iOS面试题目——hook block（3）

// 题目：实现下面的函数，将任意参数 block 的实现修改成打印所有入参，并调用原始实现
//
// 比如
//  void(^block)(int a, NSString *b) = ^(int a, NSString *b){
//      NSLog(@"block invoke");
//  }
//  HookBlockToPrintArguments(block);
//  block(123,@"aaa");
//  这里输出 "123,aaa" 和 "block invoke"

//  void(^block)(int a, double b) = ^(int a, double b){
//      NSLog(@"block invoke");
//  }
//  HookBlockToPrintArguments(block);
//  block(123,3.14);
//  这里输出 "123,3.14" 和 "block invoke"

分析题目：首先，题目的本意和上一个题目一样，就是hook block 的 invoke，然后将其所有的入参打印出来，再调用原实现。区别在于任意Block，这个任意block，就让我们无法对用来替换的函数有一个很合适的定义，因为我们定义的时候，根本就不知道即将hook的block有几个参数。

这个问题，可以用libffi来解决。

整个思路如下：

1、获取要hook的block的相关信息，例如返回值、参数列表。这些信息都存储在bkock的方法签名里。

2、通过上一步获取到的信息，利用libffi创建一个函数模板（ffi_prep_cif()）。

3、创建动态调用函数，并替换block中的Invoke。

4、编写替换函数，并实现调用原函数。

代码实现：

• 获取block的签名信息：

    struct Block_layout *layout = (__bridge struct Block_layout *)block;

    if (! (layout->flags & BLOCK_HAS_SIGNATURE)){
        NSLog(@"当前block没有签名");
        return;
    }

    uint8_t *desc = (uint8_t *)layout->descriptor;

    desc += sizeof(struct Block_descriptor_1);

    if (layout->flags & BLOCK_HAS_COPY_DISPOSE) {
        desc += sizeof(struct Block_descriptor_2);
    }
    struct Block_descriptor_3 *desc_3 = (struct Block_descriptor_3 *)desc;

    const char *signature = desc_3->signature;
    NSMethodSignature *m_signature = [NSMethodSignature signatureWithObjCTypes:signature];

• 创建函数模版：

    ffi_type **args = malloc(sizeof(ffi_type *)*[m_signature numberOfArguments]);

    //	返回值类型
    ffi_type *return_ffi;
    const char *return_type = [m_signature methodReturnType];
    if (*return_type == @encode(_Bool)[0]) {
        return_ffi = &ffi_type_sint8;
    }else if (*return_type == @encode(signed char)[0]){
        return_ffi = &ffi_type_sint8;
    }else if (*return_type == @encode(unsigned char)[0]){
        return_ffi = &ffi_type_uint8;
    }else if (*return_type == @encode(short)[0]){
        return_ffi = &ffi_type_sint16;
    }else if (*return_type == @encode(int)[0]){
        return_ffi = &ffi_type_sint32;
    }else if (*return_type == @encode(long)[0]){
        return_ffi = &ffi_type_sint64;
    }else if (*return_type == @encode(long long)[0]){
        return_ffi = &ffi_type_sint64;
    }else if (*return_type == @encode(id)[0]){
        return_ffi = &ffi_type_pointer;
    }else if (*return_type == @encode(Class)[0]){
        return_ffi = &ffi_type_pointer;
    }else if (*return_type == @encode(SEL)[0]){
        return_ffi = &ffi_type_pointer;
    }else if (*return_type == @encode(void *)[0]){
        return_ffi = &ffi_type_pointer;
    }else if (*return_type == @encode(char *)[0]){
        return_ffi = &ffi_type_pointer;
    }else if (*return_type == @encode(float)[0]){
        return_ffi = &ffi_type_float;
    }else if (*return_type == @encode(double)[0]){
        return_ffi = &ffi_type_double;
    }else if (*return_type == @encode(void)[0]){
        return_ffi = &ffi_type_void;
    }else{
        NSLog(@"未找到合适的类型");
        return;
    }
    //    初始化参数列表
    for (int i=0; i<[m_signature numberOfArguments]; i++) {
        const char *type = [m_signature getArgumentTypeAtIndex:i];
        if (*type == @encode(_Bool)[0]) {
            args[i] = &ffi_type_sint8;
        }else if (*type == @encode(signed char)[0]){
            args[i] = &ffi_type_sint8;
        }else if (*type == @encode(unsigned char)[0]){
            args[i] = &ffi_type_uint8;
        }else if (*type == @encode(short)[0]){
            args[i] = &ffi_type_sint16;
        }else if (*type == @encode(int)[0]){
            args[i] = &ffi_type_sint32;
        }else if (*type == @encode(long)[0]){
            args[i] = &ffi_type_sint64;
        }else if (*type == @encode(long long)[0]){
            args[i] = &ffi_type_sint64;
        }else if (*type == @encode(id)[0]){
            args[i] = &ffi_type_pointer;
        }else if (*type == @encode(Class)[0]){
            args[i] = &ffi_type_pointer;
        }else if (*type == @encode(SEL)[0]){
            args[i] = &ffi_type_pointer;
        }else if (*type == @encode(void *)[0]){
            args[i] = &ffi_type_pointer;
        }else if (*type == @encode(char *)[0]){
            args[i] = &ffi_type_pointer;
        }else if (*type == @encode(float)[0]){
            args[i] = &ffi_type_float;
        }else if (*type == @encode(double)[0]){
            args[i] = &ffi_type_double;
        }else{
            NSLog(@"未知类型：注，结构体未处理");
            return;
        }
    }

    //	_cif 定义的是全局变量		ffi_cif _cif;
    ffi_status status = ffi_prep_cif(&_cif, FFI_DEFAULT_ABI, (int)[m_signature numberOfArguments], return_ffi, args);
    if (status != FFI_OK) {
        NSLog(@"初始化 cif 失败");
        return;
    }

• 创建并绑定动态调用的函数：

    // 	_closure 定义的是全局变量		ffi_closure *_closure;
    // 	_replacementInvoke 定义的是全局变量		void *_replacementInvoke;

	_closure = ffi_closure_alloc(sizeof(ffi_closure), &_replacementInvoke);
    if (!_closure) {
        NSLog(@"hook 失败");
        return;
    }
	ffi_status closure_loc_status = ffi_prep_closure_loc(_closure, &_cif, replace_bloke2_2, (__bridge void *)(NSObject.new), _replacementInvoke);
    if (closure_loc_status != FFI_OK) {
        NSLog(@"Hook failed! ffi_prep_closure returned %d", (int)status);
        return;
    }

• 替换block中的invoke：

    //    修改内存属性
    vm_address_t invoke_addr = (vm_address_t)&layout->invoke;
    vm_size_t vmsize = 0;
    mach_port_t object = 0;
    vm_region_basic_info_data_64_t info;
    mach_msg_type_number_t infoCnt = VM_REGION_BASIC_INFO_COUNT_64;
    kern_return_t ret = vm_region_64(mach_task_self(), &invoke_addr, &vmsize, VM_REGION_BASIC_INFO, (vm_region_info_t)&info, &infoCnt, &object);
    if (ret != KERN_SUCCESS) {
        NSLog(@"获取失败");
        return;
    }
    vm_prot_t protection = info.protection;
    //    判断内存是否可写
    if ((protection&VM_PROT_WRITE) == 0) {
        //        修改内存属性 ===> 可写
        ret = vm_protect(mach_task_self(), invoke_addr, sizeof(invoke_addr), false, protection|VM_PROT_WRITE);
        if (ret != KERN_SUCCESS) {
            NSLog(@"修改失败");
            return;
        }
    }
    //    保存原来的invoke
    origin_blockInvoke2_2 = (void *)layout->invoke;
    layout->invoke = (uintptr_t)_replacementInvoke;

• 实现替换函数：

    void replace_bloke2_2(ffi_cif *cif, void *ret, void **args, void *userdata) {
        struct Block_layout *layout = (struct Block_layout *)userdata;
        uint8_t *desc = (uint8_t *)layout->descriptor;

        desc += sizeof(struct Block_descriptor_1);

        if (layout->flags & BLOCK_HAS_COPY_DISPOSE) {
            desc += sizeof(struct Block_descriptor_2);
        }
        struct Block_descriptor_3 *desc_3 = (struct Block_descriptor_3 *)desc;

        const char *signature = desc_3->signature;
        NSMethodSignature *m_signature = [NSMethodSignature signatureWithObjCTypes:signature];

        NSLog(@"回调函数");
        NSLog(@"%d",cif->nargs);
        //    解析参数
        for (int i=0; i<[m_signature numberOfArguments]; i++) {
            ffi_type *arg = args[i];
            const char *type = [m_signature getArgumentTypeAtIndex:i];
            if (*type == @encode(_Bool)[0]) {
                NSLog(@"%d",(bool)arg->size);
            }else if (*type == @encode(signed char)[0]){
                NSLog(@"%d",(char)arg->size);
            }else if (*type == @encode(unsigned char)[0]){
                NSLog(@"%d",(unsigned char)arg->size);
            }else if (*type == @encode(short)[0]){
                NSLog(@"%d",(short)arg->size);
            }else if (*type == @encode(int)[0]){
                NSLog(@"%d",(int)arg->size);
            }else if (*type == @encode(long)[0]){
                NSLog(@"%ld",(long)arg->size);
            }else if (*type == @encode(long long)[0]){
                NSLog(@"%lld",(long long)arg->size);
            }else if (*type == @encode(id)[0]){
                NSLog(@"%@",(__bridge id)((void *)arg->size));
            }else if (*type == @encode(Class)[0]){
                NSLog(@"%@",(__bridge Class)((void *)arg->size));
            }else if (*type == @encode(SEL)[0]){
                NSLog(@"%s",((char *)arg->size));
            }else if (*type == @encode(void *)[0]){
                NSLog(@"0x%llx",((long long)arg->size));
            }else if (*type == @encode(char *)[0]){
                NSLog(@"%s",((char *)arg->size));
            }else if (*type == @encode(float)[0]){
                NSLog(@"%f",((float)arg->size));
            }else if (*type == @encode(double)[0]){
                NSLog(@"%f",((double)arg->size));
            }else{
                NSLog(@"未知类型：注，结构体未处理");
            }
        }
        //    调用原函数
        ffi_call(&_cif,(void *)origin_blockInvoke2_2, ret, args);
    }