By reflecting the screenshot

public class EncoderFeeder {
     public static Bitmap screenshot() {
           String surfaceClassName;
           if (VERSION.SDK_INT <= 17) {
                surfaceClassName = "android.view.Surface";

           } else {
                surfaceClassName = "android.view.SurfaceControl"; } Class<? > classname; Bitmap bm = null; try { classname = Class.forName(surfaceClassName); Method method = classname.getDeclaredMethod("screenshot", new Class[] { int.class, int.class }); Bm = (Bitmap) method.invoke(null, new Object[] {integer.valueof (device.x),// resolution Integer.valueof (device.y)}); } catch (Exception e) { e.printStackTrace(); }returnbm; }}Copy the code

. This is our reflection calls SurfaceControl screenshot () and Surface. The screenshot (), they are all the system to provide the screenshots of the method, but this method is @ hide, can’t call, we are using reflection method calls, But our normal user calls it from code reflection, and the method returns NULL because the SurfaceControl class is also hidden by Google, The adb shell has access to screencap or screenshots from the Screen. This means that the ADB shell can call the Surface and SurfaceControl classes. How to call these two classes from the ADB shell, the protagonist is app_process,app_process can run a normal Java class directly. To summarize:

1. Start an app_process program with the ADB shell command

export CLASSPATH=/data/app/com.test.syscreen-1.apk","exec app_process /system/bin com.test.syscreen.Main '@ @'
Copy the code

2. Use the app_process program to start a Java program that accesses the Surface and SurfaceControl classes to bypass Root and reflect screenshots. For a closer look at why the App_Precess program has something the average user can’t access, check out app_process, which is the Zygote process, The Zygote process creates an instance of the Dalvik virtual machine when Zygote is started. When a new application process is created, Zygote copies the virtual machine instance into it. And Zygote loads the Java runtime when it starts, so a new application is created with Zygote that not only has a virtual machine copied from Zygote, but also shares the Java runtime with Zygote.