public abstract class ClassLoader {
    // --------系统默认使用的类加载器是PathClassLoader，parent为BootClassLoader
    public static ClassLoader getSystemClassLoader() {
        return SystemClassLoader.loader;
    }

    static private class SystemClassLoader {
        public static ClassLoader loader = ClassLoader.createSystemClassLoader();
    }

    private static ClassLoader createSystemClassLoader() {
        String classPath = System.getProperty("java.class.path", ".");
        String librarySearchPath = System.getProperty("java.library.path", "");
        return new PathClassLoader(classPath, librarySearchPath, BootClassLoader.getInstance());
    }

    private final ClassLoader parent;

    private ClassLoader(Void unused, ClassLoader parent) {
        this.parent = parent;
    }

    protected ClassLoader(ClassLoader parent) {
        this(checkCreateClassLoader(), parent);
    }

    protected ClassLoader() {
        this(checkCreateClassLoader(), getSystemClassLoader());
    }

    public Class<?> loadClass(String name) throws ClassNotFoundException {
        return loadClass(name, false);
    }

    protected Class<?> loadClass(String name, boolean resolve) throws ClassNotFoundException {
        // 判断当前类加载器是否已经加载过指定类，若已加载则直接返回
        Class<?> c = findLoadedClass(name);
        if (c == null) {
            try {
                if (parent != null) {
                    // 如果没有加载过，则调用parent的类加载递归加载该类
                    c = parent.loadClass(name, false);
                } else {
                    // findBootstrapClassOrNull方法return null
                    c = findBootstrapClassOrNull(name);
                }
            } catch (ClassNotFoundException e) {
            }
            // 还没加载，则调用当前类加载器来加载
            if (c == null) {
                c = findClass(name);
            }
        }
        return c;
    }

    protected Class<?> findClass(String name) throws ClassNotFoundException {
        throw new ClassNotFoundException(name);
    }
}

public class BaseDexClassLoader extends ClassLoader {
    private final DexPathList pathList;

    public BaseDexClassLoader(String dexPath, File optimizedDirectory, String librarySearchPath, ClassLoader parent) {
        this(dexPath, optimizedDirectory, librarySearchPath, parent, false);
    }

    public BaseDexClassLoader(String dexPath, File optimizedDirectory, String librarySearchPath, ClassLoader parent, boolean isTrusted) {
        super(parent);
        this.pathList = new DexPathList(this, dexPath, librarySearchPath, null, isTrusted);
    }

    // BaseDexClassLoader 实现了 findClass 方法
    protected Class<?> findClass(String name) throws ClassNotFoundException {
        List<Throwable> suppressedExceptions = new ArrayList<Throwable>();
        // 实际上是通过 DexPathList 来加载类
        Class c = pathList.findClass(name, suppressedExceptions);
        if (c == null) {
            // throw Exception;
        }
        return c;
    }
}

public class PathClassLoader extends BaseDexClassLoader {
    public PathClassLoader(String dexPath, ClassLoader parent) {
        super(dexPath, null, null, parent);
    }

    public PathClassLoader(String dexPath, String librarySearchPath, ClassLoader parent) {
        super(dexPath, null, librarySearchPath, parent);
    }
}

public class DexClassLoader extends BaseDexClassLoader {
    public DexClassLoader(String dexPath, String optimizedDirectory, String librarySearchPath, ClassLoader parent) {
        super(dexPath, null, librarySearchPath, parent);
    }
}

public class MainActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        Log.d("LLL", "HashMap: " + HashMap.class.getClassLoader());
        Log.d("LLL", "Intent: " + Intent.class.getClassLoader());
        Log.d("LLL", "Activity: " + Activity.class.getClassLoader());
        Log.d("LLL", "AppCompatActivity: " + AppCompatActivity.class.getClassLoader());
        Log.d("LLL", "this: " + this.getClassLoader());
    }
}

HashMap: java.lang.BootClassLoader@e8c0fdc
Intent: java.lang.BootClassLoader@e8c0fdc
Activity: java.lang.BootClassLoader@e8c0fdc
AppCompatActivity: dalvik.system.PathClassLoader[DexPathList[[zip file "/data/app/com.hearing.demo-CXVzyNHtPtPvvTGoYDELiA==/base.apk"],nativeLibraryDirectories=[/data/app/com.hearing.demo-CXVzyNHtPtPvvTGoYDELiA==/lib/arm64, /system/lib64, /vendor/lib64]]]
this: dalvik.system.PathClassLoader[DexPathList[[zip file "/data/app/com.hearing.demo-CXVzyNHtPtPvvTGoYDELiA==/base.apk"],nativeLibraryDirectories=[/data/app/com.hearing.demo-CXVzyNHtPtPvvTGoYDELiA==/lib/arm64, /system/lib64, /vendor/lib64]]]

@hide
public final class DexPathList {
    private static final String DEX_SUFFIX = ".dex";
    private static final String zipSeparator = "!/";

    private Element[] dexElements;
    NativeLibraryElement[] nativeLibraryPathElements;

    public DexPathList(ClassLoader definingContext, String dexPath, String librarySearchPath, File optimizedDirectory) {
        this(definingContext, dexPath, librarySearchPath, optimizedDirectory, false);
    }

    DexPathList(ClassLoader definingContext, String dexPath, String librarySearchPath, File optimizedDirectory, boolean isTrusted) {
        this.dexElements = makeDexElements(splitDexPath(dexPath), optimizedDirectory, suppressedExceptions, definingContext, isTrusted);

        this.nativeLibraryDirectories = splitPaths(librarySearchPath, false);
        this.systemNativeLibraryDirectories = splitPaths(System.getProperty("java.library.path"), true);
        List<File> allNativeLibraryDirectories = new ArrayList<>(nativeLibraryDirectories);
        allNativeLibraryDirectories.addAll(systemNativeLibraryDirectories);

        this.nativeLibraryPathElements = makePathElements(allNativeLibraryDirectories);
    }
}

public final class ReflectUtils {

    private static Field getField(Class<?> cls, String fieldName) {
        for (Class<?> acls = cls; acls != null; acls = acls.getSuperclass()) {
            try {
                final Field field = acls.getDeclaredField(fieldName);
                setAccessible(field, true);

                return field;
            } catch (final NoSuchFieldException ex) {
            }
        }
        Field match = null;
        for (final Class<?> class1 : cls.getInterfaces()) {
            try {
                match = class1.getField(fieldName);
            } catch (final NoSuchFieldException ex) {
            }
        }
        return match;
    }

    public static Object readField(Object target, String fieldName) throws Exception {
        return readField(target.getClass(), target, fieldName);
    }

    private static Object readField(Class<?> c, Object target, String fieldName) throws Exception {
        Field f = getField(c, fieldName);

        return readField(f, target);
    }

    private static Object readField(final Field field, final Object target) throws Exception {
        return field.get(target);
    }

    public static void writeField(Object target, String fName, Object value) throws Exception {
        writeField(target.getClass(), target, fName, value);
    }

    private static void writeField(Class<?> c, Object object, String fName, Object value) throws Exception {
        Field f = getField(c, fName);
        writeField(f, object, value);
    }

    private static void writeField(final Field field, final Object target, final Object value) throws Exception {
        field.set(target, value);
    }

    private static void setAccessible(AccessibleObject ao, boolean value) {
        if (ao.isAccessible() != value) {
            ao.setAccessible(value);
        }
    }

    public static Object combineArray(Object arrayLhs, Object arrayRhs) throws Exception {
        Class<?> clazz = arrayLhs.getClass().getComponentType();
        int i = Array.getLength(arrayLhs);
        int j = Array.getLength(arrayRhs);
        int k = i + j;
        Object result = Array.newInstance(clazz, k);
        System.arraycopy(arrayLhs, 0, result, 0, i);
        System.arraycopy(arrayRhs, 0, result, i, j);
        return result;
    }
}

public class FixDexUtil {

    private static final String DEX_SUFFIX = ".dex";
    private static final String APK_SUFFIX = ".apk";

    private static final String PATCH_DIR = "patch";

    private static HashSet<File> sLoadedDex = new HashSet<>();

    public static boolean needFix(@NonNull Context context) {
        sLoadedDex.clear();

        // /data/data/包名/files/patch
        File fileDir = new File(context.getFilesDir(), PATCH_DIR);
        if (!fileDir.exists()) {
            fileDir.mkdirs();
            return false;
        }
        if (!fileDir.isDirectory()) {
            fileDir.delete();
            fileDir.mkdirs();
            return false;
        }

        boolean canFix = false;
        File[] listFiles = fileDir.listFiles();
        if (listFiles == null) {
            return false;
        }
        for (File file : listFiles) {
            if ((file.getName().endsWith(DEX_SUFFIX)
                    || file.getName().endsWith(APK_SUFFIX))) {
                sLoadedDex.add(file);
                canFix = true;
            }
        }
        return canFix;
    }

    public static void fix(Application application) {
        doFix(application, sLoadedDex);
    }

    private static void doFix(Application application, HashSet<File> loadedDex) {
        try {
            Context base = application.getBaseContext();
            if (base == null) {
                Log.d("LLL", "base == null");
                return;
            }

            Object packageInfo = ReflectUtils.readField(base, "mPackageInfo");
            if (packageInfo == null) {
                Log.d("LLL", "packageInfo == null");
                return;
            }

            // 这里也可以由context.getClassLoader()得到PathClassLoader
            // 而loadedDex.getClass().getClassLoader()返回的是BootCLassLoader
            ClassLoader classLoader = (ClassLoader) ReflectUtils.readField(packageInfo, "mClassLoader");
            if (!(classLoader instanceof PathClassLoader)) {
                Log.d("LLL", "classLoader == null");
                return;
            }

            PathClassLoader pathLoader = (PathClassLoader) classLoader;

            for (File dex : loadedDex) {
                DexClassLoader dexLoader = new DexClassLoader(dex.getAbsolutePath(), null, null, pathLoader);

                // 3.开始合并: 合并的目标是Element[], 重新赋值它的值即可

                //3.1 准备好pathList的引用
                Object dexPathList = ReflectUtils.readField(dexLoader, "pathList");
                Object pathPathList = ReflectUtils.readField(pathLoader, "pathList");
                //3.2 从pathList中反射出element集合
                Object leftDexElements = ReflectUtils.readField(dexPathList, "dexElements");
                Object rightDexElements = ReflectUtils.readField(pathPathList, "dexElements");
                //3.3 合并两个dex数组
                Object dexElements = ReflectUtils.combineArray(leftDexElements, rightDexElements);

                Object pathList = ReflectUtils.readField(pathLoader, "pathList");
                ReflectUtils.writeField(pathList, "dexElements", dexElements);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

public class PatchApplication extends Application {

    @Override
    protected void attachBaseContext(Context base) {
        super.attachBaseContext(base);
        if (FixDexUtil.needFix(this)) {
            Log.d("LLL", "begin to fix");
            FixDexUtil.fix(this);
        }
    }
}

// 修复前
public class Util {
    private static final String TAG = "LLL";

    public static void test() {
        Log.d(TAG, "first publish.");
    }
}

// 修复后
public class Util {
    private static final String TAG = "LLL";

    public static void test() {
        Log.d(TAG, "first publish.");
        Log.d(TAG, "patch publish.");
    }
}

@Override
public final IBinder onBind(Intent intent) {
    return new IAccessibilityServiceClientWrapper(this, getMainLooper(), new Callbacks() {
        @Override
        public void onServiceConnected() {
            AccessibilityService.this.dispatchServiceConnected();
        }

        @Override
        public void onInterrupt() {
            AccessibilityService.this.onInterrupt();
        }

        @Override
        public void onAccessibilityEvent(AccessibilityEvent event) {
            AccessibilityService.this.onAccessibilityEvent(event);
        }

        @Override
        public void init(int connectionId, IBinder windowToken) {
            mConnectionId = connectionId;
            mWindowToken = windowToken;

            // The client may have already obtained the window manager, so
            // update the default token on whatever manager we gave them.
            final WindowManagerImpl wm = (WindowManagerImpl) getSystemService(WINDOW_SERVICE);
            wm.setDefaultToken(windowToken);
        }

        // ...
    });
}

public interface Callbacks {
    void onAccessibilityEvent(AccessibilityEvent event);
    void onInterrupt();
    void onServiceConnected();
    void init(int connectionId, IBinder windowToken);
    boolean onGesture(int gestureId);
    boolean onKeyEvent(KeyEvent event);
    void onMagnificationChanged(@NonNull Region region,
            float scale, float centerX, float centerY);
    void onSoftKeyboardShowModeChanged(int showMode);
    void onPerformGestureResult(int sequence, boolean completedSuccessfully);
    void onFingerprintCapturingGesturesChanged(boolean active);
    void onFingerprintGesture(int gesture);
    void onAccessibilityButtonClicked();
    void onAccessibilityButtonAvailabilityChanged(boolean available);
}

oneway interface IAccessibilityServiceClient {

    void init(in IAccessibilityServiceConnection connection, int connectionId, IBinder windowToken);
    void onAccessibilityEvent(in AccessibilityEvent event, in boolean serviceWantsEvent);
    void onInterrupt();
    void onGesture(int gesture);
    void clearAccessibilityCache();
    void onKeyEvent(in KeyEvent event, int sequence);
    void onMagnificationChanged(int displayId, in Region region, float scale, float centerX, float centerY);
    void onSoftKeyboardShowModeChanged(int showMode);
    void onPerformGestureResult(int sequence, boolean completedSuccessfully);
    void onFingerprintCapturingGesturesChanged(boolean capturing);
    void onFingerprintGesture(int gesture);
    void onAccessibilityButtonClicked();
    void onAccessibilityButtonAvailabilityChanged(boolean available);
}

// IAccessibilityServiceClientWrapper
public static class IAccessibilityServiceClientWrapper extends IAccessibilityServiceClient.Stub implements HandlerCaller.Callback {
    public IAccessibilityServiceClientWrapper(Context context, Looper looper,
            Callbacks callback) {
        mCallback = callback;
        mCaller = new HandlerCaller(context, looper, this, true /*asyncHandler*/);
    }

    public void init(IAccessibilityServiceConnection connection, int connectionId,
            IBinder windowToken) {
        Message message = mCaller.obtainMessageIOO(DO_INIT, connectionId,
                connection, windowToken);
        mCaller.sendMessage(message);
    }

    public void onInterrupt() {
        Message message = mCaller.obtainMessage(DO_ON_INTERRUPT);
        mCaller.sendMessage(message);
    }

    public void onAccessibilityEvent(AccessibilityEvent event, boolean serviceWantsEvent) {
        Message message = mCaller.obtainMessageBO(
                DO_ON_ACCESSIBILITY_EVENT, serviceWantsEvent, event);
        mCaller.sendMessage(message);
    }

    @Override
    public void executeMessage(Message message) {
        switch (message.what) {
            case DO_ON_ACCESSIBILITY_EVENT: {
                AccessibilityEvent event = (AccessibilityEvent) message.obj;
                boolean serviceWantsEvent = message.arg1 != 0;
                if (event != null) {
                    // Send the event to AccessibilityCache via AccessibilityInteractionClient
                    AccessibilityInteractionClient.getInstance().onAccessibilityEvent(event);
                    if (serviceWantsEvent
                            && (mConnectionId != AccessibilityInteractionClient.NO_ID)) {
                        // Send the event to AccessibilityService
                        mCallback.onAccessibilityEvent(event);
                    }
                    // Make sure the event is recycled.
                    try {
                        event.recycle();
                    } catch (IllegalStateException ise) {
                        /* ignore - best effort */
                    }
                }
            } return;

            case DO_ON_INTERRUPT: {
                if (mConnectionId != AccessibilityInteractionClient.NO_ID) {
                    mCallback.onInterrupt();
                }
            } return;

            case DO_INIT: {
                mConnectionId = message.arg1;
                SomeArgs args = (SomeArgs) message.obj;
                IAccessibilityServiceConnection connection =
                        (IAccessibilityServiceConnection) args.arg1;
                IBinder windowToken = (IBinder) args.arg2;
                args.recycle();
                if (connection != null) {
                    AccessibilityInteractionClient.getInstance().addConnection(mConnectionId,
                            connection);
                    mCallback.init(mConnectionId, windowToken);
                    mCallback.onServiceConnected();
                } else {
                    AccessibilityInteractionClient.getInstance().removeConnection(
                            mConnectionId);
                    mConnectionId = AccessibilityInteractionClient.NO_ID;
                    AccessibilityInteractionClient.getInstance().clearCache();
                    mCallback.init(AccessibilityInteractionClient.NO_ID, null);
                }
            } return;

            // ...
        }
    }
}

// HandlerCaller.Callback
public interface Callback {
    public void executeMessage(Message msg);
}

public class AccessibilityManagerService extends IAccessibilityManager.Stub {
    @Override
    public List<AccessibilityServiceInfo> getInstalledAccessibilityServiceList(int userId) {
        // ...
    }
}

/**
 * 取得正在监控目标包名的AccessibilityService
 */
private List<AccessibilityServiceInfo> getInstalledAccessibilityServiceList(String targetPackage) {
    List<AccessibilityServiceInfo> result = new ArrayList<>();
    AccessibilityManager accessibilityManager = (AccessibilityManager) getApplicationContext().getSystemService(Context.ACCESSIBILITY_SERVICE);
    if (accessibilityManager == null) {
        return result;
    }
    List<AccessibilityServiceInfo> infoList = accessibilityManager.getInstalledAccessibilityServiceList();
    if (infoList == null || infoList.size() == 0) {
        return result;
    }
    for (AccessibilityServiceInfo info : infoList) {
        if (info.packageNames == null) {
            result.add(info);
        } else {
            for (String packageName : info.packageNames) {
                if (targetPackage.equals(packageName)) {
                    result.add(info);
                }
            }
        }
    }
    return result;
}

textView.sendAccessibilityEvent(AccessibilityEvent.TYPE_NOTIFICATION_STATE_CHANGED);

public class DefensiveTextView extends android.support.v7.widget.AppCompatTextView {

    @Override
    public void findViewsWithText(ArrayList<View> outViews, CharSequence searched, int flags) {
        outViews.remove(this);
    }
}

public class AccessibilityHelper {

    private static boolean hasAccessibility(Context context, Class serviceClass) {
        if (context == null || serviceClass == null) {
            return false;
        }
        int ok = 0;
        try {
            ok = Settings.Secure.getInt(context.getContentResolver(), Settings.Secure.ACCESSIBILITY_ENABLED);
        } catch (Settings.SettingNotFoundException e) {
        }

        TextUtils.SimpleStringSplitter ms = new TextUtils.SimpleStringSplitter(':');
        if (ok == 1) {
            String settingValue = Settings.Secure.getString(context.getContentResolver(), Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES);
            if (settingValue != null) {
                ms.setString(settingValue);
                while (ms.hasNext()) {
                    String accessibilityService = ms.next();
                    if (accessibilityService.contains(serviceClass.getSimpleName())) {
                        return true;
                    }
                }
            }
        }
        return false;
    }

    public static void openAccessibility(Context context, Class service) {
        if (context == null || service == null) {
            return;
        }

        if (hasAccessibility(context, service)) {
            return;
        }
        Intent intent = new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS);
        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
        context.startActivity(intent);
    }

}

public class CallAccessibilityService extends AccessibilityService {

    private static final String TAG = "CallAccessibility";

    @Override
    public void onAccessibilityEvent(AccessibilityEvent event) {
        Log.d(TAG, "onAccessibilityEvent: " + event.toString());
        if (event.getEventType() == AccessibilityEvent.TYPE_VIEW_CLICKED) {
            AccessibilityNodeInfo nodeInfo = getRootInActiveWindow();
            if (nodeInfo != null) {
                List<AccessibilityNodeInfo> infos = nodeInfo.findAccessibilityNodeInfosByText("选择来电秀视频");
                for (AccessibilityNodeInfo info : infos) {
                    info.performAction(AccessibilityNodeInfo.ACTION_CLICK);
                }

            }
        }
    }

    @Override
    public void onInterrupt() {
        Log.d(TAG, "onInterrupt");
    }
}