iOS用消息转发机制实现方法hook

前言

最近有一个需求，改进和js交互的框架，但是在和web交互的时候，由于是旧代码的缘故，我并不知道js调用了哪些注入进web的原生对象方法，所以需要将JS调用的原生方法打印出来，方便提取迁移。

消息转发机制

当OC对象消息无法解析的时候会依次调用
resolveInstanceMethod
forwardingTargetForSelector
forwardingInvocation

在forwardingTargetForSelector方法中我们可以返回一个对象去处理传入的sel

-(id)forwardingTargetForSelector:(SEL)aSelector{
    return otherSel;
}

简单实现

通过动态建立对象去代理原来对象，动态重写forwardingTargetForSelector方法，在重写的forwardingTargetForSelector方法中处理逻辑，并且返回代理对象。

#import 

@interface NSObject (HookMethod)
-(id)hookMethod;
@end


#import "NSObject+HookMethod.h"
#import 
#import 

NSString *const hookClasssPrefix = @"hookClasssPrefix";
static const char HookName;

static Class hook_class(id self, SEL _cmd)
{
    return class_getSuperclass(object_getClass(self));
}
static id hook_forwardingTargetForSelector(id self, SEL _cmd, SEL selector)
{
    NSLog(@"%@",NSStringFromSelector(selector));
    return objc_getAssociatedObject(self, &HookName);
}

@implementation NSObject (HookMethod)

-(id)hookMethod{
    Class clazz = object_getClass(self);
    NSString *clazzName = NSStringFromClass(clazz);
    
    if (![clazzName hasPrefix:hookClasssPrefix]) {
       //动态创建代理类
        clazz = [self makeHookClassWithOriginalClassName:clazzName];
        id hookObj = [[clazz alloc] init];
        // 动态绑定被代理对象
        objc_setAssociatedObject(hookObj, &HookName, self, OBJC_ASSOCIATION_RETAIN);
        return hookObj;
    }
    return self;
}

- (Class)makeHookClassWithOriginalClassName:(NSString *)originalClazzName
{
    NSString *hookClazzName = [hookClasssPrefix stringByAppendingString:originalClazzName];
    Class clazz = NSClassFromString(hookClazzName);
    
    if (clazz) {
        return clazz;
    }
    // class doesn't exist yet, make it
    Class kvoClazz = objc_allocateClassPair([NSObject class], hookClazzName.UTF8String, 0);
    
    // 签名
    Class originalClazz = object_getClass(self);
    Method clazzMethod = class_getInstanceMethod(originalClazz, @selector(class));
    const char *types = method_getTypeEncoding(clazzMethod);
    class_addMethod(kvoClazz, @selector(class), (IMP)hook_class, types);
    
    Method clazzMethod1 = class_getInstanceMethod(originalClazz, @selector(forwardingTargetForSelector:));
    const char *type1 = method_getTypeEncoding(clazzMethod1);
    class_addMethod(kvoClazz, @selector(forwardingTargetForSelector:), (IMP)hook_forwardingTargetForSelector, type1);
    objc_registerClassPair(kvoClazz);
    return kvoClazz;
}

控制器调用

    HookObject *obj = [[HookObject alloc] init];
    obj = (HookObject *)[obj hookMethod];
    [obj doSome1];
    [obj doSome2];
    [obj doSome3];
    [obj doSome4];
/*
2018-05-08 16:06:38.335927+0800 WD_QTableDemo[47888:1768901] doSome1
2018-05-08 16:06:38.336058+0800 WD_QTableDemo[47888:1768901] 1
2018-05-08 16:06:38.336225+0800 WD_QTableDemo[47888:1768901] doSome2
2018-05-08 16:06:38.336405+0800 WD_QTableDemo[47888:1768901] 2
2018-05-08 16:06:38.336602+0800 WD_QTableDemo[47888:1768901] doSome3
2018-05-08 16:06:38.336720+0800 WD_QTableDemo[47888:1768901] 3
2018-05-08 16:06:38.336887+0800 WD_QTableDemo[47888:1768901] doSome4
2018-05-08 16:06:38.337047+0800 WD_QTableDemo[47888:1768901] 4
*/

总结

通过消息转发机制+动态代理+方法调配技术可以简单的实现方法的钩子系统，并且打印出调用的方法名称。

参考: http://tech.glowing.com/cn/implement-kvo/