public int add(){
    int a = 10;
    int b = 20;
    return a + b;
}

dx --dex --verbose --dump-to=dex_method.txt --dump-method=Method.add --verbose-dump Method.class 

Method.add:()I:
regs: 0002; ins: 0001; outs: 0000
 
  0000: const/16 v0, #int 30 // #001e
  0002: return v0
  0003: code-address
  debug info
    line_start: 4
    parameters_size: 0000
    0000: prologue end
    0000: line 4
    0000: line 6
    end sequence
  source file: "Method.java"

public int add();
    descriptor: ()I
    flags: ACC_PUBLIC
    Code:
      stack=2, locals=3, args_size=1
         0: bipush        10
         2: istore_1
         3: bipush        20
         5: istore_2
         6: iload_2
         7: iload_1
         8: iadd
         9: ireturn
      LineNumberTable:
        line 4: 0
        line 5: 3
        line 6: 6

Method.add:()I:
regs: 0002; ins: 0001; outs: 0000
 
  0000: const/16 v0, #int 30 // #001e
  0002: return v0
  0003: code-address
  debug info
    line_start: 4
    parameters_size: 0000
    0000: prologue end
    0000: line 4
    0000: line 6
    end sequence
  source file: "Method.java"

public class Method {

    public int add(){
        int a = 10;
        int b = 20;
        return a + b;
    }
}
//調(diào)用
Method method = new Method();
method.add();

# Android 10.0/art/runtime/art_method.h
protected:
 
  GcRoot<mirror::Class> declaring_class_;
  
  std::atomic<std::uint32_t> access_flags_;

  uint32_t dex_code_item_offset_;

  uint32_t dex_method_index_;
  uint16_t method_index_;

  union {
    uint16_t hotness_count_;
    uint16_t imt_index_;
  };

  // Fake padding field gets inserted here.

  // Must be the last fields in the method.
  struct PtrSizedFields {
    // Depending on the method type, the data is
    //   - native method: pointer to the JNI function registered to this method
    //                    or a function to resolve the JNI function,
    //   - conflict method: ImtConflictTable,
    //   - abstract/interface method: the single-implementation if any,
    //   - proxy method: the original interface method or constructor,
    //   - other methods: the profiling data.
    void* data_;

    // Method dispatch from quick compiled code invokes this pointer which may cause bridging into
    // the interpreter.
    void* entry_point_from_quick_compiled_code_;
  } ptr_sized_fields_;

public class AndFixManager {
    //native熱修復(fù)方法
    public static native void fix(Method wrong, Method right);
}

//fix對應(yīng)的JNI接口
extern "C"
JNIEXPORT void JNICALL
Java_com_tal_andfix_AndFixManager_fix(
        JNIEnv *env,
        jclass clazz,
        jobject wrong,
        jobject right) {

    //獲取ArtMethod
    env->FromReflectedMethod(wrong);

}

try {
    Class<?> clazz = Class.forName("com.tal.demo02.FixDemo");
    Method run = clazz.getDeclaredMethod("run");
    AndFixManager.fix(run,run);
} catch (Exception e) {
    e.printStackTrace();
}

#ifndef DEMO02_ART_METHOD_H
#define DEMO02_ART_METHOD_H
#endif //DEMO02_ART_METHOD_H
#include "stdint.h"
namespace art{
    namespace mirror{
        class ArtMethod final {
        public:
            uint32_t declaring_class_;
            std::atomic<std::uint32_t> access_flags_;
            uint32_t dex_code_item_offset_;
            uint32_t dex_method_index_;
            uint16_t method_index_;
            union {
                uint16_t hotness_count_;
                uint16_t imt_index_;
            };
            struct PtrSizedFields {
                void* data_;

                void* entry_point_from_quick_compiled_code_;
            } ptr_sized_fields_;

        };

    }
}

extern "C"
JNIEXPORT void JNICALL
Java_com_tal_andfix_AndFixManager_fix(
        JNIEnv *env,
        jclass clazz,
        jobject wrong,
        jobject right) {

    //獲取ArtMethod
    ArtMethod *artMethod = reinterpret_cast<ArtMethod *>(env->FromReflectedMethod(wrong));
}

public class FixDemo {

    public void run(){
        throw new IllegalArgumentException();
    }
}

public class FixDemo {
    public void run(){
        Log.e("TAG","已經(jīng)被修復(fù)了");
    }
}

public class AndFixManager {

    public static void bugFix(){
        try {
            Class clazz = Class.forName("com.take.andfix.FixDemo");
            Method wrong = clazz.getDeclaredMethod("run");
            //正確的方法
            Class clazz1 = Class.forName("com.take.andfix.fox.FixDemo");
            Method right = clazz1.getDeclaredMethod("run");
            AndFixManager.fix(wrong, right);
        }catch (Exception e){

        }
    }
    public static native void fix(Method wrong, Method right);
}

extern "C"
JNIEXPORT void JNICALL
Java_com_tal_andfix_AndFixManager_fix(JNIEnv *env, jclass clazz, jobject wrong, jobject right) {

    //獲取ArtMethod
    ArtMethod *wrongMethod = reinterpret_cast<ArtMethod *>(env->FromReflectedMethod(wrong));
    ArtMethod *rightMethod = reinterpret_cast<ArtMethod *>(env->FromReflectedMethod(right));

    //方法替換
    wrongMethod->declaring_class_ = rightMethod->declaring_class_;
    wrongMethod->access_flags_ = rightMethod->access_flags_;
    wrongMethod->dex_code_item_offset_ = rightMethod->dex_code_item_offset_;
    wrongMethod->dex_method_index_ = rightMethod->dex_method_index_;
    wrongMethod->method_index_ = rightMethod->method_index_;
    wrongMethod->ptr_sized_fields_.data_ = rightMethod->ptr_sized_fields_.data_;
    wrongMethod->ptr_sized_fields_.entry_point_from_quick_compiled_code_ = rightMethod->ptr_sized_fields_.entry_point_from_quick_compiled_code_;
}

binding.sampleText.setOnClickListener {
    AndFixManager.bugFix()
    val fixDemo = FixDemo()
    fixDemo.run()
}
打印出的結(jié)果：E/TAG: 已經(jīng)被修復(fù)了

/**
 * 修復(fù)類需要使用這個注解
 */
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface andfix {
    String clazz();
    String method();
}

public class FixDemo {
    @andfix(clazz = "com.tal.andfix.FixDemo",method = "run")
    public void run(){
        Log.e("TAG","已經(jīng)被修復(fù)了");
    }
}

dx --dex --output fix.dex /xxxx/Desktop/dx

/**
* dex文件加載，將dex文件加載到內(nèi)存
* @param context
* @param dexFile
*/
private static void loadFixDex(Context context, File dexFile) {
   try {

       DexFile odex = DexFile.loadDex(
               dexFile.getAbsolutePath(),
               new File(context.getCacheDir(), "odex").getAbsolutePath(),
               Context.MODE_PRIVATE
       );
       Enumeration<String> entries = odex.entries();
       while (entries.hasMoreElements()){
           //全類名
           String clazzName = entries.nextElement();
           //加載類
           Class aClass = odex.loadClass(clazzName, context.getClassLoader());
           //處理類
           if(aClass != null){
               processClass(aClass);
           }
       }


   } catch (Exception e) {
       e.printStackTrace();
   }
}

//方式1
Class.forName("xxxxxxxxxx")
//方式2
odex.loadClass(clazzName, context.getClassLoader())

private static void processClass(Class aClass) {
    //獲取方法上的注解
    Method[] methods = aClass.getMethods();
    for (Method method:methods){
        andfix annotation = method.getAnnotation(andfix.class);
        if(annotation != null){
            //如果存在這個注解，那么就執(zhí)行方法替換
            String clazz = annotation.clazz();
            String method1 = annotation.method();
            //獲取wrong方法
            try {
                Class<?> wrongMethodClass = Class.forName(clazz);
                //這里注意，修復(fù)類的方法，要和被修復(fù)的方法，參數(shù)一致！！！！！
                Method wrongMethod = wrongMethodClass.getDeclaredMethod(method1,method.getParameterTypes());
                //動態(tài)方法替換
                fix(wrongMethod,method);
            } catch (Exception e) {
                e.printStackTrace();
            }

        }
    }
}

binding.sampleText.setOnClickListener {

//            AndFixManager.bugFix()
    AndFixManager.loadFixDex(
        this,
        File(System.getenv("EXTERNAL_STORAGE"), "fix.dex")
    )
    val fixDemo = FixDemo()
    fixDemo.run()
}

No original dex files found for dex location /sdcard/fix.dex

android:requestLegacyExternalStorage="true"