一点一点补全

android的ActivityManagerService作为管理activity的实际类，包含了activity实际运行用到的所有方法
其中崩溃的上报就在这里，方法：

public void More ...handleApplicationCrash(IBinder app, ApplicationErrorReport.CrashInfo crashInfo)

就是当dalvik虚拟机在捕获到app异常时调用的处理函数
在其介绍中可以看到这点，

Used by com.android.internal.os.RuntimeInit
 to report when an application crashes. The application process will exit immediately after this call returns.
Parameters:
app
 object of the crashing app, null for the system server
crashInfo
 describing the exception

函数的调用顺序如下：

handleApplicationCrash
handleApplicationCrashInner
private void crashApplication(ProcessRecord r, ApplicationErrorReport crashInfo)

对于native层，在AMS初始化时会调用

public void startObservingNativeCrashes() {
        final NativeCrashListener ncl = new NativeCrashListener(this);
        ncl.start();
 }

进行初始化，由于在NativeCrashListener传入了this也就是AMS实例
所以捕获到native崩溃时，也会传给AMS，如下

         @Override
75         public void run() {
76             try {
77                 CrashInfo ci = new CrashInfo();
78                 ci.exceptionClassName = "Native crash";
79                 ci.exceptionMessage = Os.strsignal(mSignal);
80                 ci.throwFileName = "unknown";
81                 ci.throwClassName = "unknown";
82                 ci.throwMethodName = "unknown";
83                 ci.stackTrace = mCrashReport;
84 
85                 if (DEBUG) Slog.v(TAG, "Calling handleApplicationCrash()");
86                 mAm.handleApplicationCrashInner("native_crash", mApp, mApp.processName, ci);
87                 if (DEBUG) Slog.v(TAG, "<-- handleApplicationCrash() returned");
88             } catch (Exception e) {
89                 Slog.e(TAG, "Unable to report native crash", e);
90             }
91         }

在测试时，可以通过xposed等hook框架hook到AMS的crashApplication函数上，在通过uid进行过滤，实现被测APP的崩溃实时监控
同理，ANR可以通过hook到AMS的函数进行实时抓取日志

源文件：
[1] .http://grepcode.com/file/repository.grepcode.com/java/ext/com.google.android/android/5.1.1_r1/com/android/server/am/ActivityManagerService.java#ActivityManagerService