AppStore搜索框内容设置以及点击Search

（一）从命令行打开AppStore后，如何切到搜索界面

     界面下方一个 UITabBar，包含了五个 UITabBarButton，可以通过其 UITabBarButtonLabel来确定search的button地址。通过对 UITabBarButton的响应者的追踪，怀疑是 SKUITabBarController。在lldb中下断点试一下。

(lldb) thread  backtrace

* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.17

  * frame #0: 0x000000018f1c9194 StoreKitUI`-[SKUITabBarController setTransientViewController:animated:]

    frame #1: 0x0000000188bfb538 UIKit`-[UITabBarController _tabBarItemClicked:] + 496

    frame #2: 0x0000000188a23e50 UIKit`-[UIApplication sendAction:to:from:forEvent:] + 100

    frame #3: 0x0000000188bfb2f8 UIKit`-[UITabBar _sendAction:withEvent:] + 476

    frame #4: 0x0000000188a23e50 UIKit`-[UIApplication sendAction:to:from:forEvent:] + 100

    frame #5: 0x0000000188a23dcc UIKit`-[UIControl sendAction:to:forEvent:] + 80

    frame #6: 0x0000000188a0ba88 UIKit`-[UIControl _sendActionsForEvents:withEvent:] + 416

    frame #7: 0x0000000188bfaf60 UIKit`-[UITabBar(Static) _buttonUp:] + 112

    frame #8: 0x0000000188a23e50 UIKit`-[UIApplication sendAction:to:from:forEvent:] + 100

    frame #9: 0x0000000188a23dcc UIKit`-[UIControl sendAction:to:forEvent:] + 80

    frame #10: 0x0000000188a0ba88 UIKit`-[UIControl _sendActionsForEvents:withEvent:] + 416

    frame #11: 0x0000000188a236e4 UIKit`-[UIControl touchesEnded:withEvent:] + 572

    frame #12: 0x00000001889dc294 UIKit`_UIGestureRecognizerUpdate + 8988

    frame #13: 0x0000000183cb0588 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 32

    frame #14: 0x0000000183cae32c CoreFoundation`__CFRunLoopDoObservers + 372

    frame #15: 0x0000000183cae75c CoreFoundation`__CFRunLoopRun + 928

    frame #16: 0x0000000183bdd680 CoreFoundation`CFRunLoopRunSpecific + 384

    frame #17: 0x00000001850ec088 GraphicsServices`GSEventRunModal + 180

    frame #18: 0x0000000188a54d90 UIKit`UIApplicationMain + 204

    frame #19: 0x0000000100082c48 AppStore`_mh_execute_header + 11336

    frame #20: 0x000000018377e8b8 libdyld.dylib`start + 4

先来验证frame #0。

        x0 = 0x0000000125033400   <SKUITabBarController: 0x125033400>

        x1 = 0x000000018940a250  "setTransientViewController:animated:"

        x2 = 0x0000000000000000

        x3 = 0x0000000000000001

在 cycript中试着调用一下。

cy# [#0x125033400 setTransientViewController:0x0 animated:0x1]

throw #"-[__NSCFNumber parentViewController]: unrecognized selector sent to instance 0xb000000000000005 ”

应该与其他寄存器值相关。暂不作此打算。

其次，验证frame #1。

        x0 = 0x0000000125033400   <SKUITabBarController: 0x125033400>

        x1 = 0x000000018940a1a9  "_tabBarItemClicked:"

        x2 = 0x00000001246ccc40   <UITabBarItem: 0x1246ccc40>

查看下 UITabBarItem：

lldb) po [0x1246ccc40 _ivarDescription]

<UITabBarItem: 0x1246ccc40>:

in UITabBarItem:

    _title (NSString*): @"Search"<NSTaggedPointerString: 0xa006863726165536>

    _action (SEL): _tabBarItemClicked:

    _target (id): <SKUITabBarController: 0x125033400>

        ……

cy# choose(UITabBarItem)

[#"<UITabBarItem: 0x134eb0e20>",#"<UITabBarItem: 0x134eb8f30>",#"<UITabBarItem: 0x134eb96f0>",#"<UITabBarItem: 0x134ebe0b0>",#"<UITabBarItem: 0x134ebe160>",#"<UITabBarItem: 0x134fc52e0>”]

获取 UITabBarItem的数组后，查看其_title：

cy# #0x134eb0e20->_title

@“Featured"

直到捕捉到title为Search的那个,用它来构造[UITabBarController _tabBarItemClicked:]请求。成功。

---

(二) 在AppStore搜索界面，设置搜索关键词，并进行搜索

(lldb) thread backtrace

* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 2.43

  * frame #0: 0x000000018f2c8048 StoreKitUI`-[SKUISearchBarController _dispatchSubmitEventWithText:URL:searchHintOriginalTerm:searchHintIndex:]

    frame #1: 0x000000018f2c78e8 StoreKitUI`-[SKUISearchBarController searchFieldController:requestSearch:] + 200

    frame #2: 0x000000018f22368c StoreKitUI`-[SKUISearchFieldController _loadResultsForSearchRequest:] + 124

    frame #3: 0x000000018f222a28 StoreKitUI`-[SKUISearchFieldController searchBarSearchButtonClicked:] + 160

     frame #4: 0x0000000188ed5f04 UIKit`-[UISearchBar(UISearchBarStatic) _searchFieldReturnPressed] + 112

    frame #5: 0x0000000188a23e50 UIKit`-[UIApplication sendAction:to:from:forEvent:] + 100

    frame #6: 0x0000000188a23dcc UIKit`-[UIControl sendAction:to:forEvent:] + 80

    frame #7: 0x0000000188a0ba88 UIKit`-[UIControl _sendActionsForEvents:withEvent:] + 416

    frame #8: 0x0000000188d538d0 UIKit`-[UIFieldEditor insertFilteredText:] + 276

    frame #9: 0x0000000189339b20 UIKit`-[UITextField insertFilteredText:] + 104

    frame #10: 0x0000000188bc2e70 UIKit`-[UIKeyboardImpl insertText:] + 136

    frame #11: 0x0000000188e00c90 UIKit`-[UIKeyboardImpl performKeyboardOutput:] + 508

    frame #12: 0x0000000188e00854 UIKit`__55-[UIKeyboardImpl handleKeyboardInput:executionContext:]_block_invoke_2 + 172

    frame #13: 0x0000000188a16e84 UIKit`-[UIKeyboardTaskQueue continueExecutionOnMainThread] + 344

    frame #14: 0x00000001846bbe20 Foundation`__NSThreadPerformPerform + 340

    frame #15: 0x0000000183cb0efc CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24

    frame #16: 0x0000000183cb0990 CoreFoundation`__CFRunLoopDoSources0 + 540

    frame #17: 0x0000000183cae690 CoreFoundation`__CFRunLoopRun + 724

    frame #18: 0x0000000183bdd680 CoreFoundation`CFRunLoopRunSpecific + 384

    frame #19: 0x00000001850ec088 GraphicsServices`GSEventRunModal + 180

    frame #20: 0x0000000188a54d90 UIKit`UIApplicationMain + 204

    frame #21: 0x00000001000cec48 AppStore`_mh_execute_header + 11336

    frame #22: 0x000000018377e8b8 libdyld.dylib`start + 4

1. 获取SKUISearchBar的地址。choose(SKUISearchBar)容易崩（具体来说是，第一次可以用，此后一律会崩）。建议还是在UIApp.keyWindow.recursiveDescription().toString()的结果中过滤。
2. [SKUISearchBar_addr setText:”search_key_word”]
3. [SKUISearchBar_addr _searchFieldReturnPressed]