Android bypass normal system api to communicate with system service

I will use one specific api, TelephonyManager.getDeviceId, as an example.What I want to implement is bypass TelephonyManager.getDeviceId but still get device's imei. I am new to Java and Android. Java reflection with Android binder is really something cause headache...

I looked into TelephonyManager source code, found that it is do its stuff via IPhoneSubinfo.TelephonyManager souce code

For example, getDeviceId, its code in TelephonyManager is mostly

{return getSubscriberInfo().getDeviceId();} 

and getSubscriberInfo is mostly(it actually returns a binder proxy.)

{return IPhoneSubInfo.Stub.asInterface(ServiceManager.getService("iphonesubinfo"));}

Here is what i am trying to do:

step1, get a TelephonyManager instance.

step2, use reflection to get TelephonyManger's private method getSubscriberInfo, set accessible, then invoke this method to get a IPoneSubInfo instance.

step3, use reflection to get IPhoneSubInfo's public method getDeviceId, invoke this method to get deviceid.

During this, TelephonyManager's getDeviceId is never called, that's what i want to do.But in step3, the returned deviceid from IphoneSubInfo's getDeviceId, is null...and null.toString() raises Exception.

What is wrong? and if there are some doc or blogpost on this topic is welcomed.

All Code Here, Code Tells Everything:

    TelephonyManager tel = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);

try {
    Method TelephonyManager_private_getSubscriberInfo = tel.getClass().getDeclaredMethod("getSubscriberInfo");
    TelephonyManager_private_getSubscriberInfo.setAccessible(true);

    Object iphonesubinfo = TelephonyManager_private_getSubscriberInfo.invoke(tel);
    log(iphonesubinfo.toString());

    Method getDeviceId = iphonesubinfo.getClass().getDeclaredMethod("getDeviceId");
    log(getDeviceId.toString());
    getDeviceId.setAccessible(true);

    Object deviceid = getDeviceId.invoke(iphonesubinfo);   // why di is null :(
    log("deviceid:" + deviceid.toString());
}catch (NoSuchMethodException e){
    log("TelephonyManager_private_getSubscriberInfo noSuchMethodException");
    e.printStackTrace();
}catch (IllegalAccessException e){
    log("TelephonyManager_private_getSubscriberInfo IllegalAccessException");
    e.printStackTrace();
}catch (InvocationTargetException e){
    log("TelephonyManager_private_getSubscriberInfo InvocationTargetException");
    e.printStackTrace();
}