要获取Android的/data/system/packages.xml证书数据，可以通过以下代码示例来实现：

try {
    // 获取PackageManagerService的实例
    Class serviceManagerClass = Class.forName("android.os.ServiceManager");
    Method getServiceMethod = serviceManagerClass.getMethod("getService", String.class);
    IBinder packageManagerBinder = (IBinder) getServiceMethod.invoke(null, "package");

    // 获取PackageManager的代理对象
    Class packageManagerClass = Class.forName("android.content.pm.IPackageManager");
    Class packageManagerProxyClass = Class.forName("android.content.pm.PackageManagerProxy");
    Constructor packageManagerProxyConstructor = packageManagerProxyClass.getConstructor(IBinder.class);
    Object packageManagerProxy = packageManagerProxyConstructor.newInstance(packageManagerBinder);

    // 获取PackageManager的getPackageInfo方法
    Class packageManagerClass = Class.forName("android.content.pm.IPackageManager");
    Method getPackageInfoMethod = packageManagerClass.getMethod("getPackageInfo", String.class, int.class);
    
    // 调用getPackageInfo方法获取PackageInfo对象
    String packageName = "com.example.app"; // 指定要获取证书数据的应用程序包名
    int flags = PackageManager.GET_SIGNATURES; // 获取应用程序的签名数据
    Object packageInfo = getPackageInfoMethod.invoke(packageManagerProxy, packageName, flags);

    // 获取PackageInfo的signatures字段
    Field signaturesField = packageInfo.getClass().getField("signatures");
    Signature[] signatures = (Signature[]) signaturesField.get(packageInfo);

    // 输出证书信息
    for (Signature signature : signatures) {
        byte[] certBytes = signature.toByteArray();
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X509");
        ByteArrayInputStream inputStream = new ByteArrayInputStream(certBytes);
        X509Certificate cert = (X509Certificate) certificateFactory.generateCertificate(inputStream);
        // 可以根据需要获取证书的各种信息，比如公钥、序列号等
        PublicKey publicKey = cert.getPublicKey();
        String serialNumber = cert.getSerialNumber().toString();
        // 输出证书信息
        System.out.println("Public key: " + publicKey);
        System.out.println("Serial number: " + serialNumber);
    }
} catch (ClassNotFoundException | NoSuchMethodException | IllegalAccessException |
        InstantiationException | InvocationTargetException | NoSuchFieldException |
        CertificateException e) {
    e.printStackTrace();
}

请注意，上述代码示例仅为演示目的，实际使用时可能需要适配不同的Android版本和设备。