如何定位Obj-C野指针随机Crash(三)：如何让Crash自报家门

libobjc.A.dylib`objc_msgSend:

0x2f879f40 <+0>: cbz r0, 0x2f879f7e ; <+62>

0x2f879f42 <+2>: ldr.w r9, [r0]

0x2f879f46 <+6>: ldrh.w r12, [r9, #0xc]

0x2f879f4a <+10>: ldr.w r9, [r9, #0x8]

0x2f879f4e <+14>: and.w r12, r12, r1

0x2f879f52 <+18>: add.w r9, r9, r12, lsl #3

0x2f879f56 <+22>: ldr.w r12, [r9]

0x2f879f5a <+26>: teq.w r12, r1

0x2f879f5e <+30>: bne 0x2f879f66 ; <+38>

0x2f879f60 <+32>: ldr.w r12, [r9, #0x4]

0x2f879f64 <+36>: bx r12

0x2f879f66 <+38>: cmp.w r12, #0x1

0x2f879f6a <+42>: blo 0x2f879f78 ; <+56>

0x2f879f6c <+44>: it eq

0x2f879f6e <+46>: ldreq.w r9, [r9, #0x4]

0x2f879f72 <+50>: ldr r12, [r9, #8]!

0x2f879f76 <+54>: b 0x2f879f5a ; <+26>

0x2f879f78 <+56>: ldr.w r9, [r0]

0x2f879f7c <+60>: b 0x2f87a1c0 ; _objc_msgSend_uncached

0x2f879f7e <+62>: mov.w r1, #0x0

0x2f879f82 <+66>: bx lr

struct objc_class : objc_object {

// Class ISA;

Class superclass;

cache_t cache;

uintptr_t data_NEVER_USE; // class_rw_t * plus custom rr/alloc flags

class_rw_t *data() {

return (class_rw_t *)(data_NEVER_USE & ~CLASS_FAST_FLAG_MASK);

}

void setData(class_rw_t *newData) {

uintptr_t flags = (uintptr_t)data_NEVER_USE & CLASS_FAST_FLAG_MASK;

data_NEVER_USE = (uintptr_t)newData | flags;

}

……..

struct cache_t {

struct bucket_t *buckets;

mask_t shiftmask;

mask_t occupied;

……..

struct bucket_t {

cache_key_t key;

IMP imp;

…...

typedef uintptr_t cache_key_t;

0x2f879f40 <+0>: cbz r0, 0x2f879f7e //如果self为0就跳转到0x2f879f7e。给nil发消息的话就什么都不做

0x2f879f42 <+2>: ldr.w r9, [r0] //取对象的类到r9

0x2f879f46 <+6>: ldrh.w r12, [r9, #0xc] //取类的偏移#0xc的数据到r12，也就是shiftmask的值

0x2f879f4a <+10>: ldr.w r9, [r9, #0x8] //取类的偏移#0x8的成员到r9，也即是cache

0x2f879f4e <+14>: and.w r12, r12, r1 //r1和shiftmask与，放到r12,r1是参数一，也就是sel，用来计算sel的index

0x2f879f52 <+18>: add.w r9, r9, r12, lsl #3 //左移3位就是乘8，8是索引项 bucket_t的宽度，r12是cache索引，r9就cache的位置，r9+r12*8，就是当前sel对应的bucket_t缓存

0x2f879f56 <+22>: ldr.w r12, [r9] //取缓存bucket_t

0x2f879f5a <+26>: teq.w r12, r1 //判断缓存项是不是要找的sel key==sel？

0x2f879f5e <+30>: bne 0x2f879f66 //不是的话就要查找sel

0x2f879f60 <+32>: ldr.w r12, [r9, #0x4] //是的话就取出imp

0x2f879f64 <+36>: bx r12 //调sel的实现，跳到imp里面去执行

@interface DPCatcher : NSObject

@property (readwrite,assign,nonatomic) Class origClass;

@end

@implementation DPCatcher

- (id)forwardingTargetForSelector:(SEL)aSelector{

NSLog(@"发现objc野指针:%s::%p=>%@",class_getName(self.origClass),self,NSStringFromSelector(aSelector));

abort();

return nil;

}

-(void)dealloc{

NSLog(@"发现objc野指针:%s::%p=>%@",class_getName(self.origClass),self,@"dealloc");

abort();

}

-(oneway void)release{

NSLog(@"发现objc野指针:%s::%p=>%@",class_getName(self.origClass),self,@"release");

abort();

}

- (instancetype)autorelease{

NSLog(@"发现objc野指针:%s::%p=>%@",class_getName(self.origClass),self,@"autorelease");

abort();

}

@end

static void DPFree(void* p){

size_t memSiziee=malloc_size(p);

if (memSiziee>sDPCatchSize) {//有足够的空间才覆盖

id obj=(id)p;

Class origClass=object_getClass(obj);//判断是不是objc对象 ，registeredClasses里面有所有的类，如果可以查到，说明是objc类

if (origClass && CFSetContainsValue(registeredClasses, origClass)) {

memset(obj, 0x55, memSiziee);

memcpy(obj, &sDPCatchIsa, sizeof(void*));//把我们自己的类的isa复制过去

DPCatcher* bug=(DPCatcher*)p;

bug.origClass=origClass;

}else{

memset(p, 0x55, memSiziee);

}

}else{

memset(p, 0x55, memSiziee);

}

return;

}

registeredClasses = CFSetCreateMutable(NULL, 0, NULL);

unsigned int count = 0;

Class *classes = objc_copyClassList(&count);

for (unsigned int i = 0; i < count; i++) {

CFSetAddValue(registeredClasses, (__bridge const void *)(classes[i]));

}

free(classes);

classes=NULL;

sDPCatchIsa=objc_getClass("DPCatcher");

sDPCatchSize=class_getInstanceSize(sDPCatchIsa);

UIView* testObj=[[UIView alloc] init];

[testObj release];

[testObj setNeedsLayout];