void ____forwarding___(int arg0, int arg1) {
r29 = &saved_fp;
r31 = r31 + 0xffffffffffffffa0 - 0x120;
r19 = &var_170;
r25 = arg1;
r20 = arg0;
r21 = *(int128_t *)arg0;
r22 = *(int128_t *)(arg0 + 0x8);
if ((r21 & 0xffffffff80000000) == 0x0) goto loc_11bae4;
loc_11ba84:
r9 = *_objc_debug_taggedpointer_obfuscator;
r9 = *r9;
reg_zero = 0xc000000000000007 & !r21;
if (reg_zero == 0x0) {
if (!CPU_FLAGS & E) {
r9 = r9;
}
else {
r9 = 0x0;
}
}
r8 = 0x0;
r10 = (r9 ^ r21) & 0x7;
goto loc_11bab0;
loc_11bab0:
if (r10 == *(int8_t *)(*_objc_debug_tag60_permutations + r8)) goto loc_11bacc;
loc_11babc:
r8 = r8 + 0x1;
if (r8 != 0x7) goto loc_11bab0;
loc_11bad4:
asm { ubfx x8, x9, #0x37, #0x8 };
r8 = r8 + 0x8;
goto loc_11badc;
loc_11badc:
if ((r8 & 0xffff) == 0x0) goto loc_11be90;
loc_11bae4:
r0 = object_getClass(r21);
r23 = r0;
r24 = class_getName(r0);
if (class_respondsToSelector(r23, @selector(forwardingTargetForSelector:)) == 0x0) goto loc_11bb2c;
loc_11bb10:
r0 = [r21 forwardingTargetForSelector:r2];
if (r0 != 0x0) {
asm { ccmp x0, x21, #0x4, ne };
}
if (CPU_FLAGS & NE) goto loc_11bde4;
loc_11bb2c:
if (strncmp(r24, "_NSZombie_", 0xa) == 0x0) goto loc_11bea4;
loc_11bb44:
if ((class_respondsToSelector(r23, @selector(methodSignatureForSelector:)) & 0x1) == 0x0) goto loc_11bf10;
loc_11bb5c:
r0 = [r21 methodSignatureForSelector:r2];
if (r0 == 0x0) goto loc_11bf7c;
loc_11bb70:
r23 = r0;
r0 = [r0 _frameDescriptor];
r24 = r0;
r8 = *r0;
r8 = *(int16_t *)(r8 + 0x22);
asm { ubfx x8, x8, #0x6, #0x1 };
if (r8 != r25) {
r0 = sel_getName(r22);
r8 = *r24;
r8 = *(int16_t *)(r8 + 0x22);
if ((r8 & 0x40) == 0x0) {
if (!CPU_FLAGS & E) {
r8 = "";
}
else {
r8 = " not";
}
}
r9 = "";
if (r25 == 0x0) {
if (!CPU_FLAGS & E) {
r9 = "";
}
else {
r9 = " not";
}
}
_CFLog(0x4, @"*** NSForwarding: warning: method signature and compiler disagree on struct-return-edness of '%s'. Signature thinks it does%s return a struct, and compiler thinks it does%s.");
r31 = (r31 - 0x20) + 0x20;
}
r0 = object_getClass(r21);
r0 = class_respondsToSelector(r0, @selector(_forwardStackInvocation:));
r22 = r0;
if (r0 == 0x0) goto loc_11bcd4;
loc_11bc08:
r8 = *____forwarding___.onceToken;
*(int32_t *)(r19 + 0xc) = r22;
if (r8 != -0x1) {
dispatch_once(0x698620, 0x664c80);
}
objc_opt_self(@class(NSInvocation));
r0 = [r23 frameLength];
r26 = r0 + 0x140;
r22 = *0x698618;
r25 = &var_170 - (r22 + 0xf & 0xfffffffffffffff0);
bzero(r25, r22);
bzero(r25, r22);
bzero(&var_170 - (r28 + 0x14f & 0xfffffffffffffff0), r26);
objc_constructInstance(*0x698610, r25);
-[NSInvocation _initWithMethodSignature:frame:buffer:size:](r25, r25, r23, r20, &var_170 - (r28 + 0x14f & 0xfffffffffffffff0), r26);
[r21 _forwardStackInvocation:r2];
r22 = *(int32_t *)(r19 + 0xc);
goto loc_11bd24;
loc_11bd24:
if (*(int8_t *)(r25 + 0x34) != 0x0) {
r8 = *r24;
if ((*(int8_t *)(r8 + 0x22) & 0x80) != 0x0) {
r9 = *(r25 + 0x8);
r10 = *(int32_t *)(r8 + 0x1c);
r11 = *(int8_t *)(r8 + 0x20);
memmove(*(r20 + r11 + r10), *(r9 + r11 + r10), *(int32_t *)(*r8 + 0x10));
}
}
r0 = [r23 methodReturnType];
r8 = *(int8_t *)r0;
if (r8 != 0x76 && (r8 != 0x56 || *(int8_t *)(r0 + 0x1) != 0x76)) {
r20 = *(r25 + 0x10);
if (r22 != 0x0) {
r20 = [[NSData dataWithBytes:r20 length:r26] bytes];
[r25 release];
}
}
else {
if (r22 != 0x0) {
[r25 release];
}
r20 = 0x698628;
}
goto loc_11be50;
loc_11be50:
if (**___stack_chk_guard != **___stack_chk_guard) {
__stack_chk_fail();
}
return;
loc_11bcd4:
if (class_respondsToSelector(object_getClass(r21), @selector(forwardInvocation:)) == 0x0) goto loc_11bf58;
loc_11bcf0:
r25 = [NSInvocation _invocationWithMethodSignature:r23 frame:r20];
[r21 forwardInvocation:r2];
r26 = 0x0;
goto loc_11bd24;
loc_11bf58:
____forwarding___.cold.4(r19 + 0x10, r21);
return;
loc_11bf7c:
r0 = sel_getName(r22);
r20 = r0;
r0 = sel_getUid(r0);
if (r0 != r22) {
_CFLog(0x4, @"*** NSForwarding: warning: selector (%p) for message '%s' does not match selector known to Objective C runtime (%p)-- abort");
}
if (class_respondsToSelector(object_getClass(r21), @selector(doesNotRecognizeSelector:)) != 0x0) {
r1 = @selector(doesNotRecognizeSelector:);
r0 = objc_msgSend(r21, r1);
asm { brk #0x1 };
loc_11bfe4(r0, r1);
}
else {
____forwarding___.cold.3(r21);
}
return;
loc_11bf10:
r23 = class_getSuperclass(r23);
r20 = object_getClassName(r21);
if (r23 == 0x0) {
object_getClassName(r21);
_CFLog(0x4, @"*** NSForwarding: warning: object %p of class '%s' does not implement methodSignatureForSelector: -- did you forget to declare the superclass of '%s'?");
r31 = (r31 - 0x20) + 0x20;
}
else {
_CFLog(0x4, @"*** NSForwarding: warning: object %p of class '%s' does not implement methodSignatureForSelector: -- trouble ahead");
r31 = r31 + 0x0;
}
goto loc_11bf7c;
loc_11bea4:
____forwarding___.cold.2(r21, r24, r22);
return;
loc_11bde4:
if ((r0 & 0xffffffff80000000) == 0x0) goto loc_11be48;
loc_11bde8:
r9 = *_objc_debug_taggedpointer_obfuscator;
r9 = *r9;
reg_zero = 0xc000000000000007 & !r0;
if (reg_zero == 0x0) {
if (!CPU_FLAGS & E) {
r9 = r9;
}
else {
r9 = 0x0;
}
}
r8 = 0x0;
r10 = (r9 ^ r0) & 0x7;
goto loc_11be14;
loc_11be14:
if (r10 == *(int8_t *)(*_objc_debug_tag60_permutations + r8)) goto loc_11be30;
loc_11be20:
r8 = r8 + 0x1;
if (r8 != 0x7) goto loc_11be14;
loc_11be38:
asm { ubfx x8, x9, #0x37, #0x8 };
r8 = r8 + 0x8;
goto loc_11be40;
loc_11be40:
if ((r8 & 0xffff) == 0x0) goto loc_11be8c;
loc_11be48:
*r20 = r0;
r20 = 0x0;
goto loc_11be50;
loc_11be8c:
r21 = r0;
goto loc_11be90;
loc_11be90:
if (dyld_program_sdk_at_least() == 0x0) goto loc_11becc;
loc_11bea0:
____forwarding___.cold.1();
return;
loc_11becc:
r0 = _getAtomTarget(r21);
*r20 = r0;
___invoking___(*_objc_msgSend, r20, r20, 0x400);
if (*r20 == r22) {
*r20 = r21;
}
goto loc_11be50;
loc_11be30:
if (r8 == 0x7) {
asm { ubfx x8, x9, #0x37, #0x8 };
r8 = r8 + 0x8;
}
goto loc_11be40;
loc_11bacc:
if (r8 == 0x7) {
asm { ubfx x8, x9, #0x37, #0x8 };
r8 = r8 + 0x8;
}
goto loc_11badc;
}
Runtime消息转发____forwarding___函数的伪代码
©著作权归作者所有,转载或内容合作请联系作者
- 文/潘晓璐 我一进店门,熙熙楼的掌柜王于贵愁眉苦脸地迎上来,“玉大人,你说我怎么就摊上这事。” “怎么了?”我有些...
- 文/花漫 我一把揭开白布。 她就那样静静地躺着,像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上,一...
- 文/苍兰香墨 我猛地睁开眼,长吁一口气:“原来是场噩梦啊……” “哼!你这毒妇竟也来了?” 一声冷哼从身侧响起,我...
推荐阅读更多精彩内容
- 消息转发流程 通过 Hooper[https://www.hopperapp.com/] 反汇编查找相关代码 id...
- 本文Demo传送门: MessageForwardingDemo 摘要:编程,只了解原理不行,必须实战才能知道应用...
- 紧接着上一篇传送门:Runtime源码分析系列(三)之方法查找C/C++递归部分 下面直奔主题,开始本节分析内容:...