android逆向奇技淫巧二：uiautomatorviewer&method profiling定位x音java層的關鍵代碼和方法

　　做逆向，不論是在windows還是Android，抑或是macos，都必須要面對的一個問題：找到關鍵的代碼。android平台下怎么找到關鍵的代碼了？本文以某國民級短視頻APP為例，分享從UI界面定位到關鍵代碼的鏈路邏輯！

　　1、老規矩，先在模擬器運行這款APP，然后打開ui automator viewer “截屏”（注意：要暫停短視頻播放才行，否則截屏的時候會報錯）！如下：

       

 　　比如我們想找點贊按鈕的執行代碼（至於為什么要找這個按鈕的執行代碼，道上人士都懂的），光標移動到筆芯上，右邊就會顯示出筆芯的imageView，這里能看出其實是一個按鈕控件；先阿敏有resource-id和class類型；接着進入jadx（這種apk上百兆，用jadx容易卡死，需要增加內存，增加的方法見文章末尾的參考1），找到resources.arsc文件，用剛才找到的id字段也就是byb作為關鍵詞，找到點贊筆芯的id: 2131168834

         

　　然后繼續搜索，發現原來是這兩行代碼引用了：

     

　　本想點擊進一步查看java源碼，無奈本機內存只有16G，而jadx已經消耗了9G，還是卡者不動，無法繼續，這里換成android killer繼續逆向分析。把這一串id轉成16進制，然后在android killer里面搜索：

　　

       發現到處都在引用；后續會繼續分享怎么分析這些引用！

　　至於這里為啥用id來檢索，而不是控件的名稱了？我個人理解：大概率是因為控件名稱開發人員隨時都可能更改，所以編譯器自動生成id與之對應。控件名稱隨時可以改，但是id不變，通過這種方式做到松耦合！

　　2、上面使用了這個id的地方還是有很多，挨個去靜態分析還是耗時，怎么能快速找到點贊執行了哪些代碼了？這里有個更快速的方法：method profiling；本質上，method profiling相當於錄屏，結果如下: 因為用戶需要手動點擊筆芯才能點贊，所以肯定會調用onclick方法，這里就能根據onclick作為關鍵詞查詢：

　　      

              只有這兩個地方調用了onclick方法：

 　　　 

 　　    接下來再去jadx或android killer找這兩個方法分析源碼，是不是簡單多了？（用AK搜的時候注意把.改成/）

            

 　　   老規矩，最后整理一下常見的靜態分析方法：

          

 

注意：x音沒登陸時點擊屏幕用的是onClick來監聽的；一旦登陸，用戶點贊用的就是onTouch監聽了，method profiling捕獲到的函數調用如下：

  

　代碼在這：

public boolean onTouchEvent(MotionEvent motionEvent) {
        View.OnTouchListener onTouchListener;
        boolean z = false;
        PatchProxyResult proxy = PatchProxy.proxy(new Object[]{motionEvent}, this, f173585a, false, 254253);
        if (proxy.isSupported) {
            return ((Boolean) proxy.result).booleanValue();
        }
        if (!isEnabled()) {
            return false;
        }
        this.j = true;
        int actionMasked = motionEvent.getActionMasked();
        if (actionMasked != 0) {
            if (actionMasked != 1) {
                if (actionMasked == 2) {
                    this.n = motionEvent.getX();
                    this.o = motionEvent.getY();
                    float abs = Math.abs(this.f173586b - this.n);
                    float abs2 = Math.abs(this.f173587c - this.o);
                    int i2 = this.p;
                    if (abs > ((float) i2) || abs2 > ((float) i2)) {
                        z = true;
                    }
                    if (z) {
                        com.ss.android.a.a.a.a.c(this.s);
                    }
                    View.OnTouchListener onTouchListener2 = this.r;
                    if (onTouchListener2 != null) {
                        onTouchListener2.onTouch(this, motionEvent);
                    }
                } else if (actionMasked != 3) {
                    if (actionMasked == 5) {
                        com.ss.android.a.a.a.a.c(this.s);
                    }
                }
            }
            com.ss.android.a.a.a.a.c(this.s);
            if (SystemClock.elapsedRealtime() - this.f173591g < ((long) this.q) && (onTouchListener = this.r) != null) {
                onTouchListener.onTouch(this, motionEvent);
            }
        } else {
            this.f173586b = motionEvent.getX();
            this.f173587c = motionEvent.getY();
            this.f173591g = SystemClock.elapsedRealtime();
            com.ss.android.a.a.a.a.a(this.s, this.q);
            View.OnTouchListener onTouchListener3 = this.r;
            if (onTouchListener3 != null) {
                onTouchListener3.onTouch(this, motionEvent);
            }
        }
        super.onTouchEvent(motionEvent);
        return true;
    }

　　這個和上面那個是父子關系：

  

　　繼續一層一層往下撥：

   

   

 繼續往下撥：

 

 

  

反編譯失敗了：

直接看smali代碼或hook看看傳入的參數是啥：

 

 直到這里進入系統函數才罷休：

   

   這里貌似是遍歷短視頻，如果還有就取出來對比id，看看是不是同一個短視頻：

　

 

兩個參數都是float，看着像橫縱坐標：

 

 僅通過靜態分析也看不出啥花樣來，這里繼續用objection去hook上述提到的一些關鍵方法，看看傳入的參數和返回值都是啥了：

 objection --gadget "com.ss.android.ugc.aweme" explore

android hooking watch class_method com.ss.android.ugc.aweme.feed.utils.m$1.onTouch --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.feed.panel.b$10.a --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.feed.panel.t.a --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.feed.panel.b.a --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.feed.story.viewmodel.b$a.a --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.common.widget.DiggLayout.a --dump-args --dump-backtrace --dump-return

一次性hook了這么多函數，信息量最大的就是下面這個函數了，參數傳入了一大堆，但和用fiddler抓的數據相差甚遠，所以有兩種可能：（1）java層發送數據的不是這些函數，這里沒hook到  （2）發數據的函數在so層； 

•  　下滑時調用了這個函數，並傳入了MotionEvent類的參數：

(agent) [763006] Called com.ss.android.ugc.aweme.feed.panel.t.a(android.view.MotionEvent, com.ss.android.ugc.aweme.feed.adapter.av, com.ss.android.ugc.aweme.feed.model.Aweme)
(agent) [763006] Backtrace:
        com.ss.android.ugc.aweme.feed.panel.t.a(Native Method)
        com.ss.android.ugc.aweme.feed.panel.b.a(BaseListFragmentPanel.java:2411)
        com.ss.android.ugc.aweme.feed.panel.b$10.a(BaseListFragmentPanel.java:33816612)
        com.ss.android.ugc.aweme.feed.panel.b$10.a(Native Method)
        com.ss.android.ugc.aweme.feed.utils.m$1.onTouch(BaseFeedListViewUtils.java:34013410)
        com.ss.android.ugc.aweme.feed.ui.LongPressLayout.onTouchEvent(LongPressLayout.java:17170610)
        android.view.View.dispatchTouchEvent(View.java:10023)
        com.ss.android.ugc.aweme.feed.ui.LongPressLayout.dispatchTouchEvent(LongPressLayout.java:17039388)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        com.ss.android.ugc.aweme.common.widget.VerticalViewPager.dispatchTouchEvent(VerticalViewPager.java:17039392)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        com.ss.android.ugc.aweme.feed.widget.FeedSwipeRefreshLayout.dispatchTouchEvent(FeedSwipeRefreshLayout.java:17039388)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        dmt.viewpager.DmtViewPager.dispatchTouchEvent(DmtViewPager.java:17039406)
        com.ss.android.ugc.aweme.homepage.ui.view.MainFlippableViewPager.dispatchTouchEvent(MainFlippableViewPager.java:17170614)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        com.ss.android.ugc.aweme.feed.ui.seekbar.SupportSeekBarFrameLayout.dispatchTouchEvent(SupportSeekbarFrameLayout.kt:17236196)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        dmt.viewpager.DmtViewPager.dispatchTouchEvent(DmtViewPager.java:17039406)
        com.ss.android.ugc.aweme.base.ui.ScrollableViewPager.dispatchTouchEvent(ScrollableViewPager.java:17104950)
        com.ss.android.ugc.aweme.homepage.ui.view.MainScrollableViewPager.dispatchTouchEvent(MainScrollableViewPager.java:17104971)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:414)
        com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:1808)
        android.app.Activity.dispatchTouchEvent(Activity.java:3080)
        androidx.appcompat.view.WindowCallbackWrapper.dispatchTouchEvent(WindowCallbackWrapper.java:16842754)
        com.bytedance.a.h.dispatchTouchEvent(WindowCallback.kt:17039390)
        com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:376)
        android.view.View.dispatchPointerEvent(View.java:10243)
        android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:4438)
        android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:4306)
        android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:3853)
        android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:3906)
        android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:3872)
        android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:3999)
        android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:3880)
        android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:4056)
        android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:3853)
        android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:3906)
        android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:3872)
        android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:3880)
        android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:3853)
        android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:6247)
        android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:6221)
        android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:6182)
        android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:6350)
        android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:185)
        android.os.MessageQueue.nativePollOnce(Native Method)
        android.os.MessageQueue.next(MessageQueue.java:323)
        android.os.Looper.loop(Looper.java:136)
        android.app.ActivityThread.main(ActivityThread.java:6153)
        java.lang.reflect.Method.invoke(Native Method)
        com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:892)
        com.android.internal.os.ZygoteInit.main(ZygoteInit.java:782)

(agent) [763006] Arguments com.ss.android.ugc.aweme.feed.panel.t.a(MotionEvent { action=ACTION_DOWN, actionButton=0, id[0]=0, x[0]=567.0, y[0]=1176.0, toolType[0]=TOOL_TYPE_FINGER, buttonState=0, metaState=0, flags=0x0, edgeFlags=0x0, pointerCount=1, historySize=0, eventTime=4255405, downTime=4255405, deviceId=2, source=0x1002 }, [object Object], Aweme{aid='6966526429534194959', desc='才知道原來還可以乘船去頤和園！#頤和園 #旅行推薦官#吃喝玩樂在北京 #游船 @抖音小助手 @DOU+小助手', createTime=1622020838, author=com.ss.android.ugc.aweme.profile.model.User@323bfaa1, music=com.ss.android.ugc.aweme.music.model.Music@c2acaa7a, challengeList=[com.ss.android.ugc.aweme.discover.model.Challenge@57021de6], video=Video{playAddr=VideoUrlModel{uri='v0300fg10000c2n15mfci7itaorvb64g', urlList=[http://v11.douyinvod.com/c523cb9f078f527333e96647287561d3/60b9ab2c/video/tos/cn/tos-cn-ve-15/e3817c5ecb804d2aad3893a2c626d400/?a=1128&br=3520&bt=3520&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=0&cv=1&dr=0&ds=6&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=0&rc=ajl5cnc6ZnA0NTMzNGkzM0ApNzszPDc1Ozs1Nzw8OzU1NGcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzczE1YF5jLzMwXy5hMGEzLTY6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, http://v5-j.douyinvod.com/cae48d39e8381ce7de8824aaaeb76d25/60b9ab2c/video/tos/cn/tos-cn-ve-15/e3817c5ecb804d2aad3893a2c626d400/?a=1128&br=3520&bt=3520&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=0&cv=1&dr=0&ds=6&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=0&rc=ajl5cnc6ZnA0NTMzNGkzM0ApNzszPDc1Ozs1Nzw8OzU1NGcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzczE1YF5jLzMwXy5hMGEzLTY6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, https://aweme.snssdk.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=0&file_id=1920268d939d412b8386224f9a0c8844&sign=b47e3c52bb64c705b6d687a6885f31e4&is_play_url=1&source=PackSourceEnum_FEED, https://api.amemv.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=1&file_id=1920268d939d412b8386224f9a0c8844&sign=b47e3c52bb64c705b6d687a6885f31e4&is_play_url=1&source=PackSourceEnum_FEED]sourceId='6966526429534194959', ratio='540p', mVr=false, duration=22686.0, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], createTime=418523, ish265=false}, playAddrH265=VideoUrlModel{uri='v0300fg10000c2n15mfci7itaorvb64g', urlList=[http://v11.douyinvod.com/61efed9ae15d135b22a0f825d69c6cbb/60b9ab2c/video/tos/cn/tos-cn-ve-15/18a5494c301442f1ba3b5cfef0965d1c/?a=1128&br=2042&bt=2042&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=&cv=1&dr=0&ds=6&eid=258&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=11&rc=ajl5cnc6ZnA0NTMzNGkzM0ApZTtpaTdpOTtmNzg0OGRnZWcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzc2E0YDA1YzNjYl9jMS9hMWA6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, http://v5-j.douyinvod.com/0619178617db6a8022ba4ee6e4bef3c1/60b9ab2c/video/tos/cn/tos-cn-ve-15/18a5494c301442f1ba3b5cfef0965d1c/?a=1128&br=2042&bt=2042&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=&cv=1&dr=0&ds=6&eid=258&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=11&rc=ajl5cnc6ZnA0NTMzNGkzM0ApZTtpaTdpOTtmNzg0OGRnZWcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzc2E0YDA1YzNjYl9jMS9hMWA6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, https://aweme.snssdk.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=0&file_id=bcd4ad52145f4bce8f66ff48f3fc87bd&sign=1336a3a6a4d55642bd005285a9811e1c&is_play_url=1&source=PackSourceEnum_FEED, https://api.amemv.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=1&file_id=bcd4ad52145f4bce8f66ff48f3fc87bd&sign=1336a3a6a4d55642bd005285a9811e1c&is_play_url=1&source=PackSourceEnum_FEED]sourceId='6966526429534194959', ratio='540p', mVr=false, duration=22686.0, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], createTime=418523, ish265=true}, cover=com.ss.android.ugc.aweme.base.model.UrlModel@aaf30a3c, dynamicCover=com.ss.android.ugc.aweme.base.model.UrlModel@1, originCover=com.ss.android.ugc.aweme.base.model.UrlModel@4267e6d8, height=1024, width=576, ratio='540p', downloadAddr=com.ss.android.ugc.aweme.base.model.UrlModel@bf9258b5, hasWaterMark=true, videoLength=22686, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], newDownloadAddr=null, suffixLogoAddr=com.ss.android.ugc.aweme.base.model.UrlModel@bf9258b5, hasSuffixWaterMark=true, needSetCookie=false, misc_download_addrs=null, isCallback=false}, shareUrl='https://www.iesdouyin.com/share/video/6966526429534194959/?region=CN&mid=6966526465982679815&u_code=14l3h2iml&titleType=title&did=MS4wLjABAAAAquOerJW3vuXa7IdP7XVph12L7jn9gFwlQ7SutipfxDksoqwXSgkN97aln_PEC0Yv&iid=MS4wLjABAAAArySZw2NDXr-sMRbTVLZJo4SL1nkYP5JrepLYu_kX9K1EsJV6KVrvSqnZgLpcr0RA&with_sec_did=1', userDigg=0, statistics=AwemeStatistics{aid='null', commentCount=41, diggCount=26298, playCount=0, shareCount=2800, forwardCount=37, downloadCount=1059}, status=AwemeStatus{aid='null', isDelete=false, allowShare=true, allowComment=true, privateStatus=0, withFusionGoods=false, showGoodDelayTime=2000, inReviewing=false, reviewed=1, selfSee=false, isProhibited=false, downloadStatus=0, reviewStatus=, musicEditStatus=0, excludeStatus=0, allowRecommend=0}, extra='null', rate=12, shareInfo=com.ss.android.ugc.aweme.base.share.ShareInfo@34a2521, labelLarge=null, labelThumb=null, textExtra=[com.ss.android.ugc.aweme.model.TextExtraStruct@a260a462, com.ss.android.ugc.aweme.model.TextExtraStruct@e9d748c, com.ss.android.ugc.aweme.model.TextExtraStruct@2474c32, com.ss.android.ugc.aweme.model.TextExtraStruct@d9995f2a, com.ss.android.ugc.aweme.model.TextExtraStruct@c4c1007d, com.ss.android.ugc.aweme.model.TextExtraStruct@ddec2], isTop=0, labelTop=com.ss.android.ugc.aweme.base.model.UrlModel@cde9b05b, originalPos=0, isAd=false, awemeType=0, awemeRawAd=null, specialSticker=null, videoLabels=[], cmtSwt=false, adSchedule=null, mSimplePromotions=null, region=CN, recommendCardType=0, isFamiliar=false, needMarkFriend=false})

• 點贊時調用了同樣的函數，並傳入了videosEvent類的參數：

(agent) [763006] Called com.ss.android.ugc.aweme.feed.panel.t.a(com.ss.android.ugc.aweme.feed.h.cb)
(agent) [763006] Backtrace:
com.ss.android.ugc.aweme.feed.panel.t.a(Native Method)
com.ss.android.ugc.aweme.feed.panel.b.a(BaseListFragmentPanel.java:3594)
com.ss.android.ugc.aweme.feed.adapter.VideoViewHolder.a(VideoViewHolder.java:3110)
com.ss.android.ugc.aweme.feed.adapter.VideoViewHolder.a(VideoViewHolder.java:3760)
com.ss.android.ugc.aweme.feed.adapter.VideoViewHolder.onChanged(VideoViewHolder.java:16842754)
com.ss.android.ugc.aweme.arch.widgets.base.NextLiveData$NextObserver.onChanged(NextLiveData.java:17039395)
androidx.lifecycle.LiveData.considerNotify(LiveData.java:17039389)
androidx.lifecycle.LiveData.dispatchingValue(LiveData.java:17039410)
androidx.lifecycle.LiveData.setValue(LiveData.java:16973838)
androidx.lifecycle.MutableLiveData.setValue(MutableLiveData.java:16777216)
com.ss.android.ugc.aweme.arch.widgets.base.NextLiveData.setValue(NextLiveData.java:16973849)
com.ss.android.ugc.aweme.arch.widgets.base.DataCenter.a(DataCenter.java:34078842)
com.ss.android.ugc.aweme.feed.quick.presenter.cb.c(FeedDiggPresenter.java:17170485)
com.ss.android.ugc.aweme.feed.quick.presenter.ce.run(Unknown Source)
android.os.Handler.handleCallback(Handler.java:751)
android.os.Handler.dispatchMessage(Handler.java:95)
android.os.Looper.loop(Looper.java:154)
android.app.ActivityThread.main(ActivityThread.java:6153)
java.lang.reflect.Method.invoke(Native Method)
com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:892)
com.android.internal.os.ZygoteInit.main(ZygoteInit.java:782)

(agent) [763006] Arguments com.ss.android.ugc.aweme.feed.panel.t.a(VideoEvent{type=5, param=Aweme{aid='6966526429534194959', desc='才知道原來還可以乘船去頤和園！#頤和園 #旅行推薦官#吃喝玩樂在北京 #游船 @抖音小助手 @DOU+小助手', createTime=1622020838, author=com.ss.android.ugc.aweme.profile.model.User@323bfaa1, music=com.ss.android.ugc.aweme.music.model.Music@c2acaa7a, challengeList=[com.ss.android.ugc.aweme.discover.model.Challenge@57021de6], video=Video{playAddr=VideoUrlModel{uri='v0300fg10000c2n15mfci7itaorvb64g', urlList=[http://v11.douyinvod.com/c523cb9f078f527333e96647287561d3/60b9ab2c/video/tos/cn/tos-cn-ve-15/e3817c5ecb804d2aad3893a2c626d400/?a=1128&br=3520&bt=3520&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=0&cv=1&dr=0&ds=6&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=0&rc=ajl5cnc6ZnA0NTMzNGkzM0ApNzszPDc1Ozs1Nzw8OzU1NGcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzczE1YF5jLzMwXy5hMGEzLTY6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, http://v5-j.douyinvod.com/cae48d39e8381ce7de8824aaaeb76d25/60b9ab2c/video/tos/cn/tos-cn-ve-15/e3817c5ecb804d2aad3893a2c626d400/?a=1128&br=3520&bt=3520&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=0&cv=1&dr=0&ds=6&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=0&rc=ajl5cnc6ZnA0NTMzNGkzM0ApNzszPDc1Ozs1Nzw8OzU1NGcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzczE1YF5jLzMwXy5hMGEzLTY6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, https://aweme.snssdk.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=0&file_id=1920268d939d412b8386224f9a0c8844&sign=b47e3c52bb64c705b6d687a6885f31e4&is_play_url=1&source=PackSourceEnum_FEED, https://api.amemv.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=1&file_id=1920268d939d412b8386224f9a0c8844&sign=b47e3c52bb64c705b6d687a6885f31e4&is_play_url=1&source=PackSourceEnum_FEED]sourceId='6966526429534194959', ratio='540p', mVr=false, duration=22686.0, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], createTime=418523, ish265=false}, playAddrH265=VideoUrlModel{uri='v0300fg10000c2n15mfci7itaorvb64g', urlList=[http://v11.douyinvod.com/61efed9ae15d135b22a0f825d69c6cbb/60b9ab2c/video/tos/cn/tos-cn-ve-15/18a5494c301442f1ba3b5cfef0965d1c/?a=1128&br=2042&bt=2042&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=&cv=1&dr=0&ds=6&eid=258&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=11&rc=ajl5cnc6ZnA0NTMzNGkzM0ApZTtpaTdpOTtmNzg0OGRnZWcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzc2E0YDA1YzNjYl9jMS9hMWA6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, http://v5-j.douyinvod.com/0619178617db6a8022ba4ee6e4bef3c1/60b9ab2c/video/tos/cn/tos-cn-ve-15/18a5494c301442f1ba3b5cfef0965d1c/?a=1128&br=2042&bt=2042&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=&cv=1&dr=0&ds=6&eid=258&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=11&rc=ajl5cnc6ZnA0NTMzNGkzM0ApZTtpaTdpOTtmNzg0OGRnZWcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzc2E0YDA1YzNjYl9jMS9hMWA6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, https://aweme.snssdk.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=0&file_id=bcd4ad52145f4bce8f66ff48f3fc87bd&sign=1336a3a6a4d55642bd005285a9811e1c&is_play_url=1&source=PackSourceEnum_FEED, https://api.amemv.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=1&file_id=bcd4ad52145f4bce8f66ff48f3fc87bd&sign=1336a3a6a4d55642bd005285a9811e1c&is_play_url=1&source=PackSourceEnum_FEED]sourceId='6966526429534194959', ratio='540p', mVr=false, duration=22686.0, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], createTime=418523, ish265=true}, cover=com.ss.android.ugc.aweme.base.model.UrlModel@aaf30a3c, dynamicCover=com.ss.android.ugc.aweme.base.model.UrlModel@1, originCover=com.ss.android.ugc.aweme.base.model.UrlModel@4267e6d8, height=1024, width=576, ratio='540p', downloadAddr=com.ss.android.ugc.aweme.base.model.UrlModel@bf9258b5, hasWaterMark=true, videoLength=22686, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], newDownloadAddr=null, suffixLogoAddr=com.ss.android.ugc.aweme.base.model.UrlModel@bf9258b5, hasSuffixWaterMark=true, needSetCookie=false, misc_download_addrs=null, isCallback=false}, shareUrl='https://www.iesdouyin.com/share/video/6966526429534194959/?region=CN&mid=6966526465982679815&u_code=14l3h2iml&titleType=title&did=MS4wLjABAAAAquOerJW3vuXa7IdP7XVph12L7jn9gFwlQ7SutipfxDksoqwXSgkN97aln_PEC0Yv&iid=MS4wLjABAAAArySZw2NDXr-sMRbTVLZJo4SL1nkYP5JrepLYu_kX9K1EsJV6KVrvSqnZgLpcr0RA&with_sec_did=1', userDigg=0, statistics=AwemeStatistics{aid='null', commentCount=41, diggCount=26298, playCount=0, shareCount=2800, forwardCount=37, downloadCount=1059}, status=AwemeStatus{aid='null', isDelete=false, allowShare=true, allowComment=true, privateStatus=0, withFusionGoods=false, showGoodDelayTime=2000, inReviewing=false, reviewed=1, selfSee=false, isProhibited=false, downloadStatus=0, reviewStatus=, musicEditStatus=0, excludeStatus=0, allowRecommend=0}, extra='null', rate=12, shareInfo=com.ss.android.ugc.aweme.base.share.ShareInfo@34a2521, labelLarge=null, labelThumb=null, textExtra=[com.ss.android.ugc.aweme.model.TextExtraStruct@a260a462, com.ss.android.ugc.aweme.model.TextExtraStruct@e9d748c, com.ss.android.ugc.aweme.model.TextExtraStruct@2474c32, com.ss.android.ugc.aweme.model.TextExtraStruct@d9995f2a, com.ss.android.ugc.aweme.model.TextExtraStruct@c4c1007d, com.ss.android.ugc.aweme.model.TextExtraStruct@ddec2], isTop=0, labelTop=com.ss.android.ugc.aweme.base.model.UrlModel@cde9b05b, originalPos=0, isAd=false, awemeType=0, awemeRawAd=null, specialSticker=null, videoLabels=[], cmtSwt=false, adSchedule=null, mSimplePromotions=null, region=CN, recommendCardType=0, isFamiliar=false, needMarkFriend=false}, videoType=0, from='null, currentPosition='0, isPlaying='false'})
(agent) [763006] Return Value: (none)

　

 

參考：

1、https://blog.csdn.net/PLA12147111/article/details/100062592  jadx卡死解決方案