static void LinkCode(SirtRef<mirror::ArtMethod>& method, const OatFile::OatClass* oat_class, uint32_t method_index)
    SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {

// Method shouldn't have already been linked.
DCHECK(method->GetEntryPointFromCompiledCode() == NULL);
// Every kind of method should at least get an invoke stub from the oat_method.
// non-abstract methods also get their code pointers.
const OatFile::OatMethod oat_method = oat_class->GetOatMethod(method_index);

// ÕâÀïĬÈÏ»á°Ñmethod::entry_point_from_compiled_code_ÉèÖÃoatmethodµÄcode
oat_method.LinkMethod(method.get());

// Install entry point from interpreter.
Runtime* runtime = Runtime::Current();
bool enter_interpreter = NeedsInterpreter(method.get(),

method->GetEntryPointFromCompiledCode()); //ÅжϷ½·¨ÊÇ·ñÐèÒª½âÎöÖ´ÐÐ

// ÉèÖýâÎöÖ´ÐеÄÈë¿Úµã
if (enter_interpreter) {
method->SetEntryPointFromInterpreter(interpreter::artInterpreterToInterpreterBridge);
} else {
method->SetEntryPointFromInterpreter(artInterpreterToCompiledCodeBridge);
}

// ÏÂÃæÊÇÉèÖñ¾µØÖ¸ÁîÖ´ÐеÄÈë¿Úµã
if (method->IsAbstract()) {
method->SetEntryPointFromCompiledCode(GetCompiledCodeToInterpreterBridge());
return;
}

// ÕâÀï±È½ÏÄÑÀí½â£¬Èç¹ûÊǾ²Ì¬·½·¨£¬µ«²»ÊÇclinit£¬µ«ÐèÒª°Ñentry_point_from_compiled_code_ÉèÖÃΪGetResolutionTrampolineµÄ·µ»ØÖµ
if (method->IsStatic() && !method->IsConstructor()) {
// For static methods excluding the class initializer, install the trampoline.
// It will be replaced by the proper entry point by ClassLinker::FixupStaticTrampolines
// after initializing class (see ClassLinker::InitializeClass method).
method->SetEntryPointFromCompiledCode(GetResolutionTrampoline(runtime->GetClassLinker()));
} else if (enter_interpreter) {
// Set entry point from compiled code if there's no code or in interpreter only mode.
method->SetEntryPointFromCompiledCode(GetCompiledCodeToInterpreterBridge());
}

if (method->IsNative()) {
// Unregistering restores the dlsym lookup stub.
method->UnregisterNative(Thread::Current());
}

// Allow instrumentation its chance to hijack code.
runtime->GetInstrumentation()->UpdateMethodsCode(method.get(),

method->GetEntryPointFromCompiledCode());
}

Interpreter2Interpreter¶ÔÓ¦artInterpreterToInterpreterBridge(art/runtime/interpreter/interpreter.cc);
Interpreter2CompledCode¶ÔÓ¦
artInterpreterToCompiledCodeBridge(/art/runtime/entrypoints/interpreter/interpreter_entrypoints.cc);
CompliedCode2Interpreter¶ÔÓ¦art_quick_to_interpreter_bridge(art/runtime/arch/arm/quick_entrypoints_arm.S);
CompliedCode2ResolutionTrampoline¶ÔÓ¦art_quick_resolution_trampoline(art/runtime/arch/arm/quick_entrypoints_arm.S);
CompliedCode2CompliedCodeÕâ¸öÈë¿ÚÊÇÖ±½ÓÖ¸ÏòoatÖеÄÖ¸ÁÏêϸ¿É¼ûOatMethod::LinkMethod;

 /*
 * Quick invocation stub.
 * On entry:
 *   r0 = method pointer
 *   r1 = argument array or NULL for no argument methods
 *   r2 = size of argument array in bytes
 *   r3 = (managed) thread pointer
 *   [sp] = JValue* result
 *   [sp + 4] = result type char
 */
ENTRY art_quick_invoke_stub
push   {r0, r4, r5, r9, r11, lr}       @ spill regs
.save  {r0, r4, r5, r9, r11, lr}
.pad #24
.cfi_adjust_cfa_offset 24
.cfi_rel_offset r0, 0
.cfi_rel_offset r4, 4
.cfi_rel_offset r5, 8
.cfi_rel_offset r9, 12
.cfi_rel_offset r11, 16
.cfi_rel_offset lr, 20
mov    r11, sp                         @ save the stack pointer
.cfi_def_cfa_register r11
mov    r9, r3                          @ move managed thread pointer into r9
mov    r4, #SUSPEND_CHECK_INTERVAL     @ reset r4 to suspend check interval
add    r5, r2, #16                     @ create space for method pointer in frame
and    r5, #0xFFFFFFF0                 @ align frame size to 16 bytes
sub    sp, r5                          @ reserve stack space for argument array
add    r0, sp, #4                      @ pass stack pointer + method ptr as dest for memcpy
bl     memcpy                          @ memcpy (dest, src, bytes)
ldr    r0, [r11]                       @ restore method*
ldr    r1, [sp, #4]                    @ copy arg value for r1
ldr    r2, [sp, #8]                    @ copy arg value for r2
ldr    r3, [sp, #12]                   @ copy arg value for r3
mov    ip, #0                          @ set ip to 0
str    ip, [sp]                        @ store NULL for method* at bottom of frame
ldr    ip, [r0, #METHOD_CODE_OFFSET]   @ get pointer to the code
blx    ip                              @ call the method
mov    sp, r11                         @ restore the stack pointer
ldr    ip, [sp, #24]                   @ load the result pointer
strd   r0, [ip]                        @ store r0/r1 into result pointer
pop    {r0, r4, r5, r9, r11, lr}       @ restore spill regs
.cfi_adjust_cfa_offset -24
bx     lr
END art_quick_invoke_stub

 -(low)
   | caller(Method *)   | <- sp 
   | arg1               | <- r1
   | arg2               | <- r2
   | arg3               | <- r3
   | ...                | 
   | argN               |
   | callee(Method *)   | <- r0
   +(high)

void DexCache::Init(const DexFile* dex_file,
                    String* location,
                    ObjectArray<String>* strings,
                    ObjectArray<Class>* resolved_types,
                    ObjectArray<ArtMethod>* resolved_methods,
                    ObjectArray<ArtField>* resolved_fields,
                    ObjectArray<StaticStorageBase>* initialized_static_storage) {
  //...
  //...
  Runtime* runtime = Runtime::Current();
  if (runtime->HasResolutionMethod()) {
    // Initialize the resolve methods array to contain trampolines for resolution.
    ArtMethod* trampoline = runtime->GetResolutionMethod();
    size_t length = resolved_methods->GetLength();
    for (size_t i = 0; i < length; i++) {
      resolved_methods->SetWithoutChecks(i, trampoline);
    }
  }
}

mirror::ArtMethod* Runtime::CreateResolutionMethod() {
  mirror::Class* method_class = mirror::ArtMethod::GetJavaLangReflectArtMethod();
  Thread* self = Thread::Current();
  SirtRef<mirror::ArtMethod>
      method(self, down_cast<mirror::ArtMethod*>(method_class->AllocObject(self)));
  method->SetDeclaringClass(method_class);
  // TODO: use a special method for resolution method saves
  method->SetDexMethodIndex(DexFile::kDexNoIndex);
  // When compiling, the code pointer will get set later when the image is loaded.
  Runtime* r = Runtime::Current();
  ClassLinker* cl = r->GetClassLinker();
  method->SetEntryPointFromCompiledCode(r->IsCompiler() ? NULL : GetResolutionTrampoline(cl));
  return method.get();
}

  .extern artQuickResolutionTrampoline
ENTRY art_quick_resolution_trampoline
    SETUP_REF_AND_ARGS_CALLEE_SAVE_FRAME
    mov     r2, r9                 @ pass Thread::Current
    mov     r3, sp                 @ pass SP
    blx     artQuickResolutionTrampoline  @ (Method* called, receiver, Thread*, SP)
    cbz     r0, 1f                 @ is code pointer null? goto exception
    mov     r12, r0
    ldr  r0, [sp, #0]              @ load resolved method in r0
    ldr  r1, [sp, #8]              @ restore non-callee save r1
    ldrd r2, [sp, #12]             @ restore non-callee saves r2-r3
    ldr  lr, [sp, #44]             @ restore lr
    add  sp, #48                   @ rewind sp
    .cfi_adjust_cfa_offset -48
    bx      r12                    @ tail-call into actual code
1:
    RESTORE_REF_AND_ARGS_CALLEE_SAVE_FRAME
    DELIVER_PENDING_EXCEPTION
END art_quick_resolution_trampoline

// Lazily resolve a method for quick. Called by stub code.
extern "C" const void* artQuickResolutionTrampoline(mirror::ArtMethod* called,
                                                    mirror::Object* receiver,
                                                    Thread* thread, mirror::ArtMethod** sp)
    SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
  FinishCalleeSaveFrameSetup(thread, sp, Runtime::kRefsAndArgs);
  // Start new JNI local reference state
  JNIEnvExt* env = thread->GetJniEnv();
  ScopedObjectAccessUnchecked soa(env);
  ScopedJniEnvLocalRefState env_state(env);
  const char* old_cause = thread->StartAssertNoThreadSuspension("Quick method resolution set up");

// Compute details about the called method (avoid GCs)
ClassLinker* linker = Runtime::Current()->GetClassLinker();
mirror::ArtMethod* caller = QuickArgumentVisitor::GetCallingMethod(sp);
InvokeType invoke_type;
const DexFile* dex_file;
uint32_t dex_method_idx;
if (called->IsRuntimeMethod()) {
//...
//...
} else {
invoke_type = kStatic;
dex_file = &MethodHelper(called).GetDexFile();
dex_method_idx = called->GetDexMethodIndex();
}

//...

// Resolve method filling in dex cache.
if (called->IsRuntimeMethod()) {
called = linker->ResolveMethod(dex_method_idx, caller, invoke_type);
}

const void* code = NULL;
if (LIKELY(!thread->IsExceptionPending())) {
//...

linker->EnsureInitialized(called_class, true, true);

//...
}
// ...
return code;
}

inline bool ArtMethod::IsRuntimeMethod() const {
  return GetDexMethodIndex() == DexFile::kDexNoIndex;
}

mirror::ArtMethod* ClassLinker::ResolveMethod(const DexFile& dex_file,
                                                   uint32_t method_idx,
                                                   mirror::DexCache* dex_cache,
                                                   mirror::ClassLoader* class_loader,
                                                   const mirror::ArtMethod* referrer,
                                                   InvokeType type) {
  DCHECK(dex_cache != NULL);
  // Check for hit in the dex cache.
  mirror::ArtMethod* resolved = dex_cache->GetResolvedMethod(method_idx);
  if (resolved != NULL) {
    return resolved;
  }
  // Fail, get the declaring class.
  const DexFile::MethodId& method_id = dex_file.GetMethodId(method_idx);
  mirror::Class* klass = ResolveType(dex_file, method_id.class_idx_, dex_cache, class_loader);

if (klass == NULL) {
DCHECK(Thread::Current()->IsExceptionPending());
return NULL;
}

// Scan using method_idx, this saves string compares but will only hit for matching dex
// caches/files.
switch (type) {
case kDirect: // Fall-through.
case kStatic:
resolved = klass->FindDirectMethod(dex_cache, method_idx);
break;
case kInterface:
resolved = klass->FindInterfaceMethod(dex_cache, method_idx);
DCHECK(resolved == NULL || resolved->GetDeclaringClass()->IsInterface());
break;
case kSuper: // Fall-through.
case kVirtual:
resolved = klass->FindVirtualMethod(dex_cache, method_idx);
break;
default:
LOG(FATAL) << "Unreachable - invocation type: " << type;
}

if (resolved == NULL) {
// Search by name, which works across dex files.
const char* name = dex_file.StringDataByIdx(method_id.name_idx_);
std::string signature(dex_file.CreateMethodSignature(method_id.proto_idx_, NULL));
switch (type) {
case kDirect: // Fall-through.
case kStatic:
resolved = klass->FindDirectMethod(name, signature);
break;
case kInterface:
resolved = klass->FindInterfaceMethod(name, signature);
DCHECK(resolved == NULL || resolved->GetDeclaringClass()->IsInterface());
break;
case kSuper: // Fall-through.
case kVirtual:
resolved = klass->FindVirtualMethod(name, signature);
break;
}
}

if (resolved != NULL) {
// Be a good citizen and update the dex cache to speed subsequent calls.
dex_cache->SetResolvedMethod(method_idx, resolved);
return resolved;
} else {
// ...
}
}

µ÷ÓÃResolutionMethodµÄentrypoint£¬½øÈëart_quick_resolution_trampoline£»
art_quick_resolution_trampolineÌøתµ½artQuickResolutionTrampoline£»
artQuickResolutionTrampolineµ÷ÓÃClassLinker::ResolveMethod½âÎöÀà·½·¨£»
ClassLinker::ResolveMethodµ÷ÓÃClassLinkder::ResolveType½âÎöÀ࣬ÔÙ´Ó½âÎöºÃµÄÀàÑ°ÕÒÕæÕýµÄ·½·¨£»
µ÷ÓÃDexCache::SetResolvedMethod£¬ÓÃÕæÕýµÄ·½·¨¸²¸Çµô¡°ÌæÉí¡±·½·¨£»
µ÷ÓÃÕæÕý·½·¨µÄentrypoint´úÂ룻

extern int __attribute__ ((visibility ("hidden"))) art_java_method_hook(JNIEnv* env, HookInfo *info) {
    const char* classDesc = info->classDesc;
    const char* methodName = info->methodName;
    const char* methodSig = info->methodSig;
    const bool isStaticMethod = info->isStaticMethod;

// TODO we can find class by special classloader what do just like dvm
jclass claxx = env->FindClass(classDesc);
if(claxx == NULL){
LOGE("[-] %s class not found", classDesc);
return -1;
}

jmethodID methid = isStaticMethod ?
env->GetStaticMethodID(claxx, methodName, methodSig) :
env->GetMethodID(claxx, methodName, methodSig);

if(methid == NULL){
LOGE("[-] %s->%s method not found", classDesc, methodName);
return -1;
}

ArtMethod *artmeth = reinterpret_cast<ArtMethod *>(methid);

if(art_quick_dispatcher != artmeth->GetEntryPointFromCompiledCode()){
uint64_t (*entrypoint)(ArtMethod* method, Object *thiz, u4 *arg1, u4 *arg2);
entrypoint = (uint64_t (*)(ArtMethod*, Object *, u4 *, u4 *))artmeth->GetEntryPointFromCompiledCode();

info->entrypoint = (const void *)entrypoint;
info->nativecode = artmeth->GetNativeMethod();

artmeth->SetEntryPointFromCompiledCode((const void *)art_quick_dispatcher);

// save info to nativecode :)
artmeth->SetNativeMethod((const void *)info);

LOGI("[+] %s->%s was hooked\n", classDesc, methodName);
}else{
LOGW("[*] %s->%s method had been hooked", classDesc, methodName);
}

return 0;
}

/*
 * Art Quick Dispatcher.
 * On entry:
 *   r0 = method pointer
 *   r1 = arg1
 *   r2 = arg2
 *   r3 = arg3
 *   [sp] = method pointer
 *   [sp + 4] = addr of thiz
 *   [sp + 8] = addr of arg1
 *   [sp + 12] = addr of arg2
 *   [sp + 16] = addr of arg3
 * and so on
 */
    .extern artQuickToDispatcher
ENTRY art_quick_dispatcher
    push    {r4, r5, lr}           @ sp - 12
    mov     r0, r0                 @ pass r0 to method
    str     r1, [sp, #(12 + 4)]
    str     r2, [sp, #(12 + 8)]
    str     r3, [sp, #(12 + 12)]
    mov     r1, r9                 @ pass r1 to thread
    add     r2, sp, #(12 + 4)      @ pass r2 to args array
    add     r3, sp, #12            @ pass r3 to old SP
    blx     artQuickToDispatcher   @ (Method* method, Thread*, u4 **, u4 **)
    pop     {r4, r5, pc}           @ return on success, r0 and r1 hold the result
END art_quick_dispatcher

extern "C" uint64_t artQuickToDispatcher(ArtMethod* method, Thread *self, u4 **args, u4 **old_sp){
    HookInfo *info = (HookInfo *)method->GetNativeMethod();
    LOGI("[+] entry ArtHandler %s->%s", info->classDesc, info->methodName);

// If it not is static method, then args[0] was pointing to this
if(!info->isStaticMethod){
Object *thiz = reinterpret_cast<Object *>(args[0]);
if(thiz != NULL){
char *bytes = get_chars_from_utf16(thiz->GetClass()->GetName());
LOGI("[+] thiz class is %s", bytes);
delete bytes;
}
}

const void *entrypoint = info->entrypoint;
method->SetNativeMethod(info->nativecode); //restore nativecode for JNI method
uint64_t res = art_quick_call_entrypoint(method, self, args, old_sp, entrypoint);

JValue* result = (JValue* )&res;
if(result != NULL){
Object *obj = result->l;
char *raw_class_name = get_chars_from_utf16(obj->GetClass()->GetName());

if(strcmp(raw_class_name, "java.lang.String") == 0){
char *raw_string_value = get_chars_from_utf16((String *)obj);
LOGI("result-class %s, result-value \"%s\"", raw_class_name, raw_string_value);
free(raw_string_value);
}else{
LOGI("result-class %s", raw_class_name);
}

free(raw_class_name);
}

// entrypoid may be replaced by trampoline, only once.
// if(method->IsStatic() && !method->IsConstructor()){

entrypoint = method->GetEntryPointFromCompiledCode();
if(entrypoint != (const void *)art_quick_dispatcher){
LOGW("[*] entrypoint was replaced. %s->%s", info->classDesc, info->methodName);

method->SetEntryPointFromCompiledCode((const void *)art_quick_dispatcher);
info->entrypoint = entrypoint;
info->nativecode = method->GetNativeMethod();
}

method->SetNativeMethod((const void *)info);

// }

return res;
}

/*
 *
 * Art Quick Call Entrypoint
 * On entry:
 *  r0 = method pointer
 *  r1 = thread pointer
 *  r2 = args arrays pointer
 *  r3 = old_sp
 *  [sp] = entrypoint
 */
ENTRY art_quick_call_entrypoint
    push    {r4, r5, lr}           @ sp - 12
    sub     sp, #(40 + 20)         @ sp - 40 - 20
    str     r0, [sp, #(40 + 0)]    @ var_40_0 = method_pointer
    str     r1, [sp, #(40 + 4)]    @ var_40_4 = thread_pointer
    str     r2, [sp, #(40 + 8)]    @ var_40_8 = args_array
    str     r3, [sp, #(40 + 12)]   @ var_40_12 = old_sp
    mov     r0, sp
    mov     r1, r3
    ldr     r2, =40
    blx     memcpy                 @ memcpy(dest, src, size_of_byte)
    ldr     r0, [sp, #(40 + 0)]    @ restore method to r0
    ldr     r1, [sp, #(40 + 4)]
    mov     r9, r1                 @ restore thread to r9
    ldr     r5, [sp, #(40 + 8)]    @ pass r5 to args_array
    ldr     r1, [r5]               @ restore arg1
    ldr     r2, [r5, #4]           @ restore arg2
    ldr     r3, [r5, #8]           @ restore arg3
    ldr     r5, [sp, #(40 + 20 + 12)] @ pass ip to entrypoint
    blx     r5
    add     sp, #(40 + 20)
    pop     {r4, r5, pc}           @ return on success, r0 and r1 hold the result
END art_quick_call_entrypoint