存储方式

• NSUserDefault，可以存放Key-Value对形式的轻量数据。
• NSKeyedArchiver，存储对象到二进制文件。
• writeToFile，将NSString、NSArray、NSDictionary、NSData对象存储到文件。
• CoreData.Framework，对象管理并支持对象持久。
• Sqlite，轻量数据库
• Keychain，钥匙串存储
• NSUbiquitousKeyValueStore，存储数据到iCloud

关于安全性

• 敏感数据不要明文存储
• 存放在Keychain，不越狱还是安全的
• Safety is relative, choose a safer way.

三方库

概述

本文简单罗列了下iOS相关的点。

基础

• Runloop

• 苹果官方的APNS，支持App不同状态下（前台、后台、未启动等）的消息推送。

• 另外个方案是，App和应用服务间维护一个长链接，应用服务通过心跳感知App状态。当App为在线状态时，应用服务可以通过该长链接推送消息。一般跟APNS配合使用。

• 自己的项目中使用的是友盟推送。

• 在Push消息中设置自定义参数，App在- (void)application:(UIApplication *)application didReceiveRemoteNotification:(NSDictionary *)userInfo收到消息后解析参数并做相应逻辑（如跳转到相应页面等）

- (void)application:(UIApplication *)application didRegisterForRemoteNotificationsWithDeviceToken:(NSData *)deviceToken {
    NSLog(@"didRegisterForRemoteNotificationsWithDeviceToken");
    
    // 注册用户登录登出监听
    [self handleRemoteNotificationDidRegistered];
}

- (void)application:(UIApplication *)application didFailToRegisterForRemoteNotificationsWithError:(NSError *)error {
    NSLog(@"didFailToRegisterForRemoteNotificationsWithError");
}

- (void)application:(UIApplication *)application didReceiveRemoteNotification:(NSDictionary *)userInfo {
    NSLog(@"didReceiveRemoteNotification");
    
    [UMessage didReceiveRemoteNotification:userInfo];
    
    NSString *jsonString = [userInfo objectForKey:@"custom"];
    NSData *jsonData = [jsonString dataUsingEncoding:NSUTF8StringEncoding];
    NSDictionary *dic = [NSJSONSerialization JSONObjectWithData:jsonData
                                                        options:NSJSONReadingMutableContainers
                                                          error:nil];
    if (dic==nil || [dic isEqual:[NSNull null]]) {
        return;
    }

    [self handleRemoteNotification:dic];
}

其他一些资料

概述

+load

• +load方法只会被执行一次，且是在程序加载阶段，这时运行环境并不完备。
• 不同类或类别的+load方法会按一定顺序被执行。

1、依赖库的`+load`。
2、当前库`+load`，`class`的`+load`优先于`category`，父`class`优先于子`class`。
3、当前库的`All C++ static initializers and C/C++ __attribute__(constructor) functions`。
4、被依赖库的`+load`。

• 在+load方法中可以安全地发送消息给当前库内其他类的消息，虽然这些类的+load可能还没有执行过。

• 从源码中，也可以看出class的+load优先于category，父class优先于子class。

void prepare_load_methods(const headerType *mhdr)
{
    size_t count, i;

    runtimeLock.assertWriting();

    classref_t *classlist = 
        _getObjc2NonlazyClassList(mhdr, &count);
    for (i = 0; i < count; i++) {
        schedule_class_load(remapClass(classlist[i]));
    }

    category_t **categorylist = _getObjc2NonlazyCategoryList(mhdr, &count);
    for (i = 0; i < count; i++) {
        category_t *cat = categorylist[i];
        Class cls = remapClass(cat->cls);
        if (!cls) continue;  // category for ignored weak-linked class
        realizeClass(cls);
        assert(cls->ISA()->isRealized());
        add_category_to_loadable_list(cat);
    }
}

static void schedule_class_load(Class cls)
{
    if (!cls) return;
    assert(cls->isRealized());  // _read_images should realize

    if (cls->data()->flags & RW_LOADED) return;

    // Ensure superclass-first ordering
    schedule_class_load(cls->superclass);

    add_class_to_loadable_list(cls);
    cls->setInfo(RW_LOADED); 
}

initialize

• 向类或对象发送消息时，会调用lookUpImpOrForward查找，并会检查是否初始化过，如果没有，则会调用_class_initialize做初始化。

IMP lookUpImpOrForward(Class cls, SEL sel, id inst, 
                       bool initialize, bool cache, bool resolver)
{
    // ...

    if (initialize  &&  !cls->isInitialized()) {
        _class_initialize (_class_getNonMetaClass(cls, inst));
        // If sel == initialize, _class_initialize will send +initialize and 
        // then the messenger will send +initialize again after this 
        // procedure finishes. Of course, if this is not being called 
        // from the messenger then it won't happen. 2778172
    }

    // ...

    return imp;
}

参考

Method的几个概念

• Method包含方法名Selector、函数地址IMP、参数类型TypeEncoding。

NSLog(@"    method name = %s", sel_getName(method_getName(method)));
NSLog(@"    method type encode = %s", method_getTypeEncoding(method));
NSLog(@"    NumberOfArguments = %d", method_getNumberOfArguments(method));
NSLog(@"    ReturnType = %s", method_copyReturnType(method));

2016-04-08 20:54:59.351 OCRuntime[54195:953880]     method name = setNumberProperty:
2016-04-08 20:54:59.352 OCRuntime[54195:953880]     method type encode = v24@0:8@16
2016-04-08 20:54:59.352 OCRuntime[54195:953880]     NumberOfArguments = 3
2016-04-08 20:54:59.352 OCRuntime[54195:953880]     ReturnType = v

动态修改Method的几个接口

// 设置或交换IMP
IMP method_setImplementation(Method m, IMP imp);
void method_exchangeImplementations(Method m1, Method m2);

BOOL class_addMethod(Class cls, SEL name, IMP imp, const char *types);
                                 
// 如果原来没有这个方法，则直接添加Method，效果同class_addMethod
// 如果原来有，则替换掉原来的IMP，忽略参数类型
IMP class_replaceMethod(Class cls, SEL name, IMP imp, const char *types);

• 例子：

+ (void)load {
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        Class class = [self class];

        // When swizzling a class method, use the following:
        // Class class = object_getClass((id)self);

        SEL originalSelector = @selector(viewWillAppear:);
        SEL swizzledSelector = @selector(xxx_viewWillAppear:);

        Method originalMethod = class_getInstanceMethod(class, originalSelector);
        Method swizzledMethod = class_getInstanceMethod(class, swizzledSelector);

        BOOL didAddMethod =
            class_addMethod(class,
                originalSelector,
                method_getImplementation(swizzledMethod),
                method_getTypeEncoding(swizzledMethod));

        if (didAddMethod) {
            class_replaceMethod(class,
                swizzledSelector,
                method_getImplementation(originalMethod),
                method_getTypeEncoding(originalMethod));
        } else {
            method_exchangeImplementations(originalMethod, swizzledMethod);
        }
    });
}

参考

消息发送

• 对象方法的调用就是向该对象发送消息。

    OCHelper *object = [[OCHelper alloc] init];
    
    // 以下两句代码效果是相同的。
    [object onHandler];
    objc_msgSend(object, @selector(onHandler));

• 编译阶段，会自动将OC方法调用转化成内联的objc_msgSend方法调用。

消息转发

• 有了OC的消息机制，就可以在运行时修改消息执行路径。

• objc_msgSend会调用lookUpImpOrForward从类（或父类）的methodsCache或methodList寻找方法。

• lookUpImpOrForward的源码如下：

IMP lookUpImpOrForward(Class cls, SEL sel, id inst, 
                       bool initialize, bool cache, bool resolver)
{
    Class curClass;
    IMP methodPC = nil;
    Method meth;
    bool triedResolver = NO;

    methodListLock.assertUnlocked();

    // Optimistic cache lookup
    if (cache) {
        methodPC = _cache_getImp(cls, sel);
        if (methodPC) return methodPC;    
    }

    // Check for freed class
    if (cls == _class_getFreedObjectClass())
        return (IMP) _freedHandler;

    // Check for +initialize
    if (initialize  &&  !cls->isInitialized()) {
        _class_initialize (_class_getNonMetaClass(cls, inst));
        // If sel == initialize, _class_initialize will send +initialize and 
        // then the messenger will send +initialize again after this 
        // procedure finishes. Of course, if this is not being called 
        // from the messenger then it won't happen. 2778172
    }

    // The lock is held to make method-lookup + cache-fill atomic 
    // with respect to method addition. Otherwise, a category could 
    // be added but ignored indefinitely because the cache was re-filled 
    // with the old value after the cache flush on behalf of the category.
 retry:
    methodListLock.lock();

    // Ignore GC selectors
    if (ignoreSelector(sel)) {
        methodPC = _cache_addIgnoredEntry(cls, sel);
        goto done;
    }

    // Try this class's cache.

    methodPC = _cache_getImp(cls, sel);
    if (methodPC) goto done;

    // Try this class's method lists.

    meth = _class_getMethodNoSuper_nolock(cls, sel);
    if (meth) {
        log_and_fill_cache(cls, cls, meth, sel);
        methodPC = method_getImplementation(meth);
        goto done;
    }

    // Try superclass caches and method lists.

    curClass = cls;
    while ((curClass = curClass->superclass)) {
        // Superclass cache.
        meth = _cache_getMethod(curClass, sel, _objc_msgForward_impcache);
        if (meth) {
            if (meth != (Method)1) {
                // Found the method in a superclass. Cache it in this class.
                log_and_fill_cache(cls, curClass, meth, sel);
                methodPC = method_getImplementation(meth);
                goto done;
            }
            else {
                // Found a forward:: entry in a superclass.
                // Stop searching, but don't cache yet; call method 
                // resolver for this class first.
                break;
            }
        }

        // Superclass method list.
        meth = _class_getMethodNoSuper_nolock(curClass, sel);
        if (meth) {
            log_and_fill_cache(cls, curClass, meth, sel);
            methodPC = method_getImplementation(meth);
            goto done;
        }
    }

    // No implementation found. Try method resolver once.

    if (resolver  &&  !triedResolver) {
        methodListLock.unlock();
        _class_resolveMethod(cls, sel, inst);
        triedResolver = YES;
        goto retry;
    }

    // No implementation found, and method resolver didn't help. 
    // Use forwarding.

    _cache_addForwardEntry(cls, sel);
    methodPC = _objc_msgForward_impcache;

 done:
    methodListLock.unlock();

    // paranoia: look for ignored selectors with non-ignored implementations
    assert(!(ignoreSelector(sel)  &&  methodPC != (IMP)&_objc_ignored_method));

    return methodPC;
}

• 如果找到方法，则直接执行。
• 如果没有找到方法，则提供一套Hock机制，允许运行时解决。
• NSObject提供了些可重载的方法，如下：

@interface NSObject
- (id)forwardingTargetForSelector:(SEL)aSelector;
- (void)forwardInvocation:(NSInvocation *)anInvocation;
- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector;
+ (BOOL)resolveClassMethod:(SEL)sel;
+ (BOOL)resolveInstanceMethod:(SEL)sel;
@end

• 如果没有找到方法，会先调用resolveInstanceMethod，在该方法中可动态添加方法到类。

• 如果不行，接下来会调用forwardingTargetForSelector转发，可动态替换掉响应对象。
• 如果还不行，则调用methodSignatureForSelector和forwardInvocation转发Invocation。
• 如果还不行，则会抛异常doesNotRecognizeSelector。

参考

关联对象

• 提供了三个方法，分别是get、set、remove

void objc_setAssociatedObject(id object, const void *key, id value, objc_AssociationPolicy policy);
id objc_getAssociatedObject(id object, const void *key);
void objc_removeAssociatedObjects(id object);

源码

• 获取

id _object_get_associative_reference(id object, void *key) {
    id value = nil;
    uintptr_t policy = OBJC_ASSOCIATION_ASSIGN;
    {
        AssociationsManager manager;
        AssociationsHashMap &associations(manager.associations());
        disguised_ptr_t disguised_object = DISGUISE(object);
        AssociationsHashMap::iterator i = associations.find(disguised_object);
        if (i != associations.end()) {
            ObjectAssociationMap *refs = i->second;
            ObjectAssociationMap::iterator j = refs->find(key);
            if (j != refs->end()) {
                ObjcAssociation &entry = j->second;
                value = entry.value();
                policy = entry.policy();
                if (policy & OBJC_ASSOCIATION_GETTER_RETAIN) ((id(*)(id, SEL))objc_msgSend)(value, SEL_retain);
            }
        }
    }
    if (value && (policy & OBJC_ASSOCIATION_GETTER_AUTORELEASE)) {
        ((id(*)(id, SEL))objc_msgSend)(value, SEL_autorelease);
    }
    return value;
}

• 设置

void _object_set_associative_reference(id object, void *key, id value, uintptr_t policy) {
    // retain the new value (if any) outside the lock.
    ObjcAssociation old_association(0, nil);
    id new_value = value ? acquireValue(value, policy) : nil;
    {
        AssociationsManager manager;
        AssociationsHashMap &associations(manager.associations());
        disguised_ptr_t disguised_object = DISGUISE(object);
        if (new_value) {
            // break any existing association.
            AssociationsHashMap::iterator i = associations.find(disguised_object);
            if (i != associations.end()) {
                // secondary table exists
                ObjectAssociationMap *refs = i->second;
                ObjectAssociationMap::iterator j = refs->find(key);
                if (j != refs->end()) {
                    old_association = j->second;
                    j->second = ObjcAssociation(policy, new_value);
                } else {
                    (*refs)[key] = ObjcAssociation(policy, new_value);
                }
            } else {
                // create the new association (first time).
                ObjectAssociationMap *refs = new ObjectAssociationMap;
                associations[disguised_object] = refs;
                (*refs)[key] = ObjcAssociation(policy, new_value);
                object->setHasAssociatedObjects();
            }
        } else {
            // setting the association to nil breaks the association.
            AssociationsHashMap::iterator i = associations.find(disguised_object);
            if (i !=  associations.end()) {
                ObjectAssociationMap *refs = i->second;
                ObjectAssociationMap::iterator j = refs->find(key);
                if (j != refs->end()) {
                    old_association = j->second;
                    refs->erase(j);
                }
            }
        }
    }
    // release the old value (outside of the lock).
    if (old_association.hasValue()) ReleaseValue()(old_association);
}

• 释放

id 
object_dispose(id obj)
{
    if (!obj) return nil;

    objc_destructInstance(obj);

    free(obj);

    return nil;
}

void *objc_destructInstance(id obj) 
{
    if (obj) {
        // Read all of the flags at once for performance.
        bool cxx = obj->hasCxxDtor();
        bool assoc = !UseGC && obj->hasAssociatedObjects();
        bool dealloc = !UseGC;

        // This order is important.
        if (cxx) object_cxxDestruct(obj);
        if (assoc) _object_remove_assocations(obj);
        if (dealloc) obj->clearDeallocating();
    }

    return obj;
}

void _object_remove_assocations(id object) {
    vector< ObjcAssociation,ObjcAllocator<ObjcAssociation> > elements;
    {
        AssociationsManager manager;
        AssociationsHashMap &associations(manager.associations());
        if (associations.size() == 0) return;
        disguised_ptr_t disguised_object = DISGUISE(object);
        AssociationsHashMap::iterator i = associations.find(disguised_object);
        if (i != associations.end()) {
            // copy all of the associations that need to be removed.
            ObjectAssociationMap *refs = i->second;
            for (ObjectAssociationMap::iterator j = refs->begin(), end = refs->end(); j != end; ++j) {
                elements.push_back(j->second);
            }
            // remove the secondary table.
            delete refs;
            associations.erase(i);
        }
    }
    // the calls to releaseValue() happen outside of the lock.
    for_each(elements.begin(), elements.end(), ReleaseValue());
}

参考

Ivar

struct old_ivar {
    char *ivar_name;
    char *ivar_type;
    int ivar_offset;
#ifdef __LP64__
    int space;
#endif
};

Property

struct old_property {
    const char *name;
    const char *attributes;
};

Method

struct old_method {
    SEL method_name;
    char *method_types;
    IMP method_imp;
};

protocol

struct old_protocol {
    Class isa;
    const char *protocol_name;
    struct old_protocol_list *protocol_list;
    struct objc_method_description_list *instance_methods;
    struct objc_method_description_list *class_methods;
};

struct objc_method_description *
lookup_protocol_method(old_protocol *proto, SEL aSel, 
                       bool isRequiredMethod, bool isInstanceMethod, 
                       bool recursive)
{
    struct objc_method_description *m = nil;
    old_protocol_ext *ext;

    if (isRequiredMethod) {
        if (isInstanceMethod) {
            m = lookup_method(proto->instance_methods, aSel);
        } else {
            m = lookup_method(proto->class_methods, aSel);
        }
    } else if ((ext = ext_for_protocol(proto))) {
        if (isInstanceMethod) {
            m = lookup_method(ext->optional_instance_methods, aSel);
        } else {
            m = lookup_method(ext->optional_class_methods, aSel);
        }
    }

    if (!m  &&  recursive  &&  proto->protocol_list) {
        int i;
        for (i = 0; !m  &&  i < proto->protocol_list->count; i++) {
            m = lookup_protocol_method(proto->protocol_list->list[i], aSel, 
                                       isRequiredMethod,isInstanceMethod,true);
        }
    }

    return m;
}

category

struct old_category {
    char *category_name;
    char *class_name;
    struct old_method_list *instance_methods;
    struct old_method_list *class_methods;
    struct old_protocol_list *protocols;
    uint32_t size;
    struct old_property_list *instance_properties;
};

参考

Objective-C Runtime

• Objective-C是面向运行时的编程语言，这就意味着运行阶段才知道如何执行，而不是编译链接阶段就确定好。

• What is the Objective-C Runtime?

The Objective-C Runtime is a Runtime Library, it's a library written 
mainly in C & Assembler that adds the Object Oriented capabilities 
to C to create Objective-C. This means it loads in Class information, 
does all method dispatching, method forwarding, etc. The Objective-C 
runtime essentially creates all the support structures that make 
Object Oriented Programming with Objective-C Possible.

• 有了Objective-C Runtime，就有了各种在运行时修改代码的hack手段。

类

• 先看下类的结构体定义，除了存放类的基本信息，还存放对象的变量、方法、协议的元信息。程序加载时，类结构体会被实例化，并放到全局列表中g_classList，结构体的isa、super_class、methodLists等属性也一起被初始化。

// 伪代码，对源码稍做修改。

static Class *g_classList;

struct objc_class {
    Class isa;          // 指向元类
    Class super_class;  // 指向父类
    
    // 类基本信息
    const char *name;
    long version;
    long info;
    long instance_size;
    
    // 类的变量、方法、协议的元信息
    struct objc_ivar_list *ivars;
    struct objc_method_list **methodLists;
    struct objc_protocol_list *protocols;
    
    // 方法缓存
    struct objc_cache *cache;
};
typedef struct objc_class *Class;

bool isMetaClass() {
        return info & CLS_META;
    }

元类

• 元类跟类使用相同的结构体，只是通过isMetaClass方法做区分。

• 元类结构体中，存放类的变量、方法、协议的元信息。

• 对象、类、元类的关系如下：

对象

• 对象的结构体如下，存放对象的变量数据，其他的都是先通过isa找到类，再从类中找出变量、方法等的元信息。

// 伪代码，对源码稍做修改。

struct objc_object {
    Class isa;
    
    // 变量的数据
    void *varsLayout;
}

typedef struct objc_object *id

• 创建对象，NSObject *obj = [[NSObject alloc] init];可能对应以下一些动作。

// 伪代码

{
    // 找到类
    Class cls = findClass("NSObject");
    
    // 找到alloc方法，执行生成对象
    IMP imp = findImp(cls, "alloc");
    id obj = imp(cls);
    
    // 找到init方法，执行初始化对象
    IMP imp = findImp(cls, "init");
    imp(obj);
    
    // 返回对象
    return obj;
}   
    
id alloc(Class cls) {
    id obj = malloc(sizeof(struct objc_object));
    obj->isa = cls;
    return obj;
}

id init(id obj) {
    obj->varsLayout = xxx;
}   

总结