a.apk-主利用 b.apk-被启动利用
次要思维：把b.apk放到assets目录下，因为有大小限度（1M），所以改名成b.mp3(因为mp3,jpg,png,mp4等不会查看，不会限度大小)，而后在用的时候再改回来
1.具体实现：
public void intallApp(Context context) {try {String path = context.getFilesDir().getAbsolutePath()+ "/b.apk"; //从assets中解压到这个目录File f = new File(path);if (!f.exists()) {f.createNewFile();}InputStream is = context.getAssets().open("b.mp3");//assets里的文件在利用装置后依然存在于apk文件中inputStreamToFile(is, f);String cmd = "chmod 777 " + f.getAbsolutePath();Runtime.getRuntime().exec(cmd);cmd = "chmod 777 " + f.getParent();Runtime.getRuntime().exec(cmd);// 尝试晋升上2级的父文件夹权限，在浏览插件下载到手机存储时，刚好用到了2级目录// /data/data/packagename/files/这个目录上面所有的层级目录都须要晋升权限，才可装置apk，弹出装置界面cmd = "chmod 777 " + new File(f.getParent()).getParent();Runtime.getRuntime().exec(cmd);Intent intent = new Intent();intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);intent.setAction(android.content.Intent.ACTION_VIEW);String type = "application/vnd.android.package-archive";/* 设置intent的file与MimeType */intent.setDataAndType(Uri.fromFile(f), type);context.startActivity(intent);} catch (ActivityNotFoundException e) {e.printStackTrace();} catch (IOException e) {e.printStackTrace();}}public void inputStreamToFile(InputStream inputStream,File file){///InputStream inputStream = null;OutputStream outputStream = null;try {// read this file into InputStream//inputStream = new FileInputStream("test.txt"); // write the inputStream to a FileOutputStreamoutputStream = new FileOutputStream(file); int read = 0;byte[] bytes = new byte[1024]; while ((read = inputStream.read(bytes)) != -1) {outputStream.write(bytes, 0, read);} System.out.println("Done!"); } catch (IOException e) {e.printStackTrace();} finally {if (inputStream != null) {try {inputStream.close();} catch (IOException e) {e.printStackTrace();}}if (outputStream != null) {try {// outputStream.flush();outputStream.close();} catch (IOException e) {e.printStackTrace();} }}}2.如果是启动已装置的利用，实现如下：
public boolean startApp(Context context, String packageName) {//String packageName = "XXX";Intent intent = new Intent(Intent.ACTION_MAIN, null);intent.addCategory(Intent.CATEGORY_LAUNCHER);PackageManager pm = context.getPackageManager();List<ResolveInfo> listInfos = pm.queryIntentActivities(intent, 0);String className = null;for (ResolveInfo info : listInfos) {if (packageName.equals(info.activityInfo.packageName)) {className = info.activityInfo.name;break;}}if (className != null && className.length() > 0) {intent.setComponent(new ComponentName(packageName, className));intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK| Intent.FLAG_ACTIVITY_RESET_TASK_IF_NEEDED);context.startActivity(intent);return true;}return false;}如果你晓得包名,还晓得作为启动的那activity的类名，就更简略了，就能够省掉下面查找的过程，间接启动。