Comparison of Android Hot Patch Solutions: Dexposed, AndFix, and ClassLoader

Recently, the open‑source community has produced several hot‑patch projects for Android, mainly Dexposed, AndFix, and a ClassLoader‑based solution originally from Tencent's QZone team. Although they share the same goal, their underlying mechanisms differ significantly.

Dexposed

Dexposed is an AOP‑style framework built on Xposed, allowing method‑level hooking, instrumentation, hot‑patching, and SDK hooking. Xposed requires root to modify system behavior, but Dexposed can operate without root for a single app by hooking the Zygote process and injecting code via the Xposed Bridge.

During app startup, the Zygote process forks and loads classes; Dexposed replaces app_process and hooks entry‑point methods such as handleBindApplication , ServerThread , and ActivityThread . The native hook implementation registers callbacks in libxposed_common.cpp and forwards calls to Dalvik or ART libraries.

Method‑level replacement allows inserting code before or after a method, or completely replacing it, but only for Java methods—not native C methods.

Limitations : Dexposed does not support ART (Android 5.0+), despite roadmap claims, and writing patches for obfuscated releases can be painful due to reflection and name conflicts.

Example native hook signature:

private native synchronized static void hookMethodNative(Member method, Class
declaringClass, int slot, Object additionalInfo);

AndFix

AndFix also performs method hooking but starts from fields rather than methods. The main entry point is AndFixManager.fix :

public synchronized void fix(File file, ClassLoader classLoader, List
classes) { /* implementation omitted for brevity */ }

AndFix creates a custom ClassLoader to load patched classes, iterates over the dex entries, and applies replacements via annotations. The core replacement logic resides in fixClass and replaceMethod :

private void fixClass(Class
clazz, ClassLoader classLoader) { /* iterate methods, find @MethodReplace, call replaceMethod */ }

private void replaceMethod(ClassLoader classLoader, String clz, String meth, Method method) { /* JNI bridge to ART/Dalvik for actual method swap */ }

On Dalvik and ART, the native side performs method pointer swaps, e.g., for Android 6.0:

void replace_6_0(JNIEnv* env, jobject src, jobject dest) { /* copy ArtMethod fields from src to dest */ }

void setFieldFlag_6_0(JNIEnv* env, jobject field) { /* make fields public via access flag manipulation */ }

AndFix supports Android 2.3‑6.0, applies patches without restarting the app, but may encounter issues with static initializers, constructors, or complex class loading.

ClassLoader‑Based Hot Patch

The ClassLoader approach, invented by Tencent QZone engineer Chen Zhong, leverages the multidex mechanism. By inserting a patched dex at the beginning of the dexElements array, the VM loads the corrected classes first.

public Class findClass(String name, List<Throwable> suppressed) { for (Element element : dexElements) { DexFile dex = element.dexFile; if (dex != null) { Class clazz = dex.loadClassBinaryName(name, definingContext, suppressed); if (clazz != null) return clazz; } } /* handle suppressed exceptions */ return null; }

To avoid pre‑verification errors, the solution modifies the bytecode (using JavaAssist) to insert a reference to the patched class in the Application constructor, ensuring the class is considered verified.

Open‑source implementations include Nuwa, HotFix, and DroidFix.

Comparison

Dexposed lacks ART support and requires complex patch writing for obfuscated code. AndFix works on Android 2.3‑6.0, offers a simpler implementation, but may fail with static members or constructors. The ClassLoader method is the most reliable across versions, though patches only take effect after the next app launch.

In summary, for maximum compatibility choose the ClassLoader approach; for no‑restart hot fixing with simple patches consider AndFix; Dexposed remains attractive for its extensive Xposed ecosystem but currently cannot handle ART.

Source: markzhai's blog (http://blog.zhaiyifan.cn/2015/11/20/HotPatchCompare/). This is a repost with attribution.