//data是前面已经存在的app信息，获取到当前app的包名，用于判断某个目录下是否存在
//某个文件，文件存在做某事
String curPkgName = data.appInfo.packageName;
int curUid = Process.myUid();
//获取进程id，猜测大部分系统进程id都是10000内，应该是过滤了系统的app
if (curUid > 10000) {
  	//这个类后面会给出来，是复制文件，判断文件夹等等用途
    Persist.LOGD("curPkgName: " + curPkgName + " curUid: " + curUid);
    //判断当前app是否激活了持久化hook，就是判断包目录下是否存在某个文件
    Boolean isPersist = Persist.isEnablePersist(curPkgName);
    Persist.LOGD("isPersist: " + isPersist);
    if (isPersist) {
        //复制hook脚本到app安装目录下，然后加载gadget so
        if(Persist.doXiaojianbangPersist(appContext, curPkgName)){
            Persist.LOGD("doXiaojianbangPersist is ok");
        }else {
            Persist.LOGD("doXiaojianbangPersist failed");
        };
    }
}

xz -d xxxx.tar.xz

//源码根目录下，在打开这个文件
/build/make/target/product/handheld_system.mk
//找到PRODUCT_COPY_FILES地方
//myfrida这个目录就是你创建的，你可以随便写自己的。
PRODUCT_COPY_FILES += \
    frameworks/base/cmds/myfrida/frida-gadget-14.2.18-android-arm.so:$(TARGET_COPY_OUT_SYSTEM)/lib/myfrida.so \
    frameworks/base/cmds/myfrida/frida-gadget-14.2.18-android-arm64.so:$(TARGET_COPY_OUT_SYSTEM)/lib64/myfrida.so

Boolean isPersist = Persist.isEnablePersist(curPkgName);

import android.content.Context;
import android.util.Log;
import android.os.Process;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;

import org.json.JSONObject;


public class Persist {

    public static final String SO_NAME = "libxiaojianbang.so";
    public static final String SO_CONFIG_NAME = "libxiaojianbang.config.so";
    public static final String LIB32_DIR = "/system/lib";
    public static final String LIB64_DIR = "/system/lib64";

    public static final String SETTINGS_DIR = "/data/system/xsettings/xiaojianbang/persist";
    public static final String ENABLE_PERSIST_FILE_NAME = "xiaojianbang_persist";

    public static final String CONFIG_JS_DIR = "/data/system/xsettings/xiaojianbang/jscfg";
    public static final String CONFIG_JS_FILE_NAME = "config.js";

    public static final String TAG_NAME = "xiaojianbang_persist";


    public static void LOGD(String msg) {
        Log.d(TAG_NAME, msg);
    }

    private static boolean saveFile(String filePath, String textMsg) {
        try{
            FileOutputStream fileOutputStream = new FileOutputStream(filePath);
            fileOutputStream.write(textMsg.getBytes("utf-8"));
            fileOutputStream.flush();
            fileOutputStream.close();
            return true;
        } catch (Exception e) {
            e.printStackTrace();
        }
        return false;
    }

    private static boolean copyFile(File srcFile, File dstFile) {
        try{
            FileInputStream fileInputStream = new FileInputStream(srcFile);
            FileOutputStream fileOutputStream = new FileOutputStream(dstFile);
            byte[] data = new byte[16 * 1024];
            int len = -1;
            while((len = fileInputStream.read(data)) != -1) {
                fileOutputStream.write(data,0, len);
                fileOutputStream.flush();
            }
            fileInputStream.close();
            fileOutputStream.close();
            return true;
        } catch (Exception e) {
            e.printStackTrace();
        }
        return false;
    }
    // 判断app是否打开自动注入脚本功能
    public static boolean isEnablePersist(String pkgName) {
        // 判断文件是否存在 /data/system/xsettings/xiaojianbang/persist/com.xiaojianbang.app/xiaojianbang_persist
        File enableFile = new File(SETTINGS_DIR, pkgName + File.separator + ENABLE_PERSIST_FILE_NAME);
        return enableFile.exists();
    }
    // 获取源JS文件路径
    private static File getConfigJSPath(String pkgName) {
        // /data/system/xsettings/xiaojianbang/jscfg/com.xiaojianbang.app/config.js
        return new File(CONFIG_JS_DIR, pkgName + File.separator + CONFIG_JS_FILE_NAME);
    }
    // 拷贝源JS文件到app私有目录
    private static File copyJSFile(Context context, String pkgName) {
        // 判断源JS文件是否存在
        File srcJSFile = getConfigJSPath(pkgName);
        if(!srcJSFile.exists()) {
            LOGD("srcJSFile not exists");
            return null;
        }
        // 拷贝源JS文件到app私有目录
        // /data/data/com.xiaojianbang.app/files/config.js
        File dstJSFile = new File(context.getFilesDir(), CONFIG_JS_FILE_NAME);
        boolean isCopyJSOk = copyFile(srcJSFile, dstJSFile);
        if(!isCopyJSOk){
            LOGD("copyJSFile fail: " + srcJSFile + " -> " + dstJSFile);
            return null;
        }
        return dstJSFile;
    }
    // 生成Gadget配置文件
    private static boolean genGadgetConfig(Context context, File dstJSFile) {
        JSONObject jsonObject = new JSONObject();
        JSONObject childObj = new JSONObject();
        try {
            childObj.put("type", "script");
            childObj.put("path", dstJSFile.toString());
            jsonObject.put("interaction", childObj);
        }catch (Exception e){
            e.printStackTrace();
return false;
        }
        String configFilePath = context.getFilesDir() + File.separator + SO_CONFIG_NAME;
        boolean isSaveOk = saveFile(configFilePath, jsonObject.toString());
        if(!isSaveOk){
            LOGD("saveFile fail: " + configFilePath);
            return false;
        }
        return true;
    }
    // 拷贝源so文件到app私有目录
    private static File copySoFile(Context context) {
        // 判断源so文件是否存在
        // /system/lib/libxiaojianbang.so
        // /system/lib64/libxiaojianbang.so
        File srcSoFile = new File(LIB32_DIR, SO_NAME);
        if(Process.is64Bit()) {
            srcSoFile = new File(LIB64_DIR, SO_NAME);
        }
        if(!srcSoFile.exists()) {
            LOGD("srcSoFile not exists");
            return null;
        }
        // 拷贝源so文件到app私有目录
        // /data/data/com.xiaojianbang.app/files/libxiaojianbang.so
        File dstSoFile = new File(context.getFilesDir(), SO_NAME);
        if(srcSoFile.length() != dstSoFile.length()) {
            boolean isCopyFileOk = copyFile(srcSoFile, dstSoFile);
            if(!isCopyFileOk){
                LOGD("copySoFile fail: " + srcSoFile + " -> " + dstSoFile);
                return null;
            }
        }
        return dstSoFile;
    }
    // 进行Frida Gadget持久化
    public static boolean doXiaojianbangPersist(Context context, String pkgName) {
        File dstJSFile = copyJSFile(context, pkgName);
        if(null == dstJSFile) return false;
        if(!genGadgetConfig(context, dstJSFile)) return false;
        File dstSoFile = copySoFile(context);
        if(null == dstSoFile) return false;
        System.load(dstSoFile.toString());
        return true;
    }

}

/data/system/xsettings/xiaojianbang/persist/com.xiaojianbang.app/xiaojianbang_persist

mkdir /data/system/xsettings 0775 system system
mkdir /data/system/xsettings/xiaojianbang 0775 system system
mkdir /data/system/xsettings/xiaojianbang/persist 0775 system system
mkdir /data/system/xsettings/xiaojianbang/jscfg 0775 system system

/data/system/xsettings/xiaojianbang/jscfg/pkgName/config.js