android逆向奇技淫巧二：uiautomatorviewer&method profiling定位x音java层的关键代码和方法

　　做逆向，不论是在windows还是Android，抑或是macos，都必须要面对的一个问题：找到关键的代码。android平台下怎么找到关键的代码了？本文以某国民级短视频APP为例，分享从UI界面定位到关键代码的链路逻辑！

　　1、老规矩，先在模拟器运行这款APP，然后打开ui automator viewer “截屏”（注意：要暂停短视频播放才行，否则截屏的时候会报错）！如下：

       

 　　比如我们想找点赞按钮的执行代码（至于为什么要找这个按钮的执行代码，道上人士都懂的），光标移动到笔芯上，右边就会显示出笔芯的imageView，这里能看出其实是一个按钮控件；先阿敏有resource-id和class类型；接着进入jadx（这种apk上百兆，用jadx容易卡死，需要增加内存，增加的方法见文章末尾的参考1），找到resources.arsc文件，用刚才找到的id字段也就是byb作为关键词，找到点赞笔芯的id: 2131168834

         

　　然后继续搜索，发现原来是这两行代码引用了：

     

　　本想点击进一步查看java源码，无奈本机内存只有16G，而jadx已经消耗了9G，还是卡者不动，无法继续，这里换成android killer继续逆向分析。把这一串id转成16进制，然后在android killer里面搜索：

　　

       发现到处都在引用；后续会继续分享怎么分析这些引用！

　　至于这里为啥用id来检索，而不是控件的名称了？我个人理解：大概率是因为控件名称开发人员随时都可能更改，所以编译器自动生成id与之对应。控件名称随时可以改，但是id不变，通过这种方式做到松耦合！

　　2、上面使用了这个id的地方还是有很多，挨个去静态分析还是耗时，怎么能快速找到点赞执行了哪些代码了？这里有个更快速的方法：method profiling；本质上，method profiling相当于录屏，结果如下: 因为用户需要手动点击笔芯才能点赞，所以肯定会调用onclick方法，这里就能根据onclick作为关键词查询：

　　      

              只有这两个地方调用了onclick方法：

 　　　 

 　　    接下来再去jadx或android killer找这两个方法分析源码，是不是简单多了？（用AK搜的时候注意把.改成/）

            

 　　   老规矩，最后整理一下常见的静态分析方法：

          

注意：x音没登陆时点击屏幕用的是onClick来监听的；一旦登陆，用户点赞用的就是onTouch监听了，method profiling捕获到的函数调用如下：

  

　代码在这：

public boolean onTouchEvent(MotionEvent motionEvent) {
        View.OnTouchListener onTouchListener;
        boolean z = false;
        PatchProxyResult proxy = PatchProxy.proxy(new Object[]{motionEvent}, this, f173585a, false, 254253);
        if (proxy.isSupported) {
            return ((Boolean) proxy.result).booleanValue();
        }
        if (!isEnabled()) {
            return false;
        }
        this.j = true;
        int actionMasked = motionEvent.getActionMasked();
        if (actionMasked != 0) {
            if (actionMasked != 1) {
                if (actionMasked == 2) {
                    this.n = motionEvent.getX();
                    this.o = motionEvent.getY();
                    float abs = Math.abs(this.f173586b - this.n);
                    float abs2 = Math.abs(this.f173587c - this.o);
                    int i2 = this.p;
                    if (abs > ((float) i2) || abs2 > ((float) i2)) {
                        z = true;
                    }
                    if (z) {
                        com.ss.android.a.a.a.a.c(this.s);
                    }
                    View.OnTouchListener onTouchListener2 = this.r;
                    if (onTouchListener2 != null) {
                        onTouchListener2.onTouch(this, motionEvent);
                    }
                } else if (actionMasked != 3) {
                    if (actionMasked == 5) {
                        com.ss.android.a.a.a.a.c(this.s);
                    }
                }
            }
            com.ss.android.a.a.a.a.c(this.s);
            if (SystemClock.elapsedRealtime() - this.f173591g < ((long) this.q) && (onTouchListener = this.r) != null) {
                onTouchListener.onTouch(this, motionEvent);
            }
        } else {
            this.f173586b = motionEvent.getX();
            this.f173587c = motionEvent.getY();
            this.f173591g = SystemClock.elapsedRealtime();
            com.ss.android.a.a.a.a.a(this.s, this.q);
            View.OnTouchListener onTouchListener3 = this.r;
            if (onTouchListener3 != null) {
                onTouchListener3.onTouch(this, motionEvent);
            }
        }
        super.onTouchEvent(motionEvent);
        return true;
    }

　　这个和上面那个是父子关系：

  

　　继续一层一层往下拨：

   

   

 继续往下拨：

 

 

  

反编译失败了：

直接看smali代码或hook看看传入的参数是啥：

 

 直到这里进入系统函数才罢休：

   

   这里貌似是遍历短视频，如果还有就取出来对比id，看看是不是同一个短视频：

　

 

两个参数都是float，看着像横纵坐标：

 

 仅通过静态分析也看不出啥花样来，这里继续用objection去hook上述提到的一些关键方法，看看传入的参数和返回值都是啥了：

 objection --gadget "com.ss.android.ugc.aweme" explore

android hooking watch class_method com.ss.android.ugc.aweme.feed.utils.m$1.onTouch --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.feed.panel.b$10.a --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.feed.panel.t.a --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.feed.panel.b.a --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.feed.story.viewmodel.b$a.a --dump-args --dump-backtrace --dump-return

android hooking watch class_method com.ss.android.ugc.aweme.common.widget.DiggLayout.a --dump-args --dump-backtrace --dump-return

一次性hook了这么多函数，信息量最大的就是下面这个函数了，参数传入了一大堆，但和用fiddler抓的数据相差甚远，所以有两种可能：（1）java层发送数据的不是这些函数，这里没hook到  （2）发数据的函数在so层； 

•  　下滑时调用了这个函数，并传入了MotionEvent类的参数：

(agent) [763006] Called com.ss.android.ugc.aweme.feed.panel.t.a(android.view.MotionEvent, com.ss.android.ugc.aweme.feed.adapter.av, com.ss.android.ugc.aweme.feed.model.Aweme)
(agent) [763006] Backtrace:
        com.ss.android.ugc.aweme.feed.panel.t.a(Native Method)
        com.ss.android.ugc.aweme.feed.panel.b.a(BaseListFragmentPanel.java:2411)
        com.ss.android.ugc.aweme.feed.panel.b$10.a(BaseListFragmentPanel.java:33816612)
        com.ss.android.ugc.aweme.feed.panel.b$10.a(Native Method)
        com.ss.android.ugc.aweme.feed.utils.m$1.onTouch(BaseFeedListViewUtils.java:34013410)
        com.ss.android.ugc.aweme.feed.ui.LongPressLayout.onTouchEvent(LongPressLayout.java:17170610)
        android.view.View.dispatchTouchEvent(View.java:10023)
        com.ss.android.ugc.aweme.feed.ui.LongPressLayout.dispatchTouchEvent(LongPressLayout.java:17039388)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        com.ss.android.ugc.aweme.common.widget.VerticalViewPager.dispatchTouchEvent(VerticalViewPager.java:17039392)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        com.ss.android.ugc.aweme.feed.widget.FeedSwipeRefreshLayout.dispatchTouchEvent(FeedSwipeRefreshLayout.java:17039388)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        dmt.viewpager.DmtViewPager.dispatchTouchEvent(DmtViewPager.java:17039406)
        com.ss.android.ugc.aweme.homepage.ui.view.MainFlippableViewPager.dispatchTouchEvent(MainFlippableViewPager.java:17170614)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        com.ss.android.ugc.aweme.feed.ui.seekbar.SupportSeekBarFrameLayout.dispatchTouchEvent(SupportSeekbarFrameLayout.kt:17236196)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        dmt.viewpager.DmtViewPager.dispatchTouchEvent(DmtViewPager.java:17039406)
        com.ss.android.ugc.aweme.base.ui.ScrollableViewPager.dispatchTouchEvent(ScrollableViewPager.java:17104950)
        com.ss.android.ugc.aweme.homepage.ui.view.MainScrollableViewPager.dispatchTouchEvent(MainScrollableViewPager.java:17104971)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2659)
        android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2291)
        com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:414)
        com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:1808)
        android.app.Activity.dispatchTouchEvent(Activity.java:3080)
        androidx.appcompat.view.WindowCallbackWrapper.dispatchTouchEvent(WindowCallbackWrapper.java:16842754)
        com.bytedance.a.h.dispatchTouchEvent(WindowCallback.kt:17039390)
        com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:376)
        android.view.View.dispatchPointerEvent(View.java:10243)
        android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:4438)
        android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:4306)
        android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:3853)
        android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:3906)
        android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:3872)
        android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:3999)
        android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:3880)
        android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:4056)
        android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:3853)
        android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:3906)
        android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:3872)
        android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:3880)
        android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:3853)
        android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:6247)
        android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:6221)
        android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:6182)
        android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:6350)
        android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:185)
        android.os.MessageQueue.nativePollOnce(Native Method)
        android.os.MessageQueue.next(MessageQueue.java:323)
        android.os.Looper.loop(Looper.java:136)
        android.app.ActivityThread.main(ActivityThread.java:6153)
        java.lang.reflect.Method.invoke(Native Method)
        com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:892)
        com.android.internal.os.ZygoteInit.main(ZygoteInit.java:782)

(agent) [763006] Arguments com.ss.android.ugc.aweme.feed.panel.t.a(MotionEvent { action=ACTION_DOWN, actionButton=0, id[0]=0, x[0]=567.0, y[0]=1176.0, toolType[0]=TOOL_TYPE_FINGER, buttonState=0, metaState=0, flags=0x0, edgeFlags=0x0, pointerCount=1, historySize=0, eventTime=4255405, downTime=4255405, deviceId=2, source=0x1002 }, [object Object], Aweme{aid='6966526429534194959', desc='才知道原来还可以乘船去颐和园！#颐和园 #旅行推荐官#吃喝玩乐在北京 #游船 @抖音小助手 @DOU+小助手', createTime=1622020838, author=com.ss.android.ugc.aweme.profile.model.User@323bfaa1, music=com.ss.android.ugc.aweme.music.model.Music@c2acaa7a, challengeList=[com.ss.android.ugc.aweme.discover.model.Challenge@57021de6], video=Video{playAddr=VideoUrlModel{uri='v0300fg10000c2n15mfci7itaorvb64g', urlList=[http://v11.douyinvod.com/c523cb9f078f527333e96647287561d3/60b9ab2c/video/tos/cn/tos-cn-ve-15/e3817c5ecb804d2aad3893a2c626d400/?a=1128&br=3520&bt=3520&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=0&cv=1&dr=0&ds=6&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=0&rc=ajl5cnc6ZnA0NTMzNGkzM0ApNzszPDc1Ozs1Nzw8OzU1NGcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzczE1YF5jLzMwXy5hMGEzLTY6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, http://v5-j.douyinvod.com/cae48d39e8381ce7de8824aaaeb76d25/60b9ab2c/video/tos/cn/tos-cn-ve-15/e3817c5ecb804d2aad3893a2c626d400/?a=1128&br=3520&bt=3520&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=0&cv=1&dr=0&ds=6&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=0&rc=ajl5cnc6ZnA0NTMzNGkzM0ApNzszPDc1Ozs1Nzw8OzU1NGcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzczE1YF5jLzMwXy5hMGEzLTY6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, https://aweme.snssdk.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=0&file_id=1920268d939d412b8386224f9a0c8844&sign=b47e3c52bb64c705b6d687a6885f31e4&is_play_url=1&source=PackSourceEnum_FEED, https://api.amemv.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=1&file_id=1920268d939d412b8386224f9a0c8844&sign=b47e3c52bb64c705b6d687a6885f31e4&is_play_url=1&source=PackSourceEnum_FEED]sourceId='6966526429534194959', ratio='540p', mVr=false, duration=22686.0, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], createTime=418523, ish265=false}, playAddrH265=VideoUrlModel{uri='v0300fg10000c2n15mfci7itaorvb64g', urlList=[http://v11.douyinvod.com/61efed9ae15d135b22a0f825d69c6cbb/60b9ab2c/video/tos/cn/tos-cn-ve-15/18a5494c301442f1ba3b5cfef0965d1c/?a=1128&br=2042&bt=2042&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=&cv=1&dr=0&ds=6&eid=258&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=11&rc=ajl5cnc6ZnA0NTMzNGkzM0ApZTtpaTdpOTtmNzg0OGRnZWcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzc2E0YDA1YzNjYl9jMS9hMWA6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, http://v5-j.douyinvod.com/0619178617db6a8022ba4ee6e4bef3c1/60b9ab2c/video/tos/cn/tos-cn-ve-15/18a5494c301442f1ba3b5cfef0965d1c/?a=1128&br=2042&bt=2042&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=&cv=1&dr=0&ds=6&eid=258&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=11&rc=ajl5cnc6ZnA0NTMzNGkzM0ApZTtpaTdpOTtmNzg0OGRnZWcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzc2E0YDA1YzNjYl9jMS9hMWA6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, https://aweme.snssdk.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=0&file_id=bcd4ad52145f4bce8f66ff48f3fc87bd&sign=1336a3a6a4d55642bd005285a9811e1c&is_play_url=1&source=PackSourceEnum_FEED, https://api.amemv.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=1&file_id=bcd4ad52145f4bce8f66ff48f3fc87bd&sign=1336a3a6a4d55642bd005285a9811e1c&is_play_url=1&source=PackSourceEnum_FEED]sourceId='6966526429534194959', ratio='540p', mVr=false, duration=22686.0, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], createTime=418523, ish265=true}, cover=com.ss.android.ugc.aweme.base.model.UrlModel@aaf30a3c, dynamicCover=com.ss.android.ugc.aweme.base.model.UrlModel@1, originCover=com.ss.android.ugc.aweme.base.model.UrlModel@4267e6d8, height=1024, width=576, ratio='540p', downloadAddr=com.ss.android.ugc.aweme.base.model.UrlModel@bf9258b5, hasWaterMark=true, videoLength=22686, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], newDownloadAddr=null, suffixLogoAddr=com.ss.android.ugc.aweme.base.model.UrlModel@bf9258b5, hasSuffixWaterMark=true, needSetCookie=false, misc_download_addrs=null, isCallback=false}, shareUrl='https://www.iesdouyin.com/share/video/6966526429534194959/?region=CN&mid=6966526465982679815&u_code=14l3h2iml&titleType=title&did=MS4wLjABAAAAquOerJW3vuXa7IdP7XVph12L7jn9gFwlQ7SutipfxDksoqwXSgkN97aln_PEC0Yv&iid=MS4wLjABAAAArySZw2NDXr-sMRbTVLZJo4SL1nkYP5JrepLYu_kX9K1EsJV6KVrvSqnZgLpcr0RA&with_sec_did=1', userDigg=0, statistics=AwemeStatistics{aid='null', commentCount=41, diggCount=26298, playCount=0, shareCount=2800, forwardCount=37, downloadCount=1059}, status=AwemeStatus{aid='null', isDelete=false, allowShare=true, allowComment=true, privateStatus=0, withFusionGoods=false, showGoodDelayTime=2000, inReviewing=false, reviewed=1, selfSee=false, isProhibited=false, downloadStatus=0, reviewStatus=, musicEditStatus=0, excludeStatus=0, allowRecommend=0}, extra='null', rate=12, shareInfo=com.ss.android.ugc.aweme.base.share.ShareInfo@34a2521, labelLarge=null, labelThumb=null, textExtra=[com.ss.android.ugc.aweme.model.TextExtraStruct@a260a462, com.ss.android.ugc.aweme.model.TextExtraStruct@e9d748c, com.ss.android.ugc.aweme.model.TextExtraStruct@2474c32, com.ss.android.ugc.aweme.model.TextExtraStruct@d9995f2a, com.ss.android.ugc.aweme.model.TextExtraStruct@c4c1007d, com.ss.android.ugc.aweme.model.TextExtraStruct@ddec2], isTop=0, labelTop=com.ss.android.ugc.aweme.base.model.UrlModel@cde9b05b, originalPos=0, isAd=false, awemeType=0, awemeRawAd=null, specialSticker=null, videoLabels=[], cmtSwt=false, adSchedule=null, mSimplePromotions=null, region=CN, recommendCardType=0, isFamiliar=false, needMarkFriend=false})

• 点赞时调用了同样的函数，并传入了videosEvent类的参数：

(agent) [763006] Called com.ss.android.ugc.aweme.feed.panel.t.a(com.ss.android.ugc.aweme.feed.h.cb)
(agent) [763006] Backtrace:
com.ss.android.ugc.aweme.feed.panel.t.a(Native Method)
com.ss.android.ugc.aweme.feed.panel.b.a(BaseListFragmentPanel.java:3594)
com.ss.android.ugc.aweme.feed.adapter.VideoViewHolder.a(VideoViewHolder.java:3110)
com.ss.android.ugc.aweme.feed.adapter.VideoViewHolder.a(VideoViewHolder.java:3760)
com.ss.android.ugc.aweme.feed.adapter.VideoViewHolder.onChanged(VideoViewHolder.java:16842754)
com.ss.android.ugc.aweme.arch.widgets.base.NextLiveData$NextObserver.onChanged(NextLiveData.java:17039395)
androidx.lifecycle.LiveData.considerNotify(LiveData.java:17039389)
androidx.lifecycle.LiveData.dispatchingValue(LiveData.java:17039410)
androidx.lifecycle.LiveData.setValue(LiveData.java:16973838)
androidx.lifecycle.MutableLiveData.setValue(MutableLiveData.java:16777216)
com.ss.android.ugc.aweme.arch.widgets.base.NextLiveData.setValue(NextLiveData.java:16973849)
com.ss.android.ugc.aweme.arch.widgets.base.DataCenter.a(DataCenter.java:34078842)
com.ss.android.ugc.aweme.feed.quick.presenter.cb.c(FeedDiggPresenter.java:17170485)
com.ss.android.ugc.aweme.feed.quick.presenter.ce.run(Unknown Source)
android.os.Handler.handleCallback(Handler.java:751)
android.os.Handler.dispatchMessage(Handler.java:95)
android.os.Looper.loop(Looper.java:154)
android.app.ActivityThread.main(ActivityThread.java:6153)
java.lang.reflect.Method.invoke(Native Method)
com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:892)
com.android.internal.os.ZygoteInit.main(ZygoteInit.java:782)

(agent) [763006] Arguments com.ss.android.ugc.aweme.feed.panel.t.a(VideoEvent{type=5, param=Aweme{aid='6966526429534194959', desc='才知道原来还可以乘船去颐和园！#颐和园 #旅行推荐官#吃喝玩乐在北京 #游船 @抖音小助手 @DOU+小助手', createTime=1622020838, author=com.ss.android.ugc.aweme.profile.model.User@323bfaa1, music=com.ss.android.ugc.aweme.music.model.Music@c2acaa7a, challengeList=[com.ss.android.ugc.aweme.discover.model.Challenge@57021de6], video=Video{playAddr=VideoUrlModel{uri='v0300fg10000c2n15mfci7itaorvb64g', urlList=[http://v11.douyinvod.com/c523cb9f078f527333e96647287561d3/60b9ab2c/video/tos/cn/tos-cn-ve-15/e3817c5ecb804d2aad3893a2c626d400/?a=1128&br=3520&bt=3520&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=0&cv=1&dr=0&ds=6&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=0&rc=ajl5cnc6ZnA0NTMzNGkzM0ApNzszPDc1Ozs1Nzw8OzU1NGcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzczE1YF5jLzMwXy5hMGEzLTY6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, http://v5-j.douyinvod.com/cae48d39e8381ce7de8824aaaeb76d25/60b9ab2c/video/tos/cn/tos-cn-ve-15/e3817c5ecb804d2aad3893a2c626d400/?a=1128&br=3520&bt=3520&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=0&cv=1&dr=0&ds=6&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=0&rc=ajl5cnc6ZnA0NTMzNGkzM0ApNzszPDc1Ozs1Nzw8OzU1NGcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzczE1YF5jLzMwXy5hMGEzLTY6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, https://aweme.snssdk.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=0&file_id=1920268d939d412b8386224f9a0c8844&sign=b47e3c52bb64c705b6d687a6885f31e4&is_play_url=1&source=PackSourceEnum_FEED, https://api.amemv.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=1&file_id=1920268d939d412b8386224f9a0c8844&sign=b47e3c52bb64c705b6d687a6885f31e4&is_play_url=1&source=PackSourceEnum_FEED]sourceId='6966526429534194959', ratio='540p', mVr=false, duration=22686.0, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], createTime=418523, ish265=false}, playAddrH265=VideoUrlModel{uri='v0300fg10000c2n15mfci7itaorvb64g', urlList=[http://v11.douyinvod.com/61efed9ae15d135b22a0f825d69c6cbb/60b9ab2c/video/tos/cn/tos-cn-ve-15/18a5494c301442f1ba3b5cfef0965d1c/?a=1128&br=2042&bt=2042&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=&cv=1&dr=0&ds=6&eid=258&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=11&rc=ajl5cnc6ZnA0NTMzNGkzM0ApZTtpaTdpOTtmNzg0OGRnZWcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzc2E0YDA1YzNjYl9jMS9hMWA6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, http://v5-j.douyinvod.com/0619178617db6a8022ba4ee6e4bef3c1/60b9ab2c/video/tos/cn/tos-cn-ve-15/18a5494c301442f1ba3b5cfef0965d1c/?a=1128&br=2042&bt=2042&btag=b&cd=0%7C0%7C0&ch=5&cr=3&cs=&cv=1&dr=0&ds=6&eid=258&er=&l=2021060411245201021210407602009846&lr=all&mime_type=video_mp4&net=0&pl=0&qs=11&rc=ajl5cnc6ZnA0NTMzNGkzM0ApZTtpaTdpOTtmNzg0OGRnZWcpaGxuZDFwekAxX29eZmZjMmtgLS1kLTBzc2E0YDA1YzNjYl9jMS9hMWA6Y2pxK2BtYmJeYA%3D%3D&vl=&vr=, https://aweme.snssdk.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=0&file_id=bcd4ad52145f4bce8f66ff48f3fc87bd&sign=1336a3a6a4d55642bd005285a9811e1c&is_play_url=1&source=PackSourceEnum_FEED, https://api.amemv.com/aweme/v1/play/?video_id=v0300fg10000c2n15mfci7itaorvb64g&line=1&file_id=bcd4ad52145f4bce8f66ff48f3fc87bd&sign=1336a3a6a4d55642bd005285a9811e1c&is_play_url=1&source=PackSourceEnum_FEED]sourceId='6966526429534194959', ratio='540p', mVr=false, duration=22686.0, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], createTime=418523, ish265=true}, cover=com.ss.android.ugc.aweme.base.model.UrlModel@aaf30a3c, dynamicCover=com.ss.android.ugc.aweme.base.model.UrlModel@1, originCover=com.ss.android.ugc.aweme.base.model.UrlModel@4267e6d8, height=1024, width=576, ratio='540p', downloadAddr=com.ss.android.ugc.aweme.base.model.UrlModel@bf9258b5, hasWaterMark=true, videoLength=22686, bitRate=[BitRate{bitRate=3757824, gearName='adapt_lowest_1080', qualityType=2, isH265=1}, BitRate{bitRate=2569511, gearName='adapt_lowest_720', qualityType=15, isH265=1}, BitRate{bitRate=2091880, gearName='adapt_540', qualityType=28, isH265=1}], newDownloadAddr=null, suffixLogoAddr=com.ss.android.ugc.aweme.base.model.UrlModel@bf9258b5, hasSuffixWaterMark=true, needSetCookie=false, misc_download_addrs=null, isCallback=false}, shareUrl='https://www.iesdouyin.com/share/video/6966526429534194959/?region=CN&mid=6966526465982679815&u_code=14l3h2iml&titleType=title&did=MS4wLjABAAAAquOerJW3vuXa7IdP7XVph12L7jn9gFwlQ7SutipfxDksoqwXSgkN97aln_PEC0Yv&iid=MS4wLjABAAAArySZw2NDXr-sMRbTVLZJo4SL1nkYP5JrepLYu_kX9K1EsJV6KVrvSqnZgLpcr0RA&with_sec_did=1', userDigg=0, statistics=AwemeStatistics{aid='null', commentCount=41, diggCount=26298, playCount=0, shareCount=2800, forwardCount=37, downloadCount=1059}, status=AwemeStatus{aid='null', isDelete=false, allowShare=true, allowComment=true, privateStatus=0, withFusionGoods=false, showGoodDelayTime=2000, inReviewing=false, reviewed=1, selfSee=false, isProhibited=false, downloadStatus=0, reviewStatus=, musicEditStatus=0, excludeStatus=0, allowRecommend=0}, extra='null', rate=12, shareInfo=com.ss.android.ugc.aweme.base.share.ShareInfo@34a2521, labelLarge=null, labelThumb=null, textExtra=[com.ss.android.ugc.aweme.model.TextExtraStruct@a260a462, com.ss.android.ugc.aweme.model.TextExtraStruct@e9d748c, com.ss.android.ugc.aweme.model.TextExtraStruct@2474c32, com.ss.android.ugc.aweme.model.TextExtraStruct@d9995f2a, com.ss.android.ugc.aweme.model.TextExtraStruct@c4c1007d, com.ss.android.ugc.aweme.model.TextExtraStruct@ddec2], isTop=0, labelTop=com.ss.android.ugc.aweme.base.model.UrlModel@cde9b05b, originalPos=0, isAd=false, awemeType=0, awemeRawAd=null, specialSticker=null, videoLabels=[], cmtSwt=false, adSchedule=null, mSimplePromotions=null, region=CN, recommendCardType=0, isFamiliar=false, needMarkFriend=false}, videoType=0, from='null, currentPosition='0, isPlaying='false'})
(agent) [763006] Return Value: (none)

　

参考：

1、https://blog.csdn.net/PLA12147111/article/details/100062592  jadx卡死解决方案