param) {
            param.setResult(null); // 构造方法返回 void，用 null
        }
    };

private void invokeAllConstructors(String[] names, BaseDexClassLoader loader, List<String> blackList) {
        for (String name : names) {
            try {
                // 将黑名单进行剔除，因为在某些APP的某些类中，可能会继承一些当前Android版本不存在的类
                // 这时候尝试new实例会直接导致APP崩溃
                if (matchPrefix(blackList, name)) continue; 
                Class<?> clazz = XposedHelpers.findClass(name, loader);
                int mod = clazz.getModifiers();
                if (clazz.isInterface() || clazz.isAnnotation()
                        || clazz.isEnum() || Modifier.isAbstract(mod))
                    continue;

                Constructor<?>[] constructors = clazz.getDeclaredConstructors();
                if (constructors.length == 0) continue;

                // 选择任意一个构造方法即可
                Constructor<?> target = constructors[0];
                target.setAccessible(true);

                Set<XC_MethodHook.Unhook> unhooks = XposedBridge.hookAllConstructors(clazz, BLOCK_CONSTRUCTOR);
                try {
                    // 获取参数列表，通过正确的参数类型调用可以避免在调用中途遇到无法预期的拦截
                    Object[] args = makeDefaultArgs(target.getParameterTypes());
                    if (invokeDebugger) Log.e(DebugTag, "Invoke Class: " + clazz);
                    // 调用构造方法，触发代码的回填
                    target.newInstance(args);
                } catch (Throwable ignored) {
                } finally {
                    // 为了防止某些加固通过检测方法是否被转为Native方法来检测Hook，无论构造是否成功都要解除Hook
                    for (XC_MethodHook.Unhook unhook : unhooks) {
                        unhook.unhook();
                    }
                }
            } catch (Throwable e) {
                Log.e(ErrTAG, "Failed: " + name, e);
            }
        }
    }

try {
                        // sleep 10秒，等待壳加载结束
                        Thread.sleep(10000);
                        ensureNativeLoaded();
                        if (!nativeLoaded) {
                            Log.e(TAG, "Native library not loaded, abort!");
                            return;
                        }
                        // 通过LoadedApk获取APP的真实ClassLoader
                        ClassLoader realLoader = getRealClassLoader(loadPackageParam);
                        if (!(realLoader instanceof BaseDexClassLoader)) {
                            Log.e(TAG, "realLoader is not BaseDexClassLoader, skip invokeAllMethod");
                            return;
                        }
                        // 通过DexFile的Cookie将所有Dex文件Dump下来
                        List<DexFile> allDexFile = getAllDexFiles(realLoader);
                        // 调用DexFile内部的getClassNameList方法获取所有的Class名称，然后去进行主动调用
                        for (DexFile dexFile : allDexFile) {
                            if (dexFile != null) {
                                // 获取每一个DexFile的方法之后主动调用
                                String[] names = getAllClassName(dexFile, whiteList, blackList);
                                invokeAllConstructors(names, (BaseDexClassLoader) realLoader,blackList);
//                                invokeTest(realLoader, "");
                                // 将Dex文件dump到输出目录
                                dumpDex(dexFile, outDir);
                            }
                        }
                        Log.e(TAG, "All Dex dumps completed!");
                    } catch (Throwable e) {
                        Log.e(ErrTAG, "Reflect dump failed", e);
                    }

String[] methodNames = {
        "makeDexElements",        // DexClassLoader
        "makePathElements",       // PathClassLoader
        "makeInMemoryDexElements" // InMemoryDexClassLoader
};

319      private static Element[] makeDexElements(List<File> files, File optimizedDirectory,
320              List<IOException> suppressedExceptions, ClassLoader loader) {
321          return makeDexElements(files, optimizedDirectory, suppressedExceptions, loader, false);
322      }
323  
324  
325      private static Element[] makeDexElements(List<File> files, File optimizedDirectory,
326              List<IOException> suppressedExceptions, ClassLoader loader, boolean isTrusted) {
327        Element[] elements = new Element[files.size()];
328        int elementsPos = 0;
......