协议名字

Snip20200423_50.png

从上面这张图可以看到第一个地址是0000000100009068，这个地址是虚拟地址，需要将它转换为文件偏移地址。计算公式如下:

文件偏移地址 = 虚拟地址 - 模块在内存中地址 + 模块在文件中的偏移

Snip20200423_51.png

Snip20200423_52.png

Snip20200423_54.png

第二个地址：00000001000090C8 ，同理可求得偏移地址 = 00000001000090C8 - 0000000100000000 + 0x00018000 = 0x210C8

Snip20200423_58.png

Snip20200423_59.png

** 第三个地址 ** 0000000100009128，同理可求得偏移地址 = 0000000100009128 - 0000000100000000 + 0x00018000 = 0x21128

Snip20200423_60.png

Snip20200423_61.png

分类名字

Snip20200423_55.png

Snip20200423_56.png

Snip20200423_57.png

类名字

Snip20200423_62.png

objc的类源码

struct objc_object {
private:
    isa_t isa;//8 个字节
}

struct objc_class : objc_object {
    // Class ISA;
    Class superclass;//8 个字节
    cache_t cache;             // formerly cache pointer and vtable
    class_data_bits_t bits;    // class_rw_t * plus custom rr/alloc flags

}

struct cache_t {
    struct bucket_t *_buckets;//结构体8个字节
    mask_t _mask;//typedef uint32_t mask_t; 由此可知mask_t占用4个字节
    mask_t _occupied;//4个字节
}

struct class_rw_t {
    // Be warned that Symbolication knows the layout of this structure.
    uint32_t flags;
    uint32_t version;

    const class_ro_t *ro;

    method_array_t methods;
    property_array_t properties;
    protocol_array_t protocols;

    Class firstSubclass;
    Class nextSiblingClass;

    char *demangledName;
}
struct class_ro_t {
    uint32_t flags;
    uint32_t instanceStart;
    uint32_t instanceSize;
#ifdef __LP64__
    uint32_t reserved;
#endif

    const uint8_t * ivarLayout;
    
    const char * name;
    method_list_t * baseMethodList;
    protocol_list_t * baseProtocols;
    const ivar_list_t * ivars;

    const uint8_t * weakIvarLayout;
    property_list_t *baseProperties;

    method_list_t *baseMethods() const {
        return baseMethodList;
    }
};

Snip20200423_64.png

2.0以后，类的相关属性方法等都是从data中获取，所以这里我们取到是0x20FA0偏移32个字节的值0000000100008578

Snip20200423_65.png

方法虚拟地址为0x0000000100006c25
0x18000 + (0x100006c25 - 0x100000000) = 0x1EC25 获取偏移地址

Snip20200423_66.png

方法解析

从上面可以知道class_ro_t 有一个baseMethodList属性，其中保存的就是类的实力方法。前面读取的类是CustomClass，对应读取的值是0000000100008478.。对应的文件偏移 = 0000000100008478 - 0000000100000000 + 0x00018000 = 0x20478;

查看method_list_t 的源码

struct entsize_list_tt {
    uint32_t entsizeAndFlags;
    uint32_t count;
    Element first;
}
struct method_list_t : entsize_list_tt<method_t, method_list_t, 0x3> {
    bool isFixedUp() const;
    void setFixedUp();

    uint32_t indexOfMethod(const method_t *meth) const {
        uint32_t i = 
            (uint32_t)(((uintptr_t)meth - (uintptr_t)this) / entsize());
        assert(i < count);
        return i;
    }
};

struct method_t {
    SEL name;
    const char *types;
    MethodListIMP imp;
};

Snip20200423_68.png

Snip20200423_69.png

Snip20200423_70.png

其他方法同理可得哈！
第二个name 00000001000077D6，求得对应的文件偏移 = 00000001000077D6 - 0000000100000000 + 0x00018000 = 0x1EDB0

https://www.jianshu.com/p/4b5b369cb855