public class ReCompileCode {

    public static void main(String[] args) {
        try {
            if (args == null && args.length == 0) {
                System.out.println("请传递dex目录文件夹");
                return;
            }
            File dexDirFile = new File(args[0]);
            if (!dexDirFile.exists()) {
                System.out.println("dex目录文件夹不存在");
                return;
            }
            File distDirFile = new File(dexDirFile, "dist");
            if (!distDirFile.exists()) {
                distDirFile.mkdirs();
            }
            File[] dexFileArr = dexDirFile.listFiles(new FileFilter() {
                @Override
                public boolean accept(File file) {
                    return file.getName().endsWith(".dex") || file.getName().endsWith(".apk");
                }
            });
            Process process = null;
            String s = null;
            System.out.println("......开始解析......");
            for (File dexFile : dexFileArr) {
                String cmd = "jadx -d " + distDirFile.getAbsolutePath() + " " + dexFile.getAbsolutePath();
                process = Runtime.getRuntime().exec(cmd);
                BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(process.getInputStream()));
                while ((s = bufferedReader.readLine()) != null) {
                }
                process.waitFor();
                System.out.println(dexFile.getAbsolutePath() + "...解析完成... code=" + process.exitValue());
            }
            System.out.println("......解析结束......");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

}

public class CheXiaoTongHook extends BaseHook {

    public CheXiaoTongHook() {
        super("com.easypass.carstong", "com.easypass.carstong.protocol.bean.ResultBean");
    }

    @Override
    public void handleLoadPackage(Class clazz) throws Exception {
        XposedHelpers.findAndHookMethod(clazz, "getData", new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                Object response = param.getResult();
                if (response != null) {
                    JSONObject jsonObject = new JSONObject();
                    jsonObject.put("packageName", packageName);
                    jsonObject.put("activityName", getCurrentActivityName());
                    jsonObject.put("responseData", response);
                    String content = jsonObject.toString();
                    Logger.d(TAG, response + "\n\n");
                    FileLogger.log(content);
                }
            }
        });
    }

}

   //替换调默认的classloader
   @Override
    protected void attachBaseContext(Context base) {
        super.attachBaseContext(base);
        try {
            File odex = this.getDir("payload_odex", MODE_PRIVATE);
            File libs = this.getDir("payload_lib", MODE_PRIVATE);
            odexPath = odex.getAbsolutePath();
            libPath = libs.getAbsolutePath();
            apkFileName = odex.getAbsolutePath() + "/source.apk";

            File dexFile = new File(apkFileName);
            if (!dexFile.exists()) {
                dexFile.createNewFile();
                byte[] dexdata = this.readDexFileFromApk();
                this.splitPayLoadFromDex(dexdata);
            }
            ....
            DexClassLoader dLoader = new DexClassLoader(apkFileName, odexPath,
                    libPath, base.getClassLoader());

            RefInvoke.setFieldOjbect("android.app.LoadedApk", "mClassLoader", loadApk, dLoader);

        } catch (Exception e) {
            e.printStackTrace();
        }
    }

   //重建application，保证源应用中的自定义application生命周期能够正常被调用
    @SuppressLint("MissingSuperCall")
    @Override
    public void onCreate() {
        // 填写源应用的application全量类路径
        String appClassName = "com.min.source.App";

        Object currentActivityThread = RefInvoke.invokeStaticMethod(
                "android.app.ActivityThread", "currentActivityThread",
                new Class[]{}, new Object[]{});
        Object mBoundApplication = RefInvoke.getFieldOjbect(
                "android.app.ActivityThread", currentActivityThread,
                "mBoundApplication");
        ....
        Application app = (Application) RefInvoke.invokeMethod(
                "android.app.LoadedApk", "makeApplication", loadedApkInfo,
                new Class[]{boolean.class, Instrumentation.class},
                new Object[]{false, null});// 执行
        RefInvoke.setFieldOjbect("android.app.ActivityThread",
                "mInitialApplication", currentActivityThread, app);
       ....
        app.onCreate();
    }

    //从壳应用dex文件中抽取出
    private void splitPayLoadFromDex(byte[] data) throws IOException {
        byte[] apkdata = data;
        int ablen = apkdata.length;
        byte[] dexlen = new byte[4];
        System.arraycopy(apkdata, ablen - 4, dexlen, 0, 4);
        ByteArrayInputStream bais = new ByteArrayInputStream(dexlen);
        DataInputStream in = new DataInputStream(bais);
        int readInt = in.readInt();
        System.out.println(Integer.toHexString(readInt));
        byte[] newdex = new byte[readInt];
        System.arraycopy(apkdata, ablen - 4 - readInt, newdex, 0, readInt);
        newdex = decrypt(newdex);
        File file = new File(apkFileName);
        try {
            FileOutputStream localFileOutputStream = new FileOutputStream(file);
            localFileOutputStream.write(newdex);
            localFileOutputStream.close();

        } catch (IOException localIOException) {
            throw new RuntimeException(localIOException);
        }
    }

    //从壳应用安装的apk中获取其classes.dex文件
    private byte[] readDexFileFromApk() throws IOException {
        ByteArrayOutputStream dexByteArrayOutputStream = new ByteArrayOutputStream();
        ZipInputStream localZipInputStream = new ZipInputStream(
                new BufferedInputStream(new FileInputStream(
                        this.getApplicationInfo().sourceDir)));
        while (true) {
            ZipEntry localZipEntry = localZipInputStream.getNextEntry();
            if (localZipEntry == null) {
                localZipInputStream.close();
                break;
            }
            if (localZipEntry.getName().equals("classes.dex")) {
                byte[] arrayOfByte = new byte[1024];
                while (true) {
                    int i = localZipInputStream.read(arrayOfByte);
                    if (i == -1)
                        break;
                    dexByteArrayOutputStream.write(arrayOfByte, 0, i);
                }
            }
            localZipInputStream.closeEntry();
        }
        localZipInputStream.close();
        return dexByteArrayOutputStream.toByteArray();
    }

File apkFile = new File(sourceApkPath);
File shellDexFile = new File(shellDexPath);
...
byte[] apkByteArray = encrypt(readFileBytes(apkFile));
byte[] shellDexArray = readFileBytes(shellDexFile);
int apkByteArrayLen = apkByteArray.length;
int shellDexLen = shellDexArray.length;
int totalLen = apkByteArrayLen + shellDexLen + 4;
byte[] newDex = new byte[totalLen];
// 添加壳应用数据
System.arraycopy(shellDexArray, 0, newDex, 0, shellDexLen);
// 添加源应用数据
System.arraycopy(apkByteArray, 0, newDex, shellDexLen, apkByteArrayLen);
// 添加源应用数据长度
System.arraycopy(intToByte(apkByteArrayLen), 0, newDex, totalLen - 4, 4);
// 修改DEX file size文件头
fixFileSizeHeader(newDex);
// 修改DEX SHA1 文件头
fixSHA1Header(newDex);
// 修改DEX CheckSum文件头
fixCheckSumHeader(newDex);
// 把内容写到 newDexFile
File file = new File(newDexFile);
if (!file.exists()) {
  file.createNewFile();
}
FileOutputStream localFileOutputStream = new FileOutputStream(newDexFile);
localFileOutputStream.write(newDex);
localFileOutputStream.flush();
localFileOutputStream.close();