Step-by-Step Guide to Building Your Own Android Hotfix Framework

Hotfixing allows developers to fix bugs after an app is released by delivering a patch instead of a full APK. Android uses the Dalvik/ART virtual machine, which loads .dex files via ClassLoader. The article first explains the difference between BaseDexClassLoader, PathClassLoader, and DexClassLoader, showing their source locations.

Hotfix Architecture

Two major approaches exist: native‑level method‑table replacement (e.g., AndFix, Sophix) and Java‑level class replacement (e.g., Tinker, Robust). The tutorial focuses on the Java‑level approach, which requires an app restart.

Creating a Buggy Class

package com.example.bthvi.mycloassloaderapplication.xxx;

import android.content.Context;
import android.widget.Toast;

/**
 * Bug test class
 */
public class BugClass {
    public BugClass(Context context) {
        Toast.makeText(context, "This is a beautiful bug!", Toast.LENGTH_SHORT).show();
    }
}

Core Hotfix Utility (FixDexUtil)

The utility defines constants for file suffixes, directories, and a HashSet<File> to store discovered patch files. Key methods include: loadFixedDex(Context) – overload that calls the main loader with a null patch directory. loadFixedDex(Context, File) – triggers doDexInject to merge patch dex files. isGoingToFix(@NonNull Context) – scans a designated directory (default 007 or files/odex) for files whose names start with classes and end with .dex, .apk, .jar, or .zip. Returns true if any are found. doDexInject(Context, HashSet<File>) – obtains the app’s PathClassLoader, creates a DexClassLoader for each patch, and merges their dexElements arrays into the original loader via reflection.

Reflection helpers getField, setField, getPathList, getDexElements, and combineArray handle the low‑level array manipulation.

Integrating Hotfix Check in Splash Activity

private void init() {
    File externalStorageDirectory = Environment.getExternalStorageDirectory();
    File fileDir = externalStorageDirectory != null ?
            new File(externalStorageDirectory, "007") :
            new File(getFilesDir(), FixDexUtil.DEX_DIR);
    if (!fileDir.exists()) {
        fileDir.mkdirs();
    }
    if (FixDexUtil.isGoingToFix(this)) {
        FixDexUtil.loadFixedDex(this, Environment.getExternalStorageDirectory());
        textView.setText("Applying fix...");
    }
    new Handler().postDelayed(() -> {
        startActivity(new Intent(SplashActivity.this, MainActivity.class));
        finish();
    }, 3000);
}

Before the fix, the app shows the buggy toast; after applying the patch, the corrected toast appears.

Generating the Patch Dex

Disable Instant Run in Android Studio.

Rebuild the project ( Build → Rebuild Project) and locate the compiled .class file in app/build/intermediates/debug/<package>.

Use the Android SDK dx tool to convert the class to a dex file:

dx --dex /output/path/classes.dex /path/to/modified/class

Copy the resulting .dex file to the patch directory (e.g., 007).

Restart the app; the bug should be fixed.

Troubleshooting

If the fix does not apply, ensure that the patch file name starts with classes and ends with .dex, as the isGoingToFix method filters files based on this pattern.

References

Android source:

libcore/dalvik/src/main/java/dalvik/system/BaseDexClassLoader.java

Related articles: Flutter introduction, custom HashMap implementation (links omitted for brevity).