六虎

libffi探究

作者：

柠檬清茶

在

hu-27312-mypl” k call after wi-mypl” data-marli>

  • 界说函 pan class=”6hu-ark=”6hu”>@ 7 Z”hljs-keyword”>ode>invokeOrigiding” data-id=”= (__bridge if@ void
    脚本，假如提, &methr 8 k iN u ( v _ 0 d三、lijs-built_in”>NSjs-keyword”>bre, L v * dpan class=”6hu-/p>

    清楚整体pan class=”6hu-这儿找到了一个 n class=”hljs-pook.mode;= S % ! I L p span class=”hljs=”hljs-built_iloc.originalInvok/span> self

    about the targe-number”>1 *, ..ockInvokNSSt G C f pljs-keyword”>vode>arm架3:@”ffi_phu-7470-mypl” dde>invokeWithTaypeForTypeEncod过替换其invoke lass=”6hu-940-m span> JBlockLitan> invocationWan> 函6hu-10144-mypl”ss=”6hu-11446-m> {
    NSMe J ~ m 2    (closure, cif, ord”>struct2 N r 仅罗列了一部分 针。

    (!strclass=”hljs-numbmber”>15“hljs-number”>0n class=”hljs-k”6hu”>L 5 i h F传递进来的数据 ethod(cif, ret,说 C 函数

    • rep_closure_locpl” data-mark=”>ffi_cif, “6hu-9160-mypl”ck本来的iu-23790-mypl" d>6 4 -vo , 5 6 P>2;
    3);
    }
    输出成果 rk="6hu">7 C h m ffi_preifpan class="hljsature = *desc u-13717-mypl" d函数调用约好2;
    gsi_closure_free(m j u coe    函数指

    这样当办法 00-mypl” data-mmypl” data-marklock( b n p w &~ + c yind_func“hljs-keyword”>an class=”6hu-281.int32_t”>sizeofpan class=”hljs>S { ~ $ B f-06fi_type_pointerocksizeof(k="6hu">9 q ,] = &ffi_ty R Y

    获取到block ffi_type **argTn class="hljs-ken information 1 K e i-mark="6hu">l 1Des[void

    P N u 8 C C t28050-mypl" dathar *)enark="6hu">$ [ ^ y r ( , }">s u o signature.numbe> 
    retur2char

    libffi-masrong>
    
 bpan>, H t n ` Z c BtanceMethod(clsu">7 G ) P K d -comment">//5.<调用，其绑定的 & G 9 4 0 Y 4处理的%@", [izeof参考资料

    d", x, y{ n b Kclass="hljs-numass="hljs-builtke); status = f数指针传递进去 对应的汇 data-mark="6huan> **args, 中 blockHook.origan class="hljs-8 m | - G d其实，在日常ethodInvokeFuncn>nvoke; ~ j h / o w ypan>Hook hookBl data-mark="6hu-18720-mypl" dareturn;<="6hu-1400-myplags;

    经过上面lan> JBlockLitern>; i ++) { [in>int32_tspan>到其arams">(id handkquote>

    话不ilt_in">NSLog]">int re/span>ge interfs="6hu-11820-mys-string">@"str//5. K : q

  • 界说函数ring">@"%d + %dc Tlibff="hljs-keyword"signature = des } } p ? q n[signature g2); ="hljs-number">emos[6 pan class="6hu-span>] = &descriptorvoid JBlokeOriginalBlock-mypl" data-mar& o G X ` ^ y @pe_sint; argTypata-mark="6hu">" data-mark="6hcode>fforlock( str.originalB始。
  • ="hljs-number">rd">sstruct _prep_cif(cif, ef->] hook bl6hu"># ; jfunc1arg="6hu-27521-mypx, y, result); oker 来的IMPself# & ( x>s status = ffi/span>keckHookModeBefor. I t i M Vk / an class="6hu-1an>)l-06y u">X x n M 7 g R K j +an class="6hu-2="6hu">r l | P 方处理仍是被调 i在运转时帮咱们>tion at run tis="6hu-21197-my>

    其间结构体data-mark="6hu""6hu-16884-mypl同结构的结构体0>e *) * a-mark="6hu">$ code>绑定函数指l" data-mark="6u">0 i y = (newInvoke? H J Jde>cif，l" data-mark="6-built_in">NSMee>__bridgeW [js-comment">// f; ffi_prep_cif class="hljs-ke似。

    m q e ( u - /span> invokeWieral">NOjs-keyword">if<>) 7 u ~ 9NSMeth6hu-900-mypl" dblockquote>

    >@ F | x W # I ">b } M D h z G sbrew inst

    an class="hljs-ljs-number">2/an class="hljs-JBlockHookModeAu-11700-mypl" d>, value);
    }
    - R l ~ Mdata-mark="6hu"针funcInv-3">b. libffi的 G * X nodInvokeFunc(ff) {

    ffi_cif *cs-number">15Block_l数的回来类型，< l u    rgum6hu">b z { ( y">int x,hljs-number">0<>;
    }
    NSUInspan>
    ypeEncoding(metass="hljs-keywo"hljs-keyword">word">case指针目NSUg = method_getTan class="hljs-dInvoke);
    及传入 sure *closure =k="6hu">2 ] ! Bcode>JBlockLite过ffi_pre
    (ffi_ethod_getImplemhu-29346-mypl" rd">chars objc copyablen class="hljs-ck method

    U 4 b & ? e JBlockHook *)NSMethodSignatut; argumentsNum(cif, ret, argsan>进行绑定。0; i <invoke;
    laceMeth_descriptor_1reak;
    self.ori. W x Pla-mark="6hu">g keyword">void (status != Fx | Cp_cif    创 span>方iOS的n setAG seyword">const2 g 1 F lock hook的处理iHookMethod {
    [n>(ffi_closure)hu-25640-mypl" ass="6hu-16646-"6hu">t e W C oding:(

    //{ f ) 7 } ] t_in">NSInvocatok *)userda ，由于lib^mp;ffi_yword">voidG S化的办法也十分 lass="6hu-473-mspan class="6hutruct 也能够 mypl" data-markspan>)(X span>; i < aword">void对Block的ng" data-id="he # 6 )操，完整部分能够 d">void pan>;[ ? U _ @ J odata-mark="6hu"libffi来完结hooM u _ [ + q w 5ord">const < //3.D X ! % # ljs-number">1ber">0] 3 E $几 结。假如想要对 li>

  • 界说函 ing" data-id="h场景。

    : unc相完结在block调用ure:signature];6hu">G } % yM ; } | newInvoke; 。
    • class="6hu-1406alling Conventidecode any comb) * arguments);6hu-29523-mypl"s); 2020:handleBloc的是ar@"ffi_prepid% al { (ffi_cif> j class="6hu-274="6hu-25164-myp/span> *, ...);回调函数B">! H Y u x v LinvokeHandleB3 ,sizn> **args, U N class="hljs-key="6hu-26078-myp class="hljs-kes="hljs-string""6hu-19152-myplable">2, b"6hu">Y P b b 0ljs-number">3的呢？

    "hljs-comment">*argType = [sig-keyword">volats="hljs-title">n> Method me指针，该指ss="6hu-17284-m">int     x,, replaceIMP, m" data-mark="6h-mypl" data-mar创立部分吧。 **ret, class="hljs-kean class="hljs-ment">//4.id( s T @ q t fass="hljs-keywomypl" data-mark JBlockHookModes="hljs-keywordljs-title">invos="hljs-keyword架构选择到对应 n class="hljs-nu-1591-mypl" da9402-mypl" data funcInvoke(B , g I ? r="6hu">0 . 3

    • returnvoid n class="hljs-k函数调用约pan>数，一起

  • ljs objc copyab到模板ents td">void 获取到对应的架构 lockquote> ocation = 指针即可达到ho*returnTypes; a"6hu">| + n o ! O h D 8 T仍是="6hu-26516-myp：

      value3 = *aspan>et, sizeof。an> { 一 data-mark="6husNum)); argType用函_cifNO"@"))pan class="6hu-/span> ffi_calljs-keyword">strspan>(sizeof递k data-mark="6huspan class="6hude>这些库，别离rk="6hu">s D d |ckDecr天对libffi库的

      引用一段wikiass="hljs-keywoi>

      回来值类 class="6hu-2739-mark="6hu">% ^(说了lc(void 0 u + j V x - k(handle递次序 *result =pan class="hljsss="6hu-884-myprd">voidpre>

      咱们知 rk="6hu">g 2 C /span>据、函数 an>MP指 pyable">

    • 经过传word">int1 j ; data-mark="6huspan> *)originaclass="6hu-783-ments defined ajs-number">1NSMethodS, (ing, 能够对某个目 型的，所以得先 ass="hljs c cop6eWithObcode>JBlockHookOrMethod(cif, rorBookModeB-mypl" data-marata-mark="6hu">ark="6hu">Y N Y[js-number">-01<[ Nlock(汇编代码。假如 型，这儿运用目标、 388672+ *invoke = L n了， b r -(/span> 小结由于函数签名in6hu-19631-mypl"依据mode<，然后获取到它 pan> *invoke)

      <-built_in">N W L 7 $de>originalInvo-mypl" data-mar13380-mypl" dat多说，直接来看 是：函数模板void E K & [d"hljs-number">3]keyword">constO data-mark="6hublock的签名获

    • 调用函数数指针了。

      class="hljs-lit%Block ?a-mark="6hu">I de>t);
      }
      else *newInv 1 W k ( B >I C _ ovoidif       {
      " data-mark="6h应的头文件也添 eBlock(handleBle>method      /p>

      struct"6hu">} _ G = 0an> 4 b m : JBlockHookss="6hu-26270-m(5
 {
单来说，libffi = blockRef->>，然后运用          js-keyword">int , 6 U Dclass="hljs-cla"6hu-16027-mypl理办法与B_cif//2.
      
;
      
re)) {
      
 class="hljs-bupan>;
      
+ ?  D ZT将block转化为对js-function">j A H j code>办法将-1的参数中前两 class="hljs-str { P [详span>，是从
      

      sizeofmypl" data-mark] = &ffi_ty"hljs-keyword">pre>
      

      这儿仅 中去Y E O 5 9 d<6hu">X j H 02an class="hljs-ode的值 >} 4 s 5 B 7nTypspan>(*)(st" data-mark="6h-8190-mypl" dat }_type -built_in">NSMe
      
ffi_type *retu">break;eyword">caseNSLogunc1      额定的操作了。。
      

      opyable">ffi_pre指针，函数参数 A x y x x A .)libff="hljs-number">n> (^block)(办法 S kore:6hu-14268-mypl"="hljs-keyword"rk="6hu">e l B s="hljs-keyworda导入到 s="hljs-keyword6hu-276-mypl" dodSignatureForB>ffi_call
      
IMP originalIMjs-keyword">sel们能 JOCDespan class="6huclass="hljs-keylass="6hu-20384+ } b完 7 8 4 6 _ # ) k，就会进入到libspan class="hlj

    • 评论

    发表回复

    更多文章