摸索了一天，Method.invoke() 会无限套娃，不知道还有没有其他方法。

public class MainHook implements IXposedHookLoadPackage {

    @Override
    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {

        // 要 Hook 的子类
        Class<?> clazzActivity = XposedHelpers.findClassIfExists(
            "com.example.MainActivity",
            lpparam.classLoader
        );

        // 要 Hook 的父类
        Class<?> clazzSuperActivity = clazzActivity.getSuperclass();

        // Hook 父类方法
        XposedHelpers.findAndHookMethod(clazzSuperActivity,
                "onCreate", Bundle.class,
                new XC_MethodHook() {});

        // Hook 子类方法
        XposedHelpers.findAndHookMethod(clazzActivity,
                "onCreate", Bundle.class,
                new XC_MethodHook() {
                    @Override
                    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                        param.setResult(null);
                        Method method = clazzSuperActivity.getDeclaredMethod("onCreate", Bundle.class);
                        XposedBridge.invokeOriginalMethod(method, param.thisObject, param.args);
                    }
                });
    }
}