android invoke hidden API

String classpath = "android.content.pm.parsing.ParsingPackageUtils";
getAssistClass(classpath).getDeclaredMethod("readKeySetMapping", Parcel.class);

报错，接口被hidden

01-20 10:31:53.467  3929  3964 W eHandlerServic: Accessing hidden method Landroid/content/pm/parsing/ParsingPackageUtils;->readKeySetMapping(Landroid/os/Parcel;)Landroid/util/ArrayMap; (blacklist, reflection, denied)
01-20 10:31:53.469  3929  3964 E CVE_2021_0921: Get method Failed
01-20 10:31:53.469  3929  3964 E CVE_2021_0921: java.lang.NoSuchMethodException: android.content.pm.parsing.ParsingPackageUtils.readKeySetMapping [class android.os.Parcel]
01-20 10:31:53.469  3929  3964 E CVE_2021_0921: 	at java.lang.class.getmethod(Class.java:2072)
01-20 10:31:53.469  3929  3964 E CVE_2021_0921: 	at java.lang.class.getDeclaredMethod(Class.java:2050)

这种情况可以：

1.直接用invoke，例子如下

String classpath = "android.content.pm.parsing.ParsingPackageUtils";
Method getDeclaredMethod = Class.class.getDeclaredMethod("getDeclaredMethod", String.class, Class[].class);
getDeclaredMethod.invoke(getAssistClass(classpath),"readKeySetMapping", new Class[]{Parcel.class});

2.使用vmruntime的setHiddenApiExemptions豁免所有hidden接口，例子如下

// 豁免所有hidden接口
Method getDeclaredMethod = Class.class.getDeclaredMethod("getDeclaredMethod", String.class, Class[].class);
Class<?> vmruntimeClass = getAssistClass("dalvik.system.vmruntime");
Method setHiddenApiExemptions = (Method) getDeclaredMethod.invoke(vmruntimeClass, "setHiddenApiExemptions", new Class[]{String[].class});
setHiddenApiExemptions.setAccessible(true);
//获取vmruntime类对象实例
vmruntime objRuntime = vmruntime.getRuntime();
//setHiddenApiExemptions是hidden接口，只能用反射
setHiddenApiExemptions.invoke(objRuntime,new Object[]{new String[]{"L"}});
Log.d(TAG, "invoke ok");