Android P版本。
解决方案如下:

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.javaindex 4f09f6e..e6f2f19 100644--- a/services/core/java/com/android/server/pm/PackageManagerService.java+++ b/services/core/java/com/android/server/pm/PackageManagerService.java@@ -2652,6 +2652,14 @@ public class PackageManagerService extends IPackageManager.Stub                     | SCAN_AS_SYSTEM,                     0); +            final File preloadAppDir = new File(Environment.getRootDirectory(), "preloadapp");+            scanDirTracedLI(preloadAppDir,+                    mDefParseFlags+                    | PackageParser.PARSE_IS_SYSTEM_DIR,+                    scanFlags+                    | SCAN_AS_SYSTEM,+                    0);+             // Collect privileged vendor packages.             File privilegedVendorAppDir = new File(Environment.getVendorDirectory(), "priv-app");

测试如下:将ES文件管理器放到上面目录,下面代码批改之后,m services后替换services各组件,而后重启服务,之后能看到launcher中存在ES文件管理器,且能失常应用。
/system/preloadapp/cs/es-file-explorer-4-2-6-2-1.apk

替换services各组件命令:
adb root
adb remount
adb push X:\system\framework\oat\arm64\services.vdex /system/framework/oat/arm64/
adb push X:\system\framework\oat\arm64\services.odex /system/framework/oat/arm64/
adb push X:\system\framework\oat\arm64\services.art /system/framework/oat/arm64/
adb push X:\system\framework\services.jar.prof /system/framework/
adb push X:\system\framework\services.jar /system/framework/
adb shell sync
adb shell stop
adb shell start