preface

Dynamic method resolution is explored in IOS underlying principles of dynamic method resolution. After the dynamic resolution through log auxiliary function to realize forwardingTargetForSelector and methodSignatureForSelector method, that is the message sent by the last process forward

1.instrumentobjcAdded the function

Why is this method called

Should be set onlyobjcMsgLogEnabled = trueThe following method is executed

Execute the logMessageSend method

We run the code

Go to/TMP /msgSends-%d to find private/ TMP /msgSends-50620 to find this file

2. Forwarding messages

Message sending after the dynamic method resolution still did not find the real method implementation, at this time the dynamic method resolution throw IMP = forward_IMP into the message forwarding process. The forwarding process consists of two steps: fast forwarding and slow forwarding

Fast forward

forwardingTargetForSelectorReturn an object that receives an unrecognized message redirection

We run [person sayhello] method the person did not realize the sayhello method to add add forwardingTargetForSelector LGPerson classes run to check the results

ForwardingTargetForSelector to print the results of the first call And then the collapse of the We let the LGStudent add sayhello in forwardingTargetForSelector add code to run

Method lookup itself is sel imp lookup and we’re going to look in objc_msgSend’s cache and we’re going to look in methodList and we’re going to look in resolution and we’re going to tell me which class has a method or we’re going to look in a bad guy If we didn’t not to be found LGStudent sayhello to do Then walk methodSignatureForSelector

Slowly forward

Slowly forwardmethodSignatureForSelectorIt is also the final process of message lookup. Give dynamic method resolution, give fast forwarding, give you a chance to slow forwarding

methodSignatureForSelectorThe meaning of return aNSMethodSignatureObject that contains a description of the method identified by the given selector.methodSignatureForSelectorGeneral collocation andforwardInvocationUse, ifmethodSignatureForSelectorThe method returns anilI’m not gonna callforwardInvocation

At this timemethodSignatureForSelectorThe return value ofnil, slow forwarding completed, direct crash

At this point we add the method signature to see if forwardInvocation is called

ifmethodSignatureForSelectorThe return value ofNSMethodSignatureObject is calledforwardInvocationPhysical processinganInvocationSave theNSMethodSignatureSignature information, as well as the method signature of the target methodselAnd the recipient of the method. At this time, the crash message will not be reported, of course, can also be processedanInvocaionThe transaction

The anInvocation target is [LGStudent alloc], the anInvocation Selector is @Selector (sayHello2), and the [anInvocation invoke] invokes the message. The forwardInvocation is like a distribution center for unrecognized messages and can translate one message to another or simply “eat” some messages. So it doesn’t collapse without processing

The disassembly

DoesNotRecognizeSelector doesNotRecognizeSelector doesNotRecognizeSelector doesNotRecognizeSelector doesNotRecognizeSelector doesNotRecognizeSelector doesNotRecognizeSelector Explore the specific process

__forwarding_prep_0___ is the CoreFoundation system library CoreFoundation download link after downloading CoreFoundation library code, global search in the source code is not found, indicating that this content is not provided by Apple

3. Hoper disassembly CF

Hopper disassembler, we disassembler CoreFoundation executable, to find __forwarding_prep_0___, CoreFoundation executable how to obtain

image listYou can obtain the list of all image filesCoreFoundationFile path to

A global search for __forwarding_prep_0___ finds only one, and __forwarding__ is called, entering the __forwarding__ method

  • ifforwardingTargetForSelectorMethod not implemented, jumploc_116064process
  • ifforwardingTargetForSelectorMethod returns nil, jumploc_116064process

At this point, the slow forwarding process is entered

  • ifmethodSignatureForSelectorNo direct jump toloc_1163e3process
  • ifmethodSignatureForSelectorReturn value is equal tonilJump toloc_11645eprocess
  • ifmethodSignatureForSelectorObject that returns signature information

  • loc_1163e3Flow: Directly report an error and jump toloc_116457process
  • loc_116457Process:doesNotRecognizeSelectorCollapse treatment

  • loc_11645eProcess:doesNotRecognizeSelectorCollapse treatment

Returns the forwardInvocation method with signature information to handle the transaction