1. _dyld_start入口函数
在一个类的+ (void)load函数上打断点，查看此时的堆栈信息如下：
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 2.1
* frame #0: 0x000000010d168ee7 test`+[ViewController load](self=ViewController, _cmd="load") at ViewController.m:20:5
frame #1: 0x00007fff512a9477 libobjc.A.dylib`load_images + 1386
frame #2: 0x000000010d177e34 dyld_sim`dyld::notifySingle(dyld_image_states, ImageLoader const*, ImageLoader::InitializerTimingList*) + 418
frame #3: 0x000000010d185856 dyld_sim`ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 438
frame #4: 0x000000010d183d2c dyld_sim`ImageLoader::processInitializers(ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 188
frame #5: 0x000000010d183dcc dyld_sim`ImageLoader::runInitializers(ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&) + 82
frame #6: 0x000000010d178270 dyld_sim`dyld::initializeMainExecutable() + 199
frame #7: 0x000000010d17c1bb dyld_sim`dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*) + 3662
frame #8: 0x000000010d1771cd dyld_sim`start_sim + 122
frame #9: 0x00000001174ff85c dyld`dyld::useSimulatorDyld(int, macho_header const*, char const*, int, char const**, char const**, char const**, unsigned long*, unsigned long*) + 2308
frame #10: 0x00000001174fd4f4 dyld`dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*) + 837
frame #11: 0x00000001174f8227 dyld`dyldbootstrap::start(dyld3::MachOLoaded const*, int, char const**, dyld3::MachOLoaded const*, unsigned long*) + 453
frame #12: 0x00000001174f8025 dyld`_dyld_start + 37
可以看到栈底信息是从dyld源码中的_dyld_start函数开始的，查看dyld源码可知该函数在dyldStartup.s的汇编文件中，通过查看汇编或以上栈信息可以得知下一个调用函数为dyldbootstrap::start。
2. dyldbootstrap::start源码分析
uintptr_t start(const dyld3::MachOLoaded* appsMachHeader, int argc, const char* argv[],
const dyld3::MachOLoaded* dyldsMachHeader, uintptr_t* startGlue)
{
// Emit kdebug tracepoint to indicate dyld bootstrap has started
dyld3::kdebug_trace_dyld_marker(DBG_DYLD_TIMING_BOOTSTRAP_START, 0, 0, 0, 0);
// if kernel had to slide dyld, we need to fix up load sensitive locations
// we have to do this before using any global variables
rebaseDyld(dyldsMachHeader);
// kernel sets up env pointer to be just past end of agv array
const char** envp = &argv[argc+1];
// kernel sets up apple pointer to be just past end of envp array
const char** apple = envp;
while(*apple != NULL) { ++apple; }
++apple;
// set up random value for stack canary
__guard_setup(apple);
#if DYLD_INITIALIZER_SUPPORT
// run all C++ initializers inside dyld
runDyldInitializers(argc, argv, envp, apple);
#endif
// now that we are done bootstrapping dyld, call dyld's main
uintptr_t appsSlide = appsMachHeader->getSlide();
return dyld::_main((macho_header*)appsMachHeader, appsSlide, argc, argv, envp, apple, startGlue);
}
分析：
rebaseDyld在使用全局变量前修复dyld的地址偏移，同时会初始化进程和系统层
设置环境变量
现在的版本不需要初始化dyld了
获取地址偏移量，调用dyld::_main
3. dyld::_main源码分析
uintptr_t
_main(const macho_header* mainExecutableMH, uintptr_t mainExecutableSlide,
int argc, const char* argv[], const char* envp[], const char* apple[],
uintptr_t* startGlue)
{
...
//加载共享缓存
mapSharedCache();
//加载可执行文件并实例化
// instantiate ImageLoader for main executable
sMainExecutable = instantiateFromLoadedImage(mainExecutableMH, mainExecutableSlide, sExecPath);
//遍历加载插入的动态库
// load any inserted libraries
if ( sEnv.DYLD_INSERT_LIBRARIES != NULL ) {
for (const char* const* lib = sEnv.DYLD_INSERT_LIBRARIES; *lib != NULL; ++lib)
loadInsertedDylib(*lib);
}
//链接主程序
link(sMainExecutable, sEnv.DYLD_BIND_AT_LAUNCH, true, ImageLoader::RPathChain(NULL, NULL), -1);
//在链接主程序之后，遍历链接已经插入的动态库
// link any inserted libraries
// do this after linking main executable so that any dylibs pulled in by inserted
// dylibs (e.g. libSystem) will not be in front of dylibs the program uses
if ( sInsertedDylibCount > 0 ) {
for(unsigned int i=0; i < sInsertedDylibCount; ++i) {
ImageLoader* image = sAllImages[i+1];
link(image, sEnv.DYLD_BIND_AT_LAUNCH, true, ImageLoader::RPathChain(NULL, NULL), -1);
image->setNeverUnloadRecursive();
}
if ( gLinkContext.allowInterposing ) {
// only INSERTED libraries can interpose
// register interposing info after all inserted libraries are bound so chaining works
for(unsigned int i=0; i < sInsertedDylibCount; ++i) {
ImageLoader* image = sAllImages[i+1];
image->registerInterposing(gLinkContext);
}
}
}
// 初始化主程序
initializeMainExecutable();
// 通知监听程序调用main()函数 notify any montoring proccesses that this process is about to enter main()
notifyMonitoringDyldMain();
...
}
分析：dyld::_main主要做了以下几件事情：
mapSharedCache 加载共享缓存
instantiateFromLoadedImage 加载可执行文件并实例化
loadInsertedDylib 遍历加载插入的动态库
link 链接主程序
在链接主程序之后，遍历链接已经插入的动态库
initializeMainExecutable 初始化主程序
notifyMonitoringDyldMain 通知监听程序调用main()函数
此时main函数之前的流程已经走完了，下面说下dyld如何和objc关联起来的。
在上述初始化主程序initializeMainExecutable函数中，initializeMainExecutable -> runInitializers -> processInitializers
4.initializeMainExecutable源码
void initializeMainExecutable()
{
// record that we've reached this step
gLinkContext.startedInitializingMainExecutable = true;
// run initialzers for any inserted dylibs
ImageLoader::InitializerTimingList initializerTimes[allImagesCount()];
initializerTimes[0].count = 0;
const size_t rootCount = sImageRoots.size();
if ( rootCount > 1 ) {
for(size_t i=1; i < rootCount; ++i) {
sImageRoots[i]->runInitializers(gLinkContext, initializerTimes[0]);
}
}
// run initializers for main executable and everything it brings up
sMainExecutable->runInitializers(gLinkContext, initializerTimes[0]);
// register cxa_atexit() handler to run static terminators in all loaded images when this process exits
if ( gLibSystemHelpers != NULL )
(*gLibSystemHelpers->cxa_atexit)(&runAllStaticTerminators, NULL, NULL);
// dump info if requested
if ( sEnv.DYLD_PRINT_STATISTICS )
ImageLoader::printStatistics((unsigned int)allImagesCount(), initializerTimes[0]);
if ( sEnv.DYLD_PRINT_STATISTICS_DETAILS )
ImageLoaderMachO::printStatisticsDetails((unsigned int)allImagesCount(), initializerTimes[0]);
}
分析：
初始化所有已经插入的动态库
初始化主程序
5. processInitializers源码
void ImageLoader::processInitializers(const LinkContext& context, mach_port_t thisThread,
InitializerTimingList& timingInfo, ImageLoader::UninitedUpwards& images)
{
uint32_t maxImageCount = context.imageCount()+2;
ImageLoader::UninitedUpwards upsBuffer[maxImageCount];
ImageLoader::UninitedUpwards& ups = upsBuffer[0];
ups.count = 0;
// Calling recursive init on all images in images list, building a new list of
// uninitialized upward dependencies.
for (uintptr_t i=0; i < images.count; ++i) {
images.imagesAndPaths[i].first->recursiveInitialization(context, thisThread, images.imagesAndPaths[i].second, timingInfo, ups);
}
// If any upward dependencies remain, init them.
if ( ups.count > 0 )
processInitializers(context, thisThread, timingInfo, ups);
}
分析：
初始化所有images，调用recursiveInitialization递归其依赖的镜像进行初始化，直至全部初始化完成
6. recursiveInitialization源码
void ImageLoader::recursiveInitialization(const LinkContext& context, mach_port_t this_thread, const char* pathToInitialize,
InitializerTimingList& timingInfo, UninitedUpwards& uninitUps)
{
...省略部分代码
// initialize lower level libraries first
for(unsigned int i=0; i < libraryCount(); ++i) {
ImageLoader* dependentImage = libImage(i);
if ( dependentImage != NULL ) {
// don't try to initialize stuff "above" me yet
if ( libIsUpward(i) ) {
uninitUps.imagesAndPaths[uninitUps.count] = { dependentImage, libPath(i) };
uninitUps.count++;
}
else if ( dependentImage->fDepth >= fDepth ) {
dependentImage->recursiveInitialization(context, this_thread, libPath(i), timingInfo, uninitUps);
}
}
}
// let objc know we are about to initialize this image
uint64_t t1 = mach_absolute_time();
fState = dyld_image_state_dependents_initialized;
oldState = fState;
context.notifySingle(dyld_image_state_dependents_initialized, this, &timingInfo);
// initialize this image
bool hasInitializers = this->doInitialization(context);
// let anyone know we finished initializing this image
fState = dyld_image_state_initialized;
oldState = fState;
context.notifySingle(dyld_image_state_initialized, this, NULL);
}
分析：
首先保证初始化级别较低，被依赖的镜像
notifySingle通知objc初始化该镜像
doInitialization初始化该镜像
notifySingle通知objc初始化该镜像完毕
7.notifySingle流程
看上去notifySingle应该是类似发了个通知的
在源码中可以看到调用了(*sNotifyObjCInit)(image->getRealPath(), image->machHeader());函数
sNotifyObjCInit是在registerObjCNotifiers函数中赋值的第二个参数
registerObjCNotifiers是在_dyld_objc_notify_register函数中调用的
_dyld_objc_notify_register看着比较眼熟，实在libobjc源码中_objc_init函数中调用的
那_objc_init是在何时调用的呢？
通过在_objc_init添加符号断点，查看堆栈如下
frame #0: 0x000000010dd9cb6b libobjc.A.dylib`_objc_init
frame #1: 0x000000010f7c2789 libdispatch.dylib`_os_object_init + 13
frame #2: 0x000000010f7d12e3 libdispatch.dylib`libdispatch_init + 300
frame #3: 0x000000010ddd785f libSystem.B.dylib`libSystem_initializer + 252
frame #4: 0x000000010d4f26d9 dyld_sim`ImageLoaderMachO::doModInitFunctions(ImageLoader::LinkContext const&) + 513
frame #5: 0x000000010d4f2ace dyld_sim`ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&) + 40
frame #6: 0x000000010d4ed868 dyld_sim`ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 456
frame #7: 0x000000010d4ed7d5 dyld_sim`ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 309
frame #8: 0x000000010d4ebd2c dyld_sim`ImageLoader::processInitializers(ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 188
frame #9: 0x000000010d4ebdcc dyld_sim`ImageLoader::runInitializers(ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&) + 82
frame #10: 0x000000010d4e022a dyld_sim`dyld::initializeMainExecutable() + 129
frame #11: 0x000000010d4e41bb dyld_sim`dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*) + 3662
frame #12: 0x000000010d4df1cd dyld_sim`start_sim + 122
frame #13: 0x0000000111d1379a dyld`dyld::useSimulatorDyld(int, macho_header const*, char const*, int, char const**, char const**, char const**, unsigned long*, unsigned long*) + 2308
frame #14: 0x0000000111d11432 dyld`dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*) + 837
frame #15: 0x0000000111d0c227 dyld`dyldbootstrap::start(dyld3::MachOLoaded const*, int, char const**, dyld3::MachOLoaded const*, unsigned long*) + 453
frame #16: 0x0000000111d0c025 dyld`_dyld_start + 37
发现doModInitFunctions -> libSystem_initializer -> libdispatch_init -> _os_object_init -> _objc_init
8. doInitialization源码
bool ImageLoaderMachO::doInitialization(const LinkContext& context)
{
CRSetCrashLogMessage2(this->getPath());
// mach-o has -init and static initializers
doImageInit(context);
doModInitFunctions(context);
CRSetCrashLogMessage2(NULL);
return (fHasDashInit || fHasInitializers);
}
在doInitialization中初始化镜像以及静态C++的构造函数，注意：在doInitialization之前需要首先确保libSystem已经初始化。
总结：
dyld->objc 流程
_dyld_start -> `` -> dyldbootstrap::start -> dyld::_main -> dyld::initializeMainExecutable -> ImageLoader::runInitializers -> ImageLoader::processInitializers -> ImageLoader::recursiveInitialization -> doInitialization -> libSystem_initializer -> libdispatch_init -> _os_object_init -> _objc_init -> _dyld_objc_notify_register
在doInitialization调用完成之后，调用 _dyld_objc_notify_register函数注册的load_images函数，至此由runtime接管app运行。
dyld->objc流程.png
扫一扫
832
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
