IOS底层原理之动态转发流程

最新推荐文章于 2023-05-16 20:07:59 发布
最新推荐文章于 2023-05-16 20:07:59 发布
阅读量450 收藏
点赞数
分类专栏： 底层原理
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/weixin_40808615/article/details/118545221
版权

前言

在上一篇文章中，我们讲述了快速查找流程，接着向下探究

一、instrumentObjcMessageSends辅助分析方法的介绍

作用: 可以打印出指定区域内调用的所有的方法

@interface MHPerson : NSObject
{
    NSString * newName;
    NSObject * objc;
}

@property(nonatomic,strong)NSString * hobby;
@property(nonatomic,  copy)NSString * name1;

@property(atomic,  copy)NSString * name;

@property(nonatomic,assign)NSInteger age;
-(void)testfunc;
@end

@implementation MHPerson

@end
int main(int argc, const char * argv[]) {
    @autoreleasepool {
        MHPerson *p = [MHPerson alloc];
        instrumentObjcMessageSends(YES);

        [p testfunc];
        instrumentObjcMessageSends(NO);
        // insert code here...
        NSLog(@"Hello, World!");
        
    }
    return 0;
}

查看结果：此方法将指定函数开始与结束之间调用的函数全部以文件的形式输出，存储路径为：\tmp\msgSends,打开finder 找到msgSends-xxxx的文件，此文件内就是全部调用的函数了。

+ MHPerson NSObject resolveInstanceMethod:
+ MHPerson NSObject resolveInstanceMethod:
- MHPerson NSObject forwardingTargetForSelector:
- MHPerson NSObject forwardingTargetForSelector:
- MHPerson NSObject methodSignatureForSelector:
- MHPerson NSObject methodSignatureForSelector:
+ MHPerson NSObject resolveInstanceMethod:
+ MHPerson NSObject resolveInstanceMethod:
- MHPerson NSObject doesNotRecognizeSelector:
- MHPerson NSObject doesNotRecognizeSelector:
- OS_xpc_bundle OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_serializer OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_payload OS_xpc_payload dealloc
- NSObject NSObject dealloc
- OS_dispatch_mach_msg OS_dispatch_object dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_mach_send OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc
- __NSCFConstantString __NSCFString _fastCStringContents:
- OS_xpc_serializer OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_payload OS_xpc_payload dealloc
- NSObject NSObject dealloc
- OS_dispatch_mach_msg OS_dispatch_object dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_xpc_mach_send OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_xpc_uuid OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_mach_send OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc
- __NSCFString NSObject isProxy
- __NSCFString NSObject respondsToSelector:
- __NSCFString NSObject class
+ __NSCFString NSObject resolveInstanceMethod:
+ __NSCFString NSObject resolveInstanceMethod:
- __NSCFString __NSCFString isNSString__
- __NSCFString NSObject isNSCFConstantString__
- __NSCFString __NSCFString _fastCStringContents:
- OS_xpc_serializer OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_payload OS_xpc_payload dealloc
- NSObject NSObject dealloc
- OS_dispatch_mach_msg OS_dispatch_object dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_xpc_mach_send OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc
- OS_dispatch_data NSObject retain
- OS_dispatch_data NSObject release
- OS_dispatch_data NSObject retain
- OS_dispatch_data NSObject release
- OS_dispatch_mach_msg OS_dispatch_object dealloc
- OS_xpc_serializer OS_xpc_object dealloc
- OS_dispatch_mach_msg OS_dispatch_object dealloc
- OS_object NSObject dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_data OS_xpc_object dealloc
- OS_dispatch_data NSObject release
- OS_dispatch_data OS_dispatch_data dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_uuid OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_uuid OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc
- OS_xpc_data OS_xpc_object dealloc
- OS_dispatch_data NSObject release
- OS_dispatch_data OS_dispatch_data dealloc
- _NSDispatchData NSObject dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc
- NSException NSException initWithName:reason:userInfo:
- __NSCFConstantString __NSCFConstantString copy
- __NSCFString __NSCFString copy
- NSException NSObject isKindOfClass:
+ NSMutableDictionary NSObject alloc
+ NSMutableDictionary NSDictionary allocWithZone:
- __NSPlaceholderDictionary __NSPlaceholderDictionary init
- __NSPlaceholderDictionary __NSPlaceholderDictionary initWithCapacity:
- NSException NSException userInfo
+ NSThread NSThread callStackReturnAddresses
+ _NSCallStackArray NSObject alloc
+ _NSCallStackArray NSArray allocWithZone:
+ NSObject NSObject allocWithZone:
- _NSCallStackArray NSObject init
+ NSThread NSThread callStackSymbols
+ _NSCallStackArray _NSCallStackArray arrayWithFrames:count:symbols:
+ _NSCallStackArray NSObject alloc
+ _NSCallStackArray NSArray allocWithZone:
+ NSObject NSObject allocWithZone:
- _NSCallStackArray NSObject init
- __NSDictionaryM __NSDictionaryM setObject:forKey:
- __NSCFConstantString __NSCFString hash
- __NSCFConstantString __NSCFConstantString copyWithZone:
- __NSDictionaryM __NSDictionaryM setObject:forKey:
- __NSCFConstantString __NSCFString hash
- __NSCFConstantString __NSCFConstantString copyWithZone:
- NSException NSObject retain
- NSException NSObject isKindOfClass:
- NSException NSException name
- __NSCFConstantString __NSCFConstantString retain
- __NSCFConstantString __NSCFConstantString autorelease
- NSException NSException reason
- __NSCFString __NSCFString retain
- __NSCFString NSObject autorelease
- __NSDictionaryM __NSDictionaryM objectForKey:
- __NSCFConstantString __NSCFString hash
- _NSCallStackArray _NSCallStackArray count
- _NSCallStackArray _NSCallStackArray objectAtIndex:
- __NSCFNumber __NSCFNumber unsignedLongValue
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSNumber NSNumber numberWithUnsignedInteger:
- __NSCFNumber __NSCFNumber unsignedIntegerValue
- __NSCFNumber __NSCFNumber unsignedLongValue
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSNumber NSNumber numberWithUnsignedInteger:
- __NSCFNumber __NSCFNumber unsignedIntegerValue
- __NSCFNumber __NSCFNumber unsignedLongValue
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSNumber NSNumber numberWithUnsignedInteger:
- __NSCFNumber __NSCFNumber unsignedIntegerValue
- __NSCFNumber __NSCFNumber unsignedLongValue
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSNumber NSNumber numberWithUnsignedInteger:
- __NSCFNumber __NSCFNumber unsignedIntegerValue
- __NSCFNumber __NSCFNumber unsignedLongValue
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSNumber NSNumber numberWithUnsignedInteger:
- __NSCFNumber __NSCFNumber unsignedIntegerValue
- __NSCFNumber __NSCFNumber unsignedLongValue
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSNumber NSNumber numberWithUnsignedInteger:
- __NSCFNumber __NSCFNumber unsignedIntegerValue
- __NSCFNumber __NSCFNumber unsignedLongValue
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSNumber NSNumber numberWithUnsignedInteger:
- __NSCFNumber __NSCFNumber unsignedIntegerValue
- __NSCFNumber __NSCFNumber unsignedLongValue
- __NSDictionaryM __NSDictionaryM objectForKey:
- __NSCFConstantString __NSCFString hash
- _NSCallStackArray NSArray description
- _NSCallStackArray _NSCallStackArray descriptionWithLocale:indent:
+ NSMutableString NSString string
+ NSMutableString NSMutableString allocWithZone:
- __NSCFString NSObject autorelease
- __NSCFString __NSCFString appendString:
- __NSCFString __NSCFString appendFormat:
- __NSCFString __NSCFString appendFormat:
- __NSCFString __NSCFString appendFormat:
- __NSCFString __NSCFString appendFormat:
- __NSCFString __NSCFString appendFormat:
- __NSCFString __NSCFString appendFormat:
- __NSCFString __NSCFString appendFormat:
- __NSCFString __NSCFString appendFormat:
- __NSCFString __NSCFString appendString:
- _NSCallStackArray NSArray componentsJoinedByString:
- __NSCFConstantString __NSCFString isNSString__
- _NSCallStackArray _NSCallStackArray count
- _NSCallStackArray NSArray countByEnumeratingWithState:objects:count:
- _NSCallStackArray _NSCallStackArray count
- _NSCallStackArray NSArray getObjects:range:
- _NSCallStackArray _NSCallStackArray count
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSString NSString stringWithUTF8String:
+ NSString NSString allocWithZone:
- __NSCFString NSObject autorelease
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSString NSString stringWithUTF8String:
+ NSString NSString allocWithZone:
- NSPlaceholderString NSPlaceholderString initWithBytes:length:encoding:
- __NSCFString NSObject autorelease
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSString NSString stringWithUTF8String:
+ NSString NSString allocWithZone:
- NSPlaceholderString NSPlaceholderString initWithBytes:length:encoding:
- __NSCFString NSObject autorelease
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSString NSString stringWithUTF8String:
+ NSString NSString allocWithZone:
- NSPlaceholderString NSPlaceholderString initWithBytes:length:encoding:
- __NSCFString NSObject autorelease
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSString NSString stringWithUTF8String:
+ NSString NSString allocWithZone:
- NSPlaceholderString NSPlaceholderString initWithBytes:length:encoding:
- __NSCFString NSObject autorelease
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSString NSString stringWithUTF8String:
+ NSString NSString allocWithZone:
- NSPlaceholderString NSPlaceholderString initWithBytes:length:encoding:
- __NSCFString NSObject autorelease
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSString NSString stringWithUTF8String:
+ NSString NSString allocWithZone:
- NSPlaceholderString NSPlaceholderString initWithBytes:length:encoding:
- __NSCFString NSObject autorelease
- _NSCallStackArray _NSCallStackArray objectAtIndex:
+ NSString NSString stringWithUTF8String:
+ NSString NSString allocWithZone:
- NSPlaceholderString NSPlaceholderString initWithBytes:length:encoding:
- __NSCFString NSObject autorelease
- __NSCFString NSString description
- __NSCFString NSString description
- __NSCFString NSString description
- __NSCFString NSString description
- __NSCFString NSString description
- __NSCFString NSString description
- __NSCFString NSString description
- __NSCFString NSString description
- _NSCallStackArray NSArray countByEnumeratingWithState:objects:count:
- __NSCFString NSObject autorelease
- __NSCFString __NSCFString UTF8String
- NSMutableString NSString UTF8String
- __NSCFString __NSCFString length
- __NSCFString NSString getBytes:maxLength:usedLength:encoding:options:range:remainingRange:
- __NSCFString __NSCFString length
+ NSMutableData NSMutableData allocWithZone:
+ NSObject NSObject allocWithZone:
- NSConcreteMutableData NSConcreteMutableData initWithLength:
- NSConcreteMutableData NSConcreteMutableData setLength:
- NSConcreteMutableData NSConcreteMutableData mutableBytes
- __NSCFString NSString getBytes:maxLength:usedLength:encoding:options:range:remainingRange:
- __NSCFString __NSCFString length
- __NSCFString __NSCFString UTF8String
- __NSCFConstantString __NSCFString _fastCStringContents:
- __NSCFString NSObject isProxy
- __NSCFString NSObject respondsToSelector:
- __NSCFString NSObject class
- __NSCFString __NSCFString isNSString__
- __NSCFString NSObject isNSCFConstantString__
- __NSCFString __NSCFString _fastCStringContents:
- OS_dispatch_data NSObject retain
- OS_dispatch_data NSObject release
- OS_dispatch_data NSObject retain
- OS_dispatch_data NSObject release
- OS_xpc_serializer OS_xpc_object dealloc
- OS_dispatch_mach_msg OS_dispatch_object dealloc
- OS_object NSObject dealloc
- OS_xpc_dictionary OS_xpc_object dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_data OS_xpc_object dealloc
- OS_dispatch_data NSObject release
- OS_dispatch_data OS_dispatch_data dealloc
- _NSDispatchData NSObject dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_uuid OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_uuid OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_string OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_uint64 OS_xpc_object dealloc
- OS_object NSObject dealloc
- OS_xpc_data OS_xpc_object dealloc
- OS_dispatch_data NSObject release
- OS_dispatch_data OS_dispatch_data dealloc
- _NSDispatchData NSObject dealloc
- OS_object NSObject dealloc
- OS_object NSObject dealloc

源码

void instrumentObjcMessageSends(BOOL flag)
{
    bool enable = flag;

    // Shortcut NOP
    if (objcMsgLogEnabled == enable)
        return;

    // If enabling, flush all method caches so we get some traces
    if (enable)
        _objc_flush_caches(Nil);

    // Sync our log file
    if (objcMsgLogFD != -1)
        fsync (objcMsgLogFD);

    objcMsgLogEnabled = enable;
}

二、开始探索

之前对resolveInstanceMethod已经探索过了，接下来探索log里面的forwardingTargetForSelector

1.forwardingTargetForSelector

forwardingTargetForSelector
通过此文档可以得知forwardingTargetForSelector为快速转发流程的一个执行者，如果使用此方法对某一个函数进行重定向，那么将非常的有效。forwardingTargetForSelector会返回一个对象，成为未识别的消息的第一继承者，即方法的重定向。如果你想要更多的操作自由，请用forwardInvocation进行操作。

代码验证
@implementation MHPerson
-(id)forwardingTargetForSelector:(SEL)aSelector {
    NSLog(@"%s-%@", __func__, NSStringFromSelector(aSelector));
    return [super forwardingTargetForSelector:aSelector];
}
@end
`2021-07-07 15:05:48.446394+0800 test[11883:1110018] -[MHPerson forwardingTargetForSelector:]-testfunc
2021-07-07 15:05:48.447683+0800 test[11883:1110018] -[MHPerson testfunc]: unrecognized selector sent to instance 0x106328a50`

结果是崩溃，但是在崩溃之前有一次打印,证明了上述的探索方向是OK的，在此过程可以对方法进行重定向，以防止程序crash。

防止崩溃
@interface MHTeacher : NSObject

@end
@implementation MHTeacher

-(void)testfunc {
    NSLog(@"111");
}
-(id)forwardingTargetForSelector:(SEL)aSelector {
    NSLog(@"%s-%@", __func__, NSStringFromSelector(aSelector));
    return [MHTeacher alloc];
//    return [super forwardingTargetForSelector:aSelector];
}
2021-07-07 15:30:46.767623+0800 test[11964:1122435] -[MHPerson forwardingTargetForSelector:]-testfunc
2021-07-07 15:30:46.768480+0800 test[11964:1122435] 111
test was compiled with optimization - stepping may behave oddly; variables may not be available.
2021-07-07 15:30:46.768909+0800 test[11964:1122435] Hello, World!

成功了，但是感觉有点不正常，为什么不用自己的方法来解决呢？

2.methodSignatureForSelector

methodSignatureForSelector
该方法用于协议的实现。此方法也用于必须创建NSInvocation对象的情况，例如在消息转发期间。如果您的对象维护一个委托或能够处理它没有直接实现的消息，您应该重写此方法以返回适当的方法签名。

代码验证
- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector {
    if (aSelector == @selector(testfunc)) {
        return [NSMethodSignature signatureWithObjCTypes:"v@:"];
    }
    return  [super methodSignatureForSelector:aSelector];
}
- (void)forwardInvocation:(NSInvocation *)anInvocation {
    NSLog(@"%@--%@",anInvocation.target, NSStringFromSelector(anInvocation.selector));
    MHTeacher * t = [MHTeacher alloc];
    if ([self respondsToSelector:anInvocation.selector]) {
        [anInvocation invoke];
    }else if ([self respondsToSelector:anInvocation.selector]) {
        [anInvocation invokeWithTarget:t];
        
    }else {
        NSLog(@"%s - %@", __func__, NSStringFromSelector(anInvocation.selector));
    }
}
2021-07-08 14:44:02.316835+0800 test[1833:50734] <MHPerson: 0x1005957b0>--\M-0WY--0x7ffeefbff3c8--
test was compiled with optimization - stepping may behave oddly; variables may not be available.
2021-07-08 14:44:05.221739+0800 test[1833:50734] <MHPerson: 0x1005957b0>--testfunc
2021-07-08 14:44:05.222021+0800 test[1833:50734] -[MHPerson forwardInvocation:] - testfunc

成功！

小结

快速转发：通过forwardingTargetForSelector实现，如果此时有指定的对象去接收这个消息，就会走之指定对象的查找流程，如果返回是nil，进入慢速转发流程
慢速转发：通过methodSignatureForSelector和forwardInvocation共同实现，如果methodSignatureForSelector返回值是nil，慢速查找流程结束，如果有返回值forwardInvocation的事务处理不处理都不会崩溃

流程图

在这里插入图片描述

三、逆向查看流程

(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x00007fff2044c92e libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x000000010038de79 libsystem_pthread.dylib`pthread_kill + 263
    frame #2: 0x00007fff203d0411 libsystem_c.dylib`abort + 120
    frame #3: 0x00007fff2043eef2 libc++abi.dylib`abort_message + 241
    frame #4: 0x00007fff204305fd libc++abi.dylib`demangling_terminate_handler() + 266
    frame #5: 0x00007fff2032958d libobjc.A.dylib`_objc_terminate() + 96
    frame #6: 0x00007fff2043e307 libc++abi.dylib`std::__terminate(void (*)()) + 8
    frame #7: 0x00007fff20440beb libc++abi.dylib`__cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) + 27
    frame #8: 0x00007fff20440bb2 libc++abi.dylib`__cxa_throw + 116
    frame #9: 0x00007fff20326ec0 libobjc.A.dylib`objc_exception_throw + 350
    frame #10: 0x00007fff2067138d CoreFoundation`-[NSObject(NSObject) doesNotRecognizeSelector:] + 132
    frame #11: 0x00007fff2055690b CoreFoundation`___forwarding___ + 1448
    frame #12: 0x00007fff205562d8 CoreFoundation`_CF_forwarding_prep_0 + 120
  * frame #13: 0x0000000100003d9a test`main(argc=<unavailable>, argv=<unavailable>) at main.m:70:9 [opt]
    frame #14: 0x00007fff20496f5d libdyld.dylib`start + 1
(lldb)

发现滴啊用的方法___forwarding___、_CF_forwarding_prep_0是CoreFoundation框架下的，有些奇奇怪怪的，看一下源码，全局搜了一下，结果什么都没有找到，然后用Hopper查看了一下CoreFoundation的macho文件，找到了这个

    int ____forwarding___(int arg0, int arg1) {
    ····省略代码，因为下面会有····

分析一下流程：

forwardingTargetForSelector
  int ____forwarding___(int arg0, int arg1) {
        r15 = rdi;
        var_-48 = *___stack_chk_guard;
        rcx = COND_BYTE_SET(NE);
        if (rsi != 0x0) {  // 根据arg1判断通过_objc_msgSend_stret或_objc_msgSend发送消息
                r12 = _objc_msgSend_stret;
        }
        else {
                r12 = _objc_msgSend;
        }
        rbx = *(r15 + rcx * 0x8); //
        var_-320 = *(r15 + rcx * 0x8 + 0x8);
        r13 = rcx * 0x8;
        if ((rbx & 0x1) == 0x0) goto loc_649bb; //如果为0跳转至loc_649bb

    loc_6498b:
        rcx = *_objc_debug_taggedpointer_obfuscator;  // targed pointer
        rcx = rcx ^ rbx;
        rax = rcx >> 0x1 & 0x7;
        if (rax == 0x7) {
                rax = (rcx >> 0x4 & 0xff) + 0x8;
        }
        if (rax == 0x0) goto loc_64d48;

    loc_649bb:  // rbx & 0x1 如果为0 跳转方法
        var_-328 = r13;
        var_-312 = r12;
        var_-344 = rsi;
        rax = object_getClass(rbx); //拿到当前类
        r12 = rax;
        r13 = class_getName(rax);
        r14 = @selector(forwardingTargetForSelector:);
        if (class_respondsToSelector(r12, r14) == 0x0) goto loc_64a67; // 判断当前那类是否可以响应forwardingTargetForSelector 否 跳转loc_64a67

这一端代码根据arg1判断通过_objc_msgSend_stret或_objc_msgSend发送消息，然后判断当前那类是否可以响应forwardingTargetForSelector 否 跳转loc_64a67

methodSignatureForSelector
   loc_64a67:
        var_-312 = rbx;
        if (strncmp(r13, "_NSZombie_", 0xa) == 0x0) goto loc_64dc1;

    loc_64a8a:
        rbx = @selector(methodSignatureForSelector:);
        r14 = var_-312;
        var_-328 = r15;
        if (class_respondsToSelector(r12, rbx) == 0x0) goto loc_64dd7;

    loc_64ab2:
        rax = _objc_msgSend(r14, rbx);
        rbx = var_-344;
        if (rax == 0x0) goto loc_64e3c;

紧接着判断是否有僵尸对象，如果没有，进入慢速转发流程

  • 如果methodSignatureForSelector没有实现直接跳转到loc_64dd7流程，然后跳转到loc_64e3c
    loc_64dd7:
        rbx = class_getSuperclass(r12);
        r14 = object_getClassName(r14);
        if (rbx == 0x0) {
                _CFLog(0x4, @"*** NSForwarding: warning: object %p of class '%s' does not implement methodSignatureForSelector: -- did you forget to declare the superclass of '%s'?", var_-312, r14, object_getClassName(var_-312));
        }
        else {
                _CFLog(0x4, @"*** NSForwarding: warning: object %p of class '%s' does not implement methodSignatureForSelector: -- trouble ahead", var_-312, r14);
        }
        goto loc_64e3c;
  • 如果methodSignatureForSelector返回值等于nil跳转到loc_64e3c流程
   loc_64e3c:
        rax = sel_getName(var_-320);
        r14 = rax;
        rax = sel_getUid(rax);
        if (rax != var_-320) {
                r8 = rax;
                _CFLog(0x4, @"*** NSForwarding: warning: selector (%p) for message '%s' does not match selector known to Objective C runtime (%p)-- abort", var_-320, r14, r8);
        }
        rbx = @selector(doesNotRecognizeSelector:);
        if (class_respondsToSelector(object_getClass(var_-312), rbx) == 0x0) {
                ____forwarding___.cold.2(var_-312);
        }
        rax = _objc_msgSend(var_-312, rbx);
        asm{ ud2 };
        return rax;
  • 如果methodSignatureForSelector返回了签名信息的对象 （中间跳的有点多，直接上最后的返回代码）
    loc_64a5b:
        *(0x0 + r13) = rax;
        r15 = 0x0;
        goto loc_64d82;

    loc_64d82:
        if (*___stack_chk_guard == var_-48) {
                rax = r15;
        }
        else {
                rax = __stack_chk_fail();
        }
        return rax;

感觉有点乱，先到这里，加油。

总结

底层的探索是在一次次挫败和小有所得中慢慢开拓的，希望我们一起深入学习，提升自我

MissHector
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
从底层分析一下存在跨进程通信问题的 NSUserDefaults 还能用吗？
Z1591090的博客
09-02 811
前言 字节团队最近分享的 iOS 稳定性问题治理：卡死崩溃监控原理及最佳实践 提到：NSUserDefaults 底层实现中存在直接或者间接的跨进程通信，在主线程同步调用容易发生卡死。 随之而来的问题就是：NSUserDefaults 还能用吗？ 经过对底层分析后，笔者的研究结论是：可以在理解 NSUserDefaults 的特性后再使用。 一、NSUserDefaults 是什么？ NSUserDefaults 是 iOS 开发者常用的持久化工具，通常用于存储少量的数据 示例: NSUserDefault
iOS - 动态添加方法和消息转发
u013712343的博客
08-17 412
假设 假设，声明一个TestObect的类，.h中声明了test方法,但是.m中未实现，但是调用了这个方法会报一个经典的错误 ok，前提已经说完了，我们就从找这个错误原因讲起。 解决 首先，该方法在调用时，系统会查看这个对象能否接收这个消息（查看这个类有没有这个方法，或者有没有实现这个方法。），如果不能并且只在不能的情况下，就会调用下面这几个方法，给你“补救”的机会，你可以先理解为几套防止程序crash的备选方案，我们就是利用这几个方案进行消息转发，注意一点，前一套方案实现后一套方法就不会...
[iOS]消息传递和消息转发
最新发布
weixin_61196797的博客
05-16 1459
1.从本类的 method list (二分查找/遍历查找)查找imp2.从本类的父类的cache查找imp(汇编)3.从本类的父类的method list (二分查找/遍历查找)查找imp…继承链遍历…（父类->…->根父类）里找cache和method list的imp4.若上面环节有任何一个环节查找到了imp，跳出循环，缓存方法到本类的cache，并返回imp5.直到查找到nil，指定imp为消息转发，跳出循环，执行动态方法解析resolveMethod_locked。
OC底层消息转发机制
郭永明的技术专栏
10-30 3552
当方法查找流程结束后都没有找到对应方法的IMP，那么苹果还提供了一个消息转发的机制，这种机制分为快速转发和慢速转发两种机制，具体见正文。
iOS多线程的初步研究（九）-- dispatch源
冷胜任 的专栏
10-21 1万+
原文地址  http://www.cnblogs.com/sunfrog/p/3243230.html dispatch源（dispatch source）和RunLoop源概念上有些类似的地方，而且使用起来更简单。要很好地理解dispatch源，其实把它看成一种特别的生产消费模式。dispatch源好比生产的数据，当有新数据时，会自动在dispatch指定的队列（即消费队列）上运行
30道 iOS底层面试题（上）
10-18
在iOS开发领域，深入理解底层机制对于成为一名优秀的工程师...以上这些知识点是iOS底层面试中常见的问题，掌握它们能帮助开发者更好地理解和优化iOS应用的性能。在实际面试中，可能会结合具体的代码示例进行深入讨论。
网易iOS岗位面试真题面经
07-21
* 对于Runtime的理解：SEL、IMP、ISA、动态消息绑定、消息转发机制、方法调配 * 方法调配的应用场景 * 属性中的原子属性是如何实现的？为何原子属性影响性能？ 二、Objective-C语言 * 对于分类中的属性增加 * 属性...
整集iOS面试资料
08-15
- C语言也是很多iOS底层技术的基础。 3. **Objective-C** - Objective-C是iOS早期主要使用的编程语言。 - 面试时可能会问到关于Objective-C的基本概念、特性及与其他语言（如Swift）的比较等。 4. **KVO-KVC** ...
iOS-Code-Analyze:关于iOS的原始码解析
03-23
"iOS-Code-Analyze"项目专注于对iOS系统的源码进行解析，帮助开发者们更好地理解系统底层的工作原理，从而优化应用性能，解决复杂问题。本文将围绕这个项目，探讨一些核心的iOS源码解析知识点。 1. **Objective-C与...
Cisco IOS精髓
01-06
包括数据包转发机制、流量控制策略等内容，这对于理解路由器的工作原理至关重要。 #### 二、特定硬件平台上的Cisco IOS应用 - **存储共享路由器**：这类路由器采用共享内存架构，书中详细解释了在这种架构下，IOS...
NSData+Base64
07-10
NSData+Base64类。提供两个方法。1. + (NSData *)dataFromBase64String:(NSString *)aString; 2. - (NSString *)base64EncodedString;
GCD读写文件
bravegogo的专栏
06-14 485
转： http://blog.sina.com.cn/s/blog_6d01cce30101hzws.html//GCD读写文件    dispatch_queue_t queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0);        int intbuffer[] = { 1, 2, 3, 4 };    ...
进程间通信
lexiaoyao20的专栏
02-28 1175
原文链接：http://segmentfault.com/blog/cruise/1190000002400329 总起 OS X是MacOS与NeXTSTEP的结合。OC是Smalltalk类面向对象编程与C的结合。iCloud则是苹果移动服务与云平台的结合。 上述都是一些亮点，但是不得不说苹果技术中的进程通讯走的是“反人类”的道路。 由于不是根据每个节点上最优原则进行设计，苹果的进程间
'Invalid type in JSON write (NSConcreteMutableData)'
opentogether的博客
06-12 4434
在NSDirectory添加NSData(JSON)无效输入JSON写(NSConcreteMutableData)错误 我试图添加一个图像到JSON文件,我想发布在服务器上。我用下面的代码但我继续Invalid type in JSON write (NSConcreteMutableData)错误。代码是 NSDictionary *parameter
iOS多线程的初步研究（七）-- dispatch对象
冷胜任 的专栏
10-21 5988
原文地址  http://www.cnblogs.com/sunfrog/p/3243230.html 谈起iOS的dispatch（正式称谓是Grand Central Dispatch或GCD），不得不说这又是iOS（包括MacOSX）平台的创新，优缺点这里不讨论，只有当你使用时才能真正体会到。我们说dispatch函数的主要目的是实现多任务并发代码，那么要理解dispatc
CPU_dispatch
weixin_44018485的博客
05-24 1205
CPU的调度概念和层次 CPU的调度 基本概念 当有一堆任务要处理，但资源有限导致没法同时处理。从而需要确定某种规则来决定处理这些任务的顺序，这就是“调度”研究的问题 多道程序系统中，进程的数量往往多于处理机个数，不可能并行处理各个进程。处理机调度，就是从就绪队列中按照一定的算法选择一个进程并将处理机分配给它运行，以实现进程的并发执行。 三个层次 由于内存空间有限，无法将用户提交的作业...
iOS 冰与火之歌 - 利用 XPC 过 App 沙盒
qq_41597968的博客
03-16 1419
蒸米是阿里巴巴的移动安全工程师，香港中文大学博士，也是发现并命名了XcodeGhost的人。这次他所在的iOS安全小组发现了影响最新版iOS 9.3的0day漏洞。此漏洞杀伤力巨大，在非越狱手机上一个app应用可以利用这个漏洞做到读取或者修改沙盒外其他app的文件（照片，聊天记录等）。蒸米并未利用此漏洞牟利，而是先公开DEMO，然后再提交给苹果，然后再一点点介绍技术细节。等最终完整的技术细节出来的...
MacOS XPC的使用入门
auspark的专栏
04-21 3068
MacOS：10.14，Xcode：11.0 1、随意创建一个工程，可以是App project Xcode -> File -> New -> Project... -> macOS -> Application -> App -> click Next 填写Product Name(XPCDemo) ->选择或者不选择Team账号 -> ...
XPC Service
热门推荐
保卫的专栏
02-25 1万+
利用XPC实现多进程之间的通信 关于多进程之间的通信，之前已经写过一篇文章介绍过NSConnection的用法(用NSConnection实现不同进程间的通信)，利用NSConnection，可以直接获取到一个远程的对象，然后调用该对象的方法实现进程间的通信，这样的通信是一种直接的连接，优点在于你可以更自由的调用方法，代码直观，调用方便，但缺点是连接过于紧密，耦合性很强。 OSX10.
iOS开发进阶指南：工具、实践与底层原理详解
"《iOS开发进阶》是一本专为有一定iOS...《iOS开发进阶》这本书通过实用的工具介绍和深入的实践案例，为iOS开发者提供了从工具到底层原理全方位的提升路径，无论是对于初学者还是进阶开发者，都具有很高的学习价值。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值