monkey位于/system/bin目录下。内容为：

# Script to start "monkey" on the device, which has a very rudimentary# shell.#base=/systemexport CLASSPATH=$base/framework/monkey.jartrap "" HUPexec app_process $base/bin com.android.commands.monkey.Monkey $*

 

改造内容：

编译安卓源码，改动monkey源码，生成monkey.jar 放在/data目录

export CLASSPATH=/data/monkey.jar

trap "" HUP

exec app_process $base/bin com.android.commands.monkey.Monkey $*

 

运行命令：/system/bin/sh /data/monkey.jar -p xxxxxx

 

命令输入启动后进入：

public static void main(String[] args) {// Set the process name showing in "ps" or "top"Process.setArgV0("com.android.commands.monkey");int resultCode = (new Monkey()).run(args);System.exit(resultCode);}

具体run：运行前的准备

private int run(String[] args) {    processOptions();//处理参数    loadPackageLists();//加载黑白名单，可测的有效包名       getSystemInterfaces();//获取系统接口，都是系统的隐藏接口。    //mAm = ActivityManagerNative.getDefault();    //这里返回了一个ActivityManagerProxy对象,用来执行mangerservice接口。     //mWm = IWindowManager.Stub.asInterface(ServiceManager.getService("window"));        //上面，获取了系统窗口服务    //mPm = IPackageManager.Stub.asInterface(ServiceManager.getService("package"));       getMainApps();//获取要执行的activity    mEventSource = new MonkeySourceRandom(mRandom, mMainApps,                    mThrottle, mRandomizeThrottle, mPermissionTargetSystem);//产生一个随机事件    ((MonkeySourceRandom) mEventSource).setFactors(i, mFactors[i]);    mEventSource.validate();//验证事件，并调整比例    mNetworkMonitor.start();//监听网络变化    crashedAtCycle = runMonkeyCycles();//monkey核心逻辑}

 

重点1：随机事件

下面为默认的分发机制，当日可以通过命令的参数来修改，如果没指定将按默认运行

public MonkeySourceRandom(Random random, ArrayList
     
       MainApps,            long throttle, boolean randomizeThrottle, Display display) {        // default values for random distributions        // note, these are straight percentages, to match user input (cmd line        // args)        // but they will be converted to 0..1 values before the main loop runs.        mFactors[FACTOR_TOUCH] = 47.0f;        mFactors[FACTOR_MOTION] = 10.0f;        mFactors[FACTOR_TRACKBALL] = 30.0f;        mFactors[FACTOR_NAV] = 0.0f;        mFactors[FACTOR_MAJORNAV] = 5.0f;        mFactors[FACTOR_SYSOPS] = 2.0f;        mFactors[FACTOR_APPSWITCH] = 0.0f;        mFactors[FACTOR_FLIP] = 1.0f;        mFactors[FACTOR_ANYTHING] = 3.0f;        mFactors[FACTOR_PINCHZOOM] = 2.0f;        mRandom = random;        mMainApps = MainApps;        mQ = new MonkeyEventQueue(random, throttle, randomizeThrottle);        mDisplay = display;    }
     

 

重点2：获取随机事件后如何点击？

int injectCode = ev.injectEvent(mWm, mAm, mVerbose);

主要是：

InputManager.getInstance().injectInputEvent(me,InputManager.INJECT_INPUT_EVENT_MODE_WAIT_FOR_RESULT)) {                return MonkeyEvent.INJECT_FAIL;

详细：

@Override    public int injectEvent(IWindowManager iwm, IActivityManager iam, int verbose) {        MotionEvent me = getEvent();        if ((verbose > 0 && !mIntermediateNote) || verbose > 1) {            StringBuilder msg = new StringBuilder(":Sending ");            msg.append(getTypeLabel()).append(" (");            switch (me.getActionMasked()) {                case MotionEvent.ACTION_DOWN:                    msg.append("ACTION_DOWN");                    break;                case MotionEvent.ACTION_MOVE:                    msg.append("ACTION_MOVE");                    break;                case MotionEvent.ACTION_UP:                    msg.append("ACTION_UP");                    break;                case MotionEvent.ACTION_CANCEL:                    msg.append("ACTION_CANCEL");                    break;                case MotionEvent.ACTION_POINTER_DOWN:                    msg.append("ACTION_POINTER_DOWN ").append(me.getPointerId(me.getActionIndex()));                    break;                case MotionEvent.ACTION_POINTER_UP:                    msg.append("ACTION_POINTER_UP ").append(me.getPointerId(me.getActionIndex()));                    break;                default:                    msg.append(me.getAction());                    break;            }            msg.append("):");            int pointerCount = me.getPointerCount();            for (int i = 0; i < pointerCount; i++) {                msg.append(" ").append(me.getPointerId(i));                msg.append(":(").append(me.getX(i)).append(",").append(me.getY(i)).append(")");            }            System.out.println(msg.toString());        }        try {            //InputManager.getInstance返回input manager的实例            //Injects an input event into the event system on behalf of an application            //注入事件            if (!InputManager.getInstance().injectInputEvent(me,                    InputManager.INJECT_INPUT_EVENT_MODE_WAIT_FOR_RESULT)) {                return MonkeyEvent.INJECT_FAIL;            }        } finally {            me.recycle();        }        return MonkeyEvent.INJECT_SUCCESS;    }

MonkeyRotationEvent（旋转屏幕）：

public int injectEvent(IWindowManager iwm, IActivityManager iam, int verbose) MonkeyRotationEvent  --  使用iwm.freezeRotation(mRotationDegree);来实现旋转屏幕。

 

重点3：monkeyresult如何产生

在事件循环点击的时候，每个循环都会监控是否产生了ANR/CRASH

while (!systemCrashed && cycleCounter < mCount) {    //检查是否发生了ANR    if (mRequestAnrBugreport){        getBugreport("anr_" + mReportProcessName + "_");        mRequestAnrBugreport = false;    }    //检查系统watchdog是否报告bug     if (mRequestWatchdogBugreport) {         System.out.println("Print the watchdog report");         getBugreport("anr_watchdog_");         mRequestWatchdogBugreport = false;     }    //检查是否发生了CRASH    if (mRequestAppCrashBugreport){        getBugreport("app_crash" + mReportProcessName + "_");        mRequestAppCrashBugreport = false;    }    //检查bugreport报告生成     if (mRequestPeriodicBugreport){         getBugreport("Bugreport_");         mRequestPeriodicBugreport = false;     }    //报告系统信息，ANR时出发     if (mRequestDumpsysMemInfo) {         mRequestDumpsysMemInfo = false;         shouldReportDumpsysMemInfo = true;     }    //获取下一个随机时间    MonkeyEvent ev = mEventSource.getNextEvent();        //注入事件     int injectCode = ev.injectEvent(mWm, mAm, mVerbose);}