深入探索Class的结构

一、内存平移#

我们先通过下面的例子了解一下内存平移

1
int nums[4] = {1, 2, 3, 4};
2

3
NSLog(@"数组nums的地址：%p\n", &nums);
4

5
for (int i = 0; i < 4; i++) {
6
    NSLog(@"第%d个元素是%d地址是%p", i + 1, nums[i], &nums[i]);
7
}
8

9
NSLog(@"\n");
10

11
int *numsPointer = nums;
12
NSLog(@"数组nums的指针：%p\n", numsPointer);
13

14
for (int i = 0; i < 4; i++) {
15
    NSLog(@"偏移%d，取值%d，地址是%p", i, *(numsPointer + i), (numsPointer + i));
16
}

输出：

1
2021-06-22 23:27:02.344397+0800 Class[15488:5517067] 数组nums的地址：0x16f00d3a0
2

3
2021-06-22 23:27:02.344734+0800 Class[15488:5517067] 第1个元素是11地址是0x16f00d3a0
4
2021-06-22 23:27:02.344910+0800 Class[15488:5517067] 第2个元素是12地址是0x16f00d3a4
5
2021-06-22 23:27:02.345776+0800 Class[15488:5517067] 第3个元素是13地址是0x16f00d3a8
6
2021-06-22 23:27:02.346025+0800 Class[15488:5517067] 第4个元素是14地址是0x16f00d3ac
7
2021-06-22 23:27:02.346173+0800 Class[15488:5517067]
8
2021-06-22 23:27:02.346328+0800 Class[15488:5517067] 数组nums的指针：0x16f00d3a0
9

10
2021-06-22 23:27:02.347933+0800 Class[15488:5517067] 偏移0，取值11，地址是0x16f00d3a0
11
2021-06-22 23:27:02.348115+0800 Class[15488:5517067] 偏移1，取值12，地址是0x16f00d3a4 // 4字节
12
2021-06-22 23:27:02.348425+0800 Class[15488:5517067] 偏移2，取值13，地址是0x16f00d3a8 // 4字节
13
2021-06-22 23:27:02.349788+0800 Class[15488:5517067] 偏移3，取值14，地址是0x16f00d3ac // 4字节

内存平移

nums一个元素4字节，指针偏移1次4字节。所以这里可以通过从数组首地址开始偏移的方式进行取值操作。

同理对Class的内存结构我们是否也能进行内存平移来取值呢？

二、Class的结构内存计算#

在Class的源码中我们发现核心的数据结构是这样的，暂时忽略其中的方法，因为不影响Class的内存结构。

方法都存在方法区

1
struct objc_class : objc_object {
2
    ...
3

4
    // Class ISA; objc_object 中的 ISA
5
    Class superclass;
6
    cache_t cache;             // formerly cache pointer and vtable
7
    class_data_bits_t bits;    // class_rw_t * plus custom rr/alloc flags
8

9
    ...
10
}

-	ISA	superClass	cache	bits
说明	ISA（结构体指针）	父类（结构体指针）	方法缓存	类的具体信息
大小（字节）	8	8	16	8

三、objc_class: cache_t 的内存结构#

我们忽略掉方法，剩下的核心数据结构如下

1
struct cache_t {
2
private:
3
    explicit_atomic<uintptr_t> _bucketsAndMaybeMask;
4
    union {
5
        struct {
6
            explicit_atomic<mask_t>    _maybeMask;
7
#if __LP64__
8
            uint16_t                   _flags;
9
#endif
10
            uint16_t                   _occupied;
11
        };
12
        explicit_atomic<preopt_cache_t *> _originalPreoptCache;
13
    };
14
}

3.1 小补充：LP64数据模型#

在里面我们可以看到 __LP64__，这里代表的是LP64数据模型。现今所有64位的类Unix平台均使用LP64数据模型。

TYPE	LP32	ILP32	LP64	ILP64	LLP64
含义	指long和pointer是32位的	指int，long和pointer是32位的	指long和pointer是64位	指int，long，pointer是64位	指long long和pointer是64位的
CHAR	8	8	8	8	8
SHORT	16	16	16	16	16
INT	16	32	32	64	32
LONG	32	32	64	64	32
LONG LONG	64	64	64	64	64
POINTER	32	32	64	64	64

3.2 内部联合体的内存结构#

联合体包含了两部分：结构体、指针。我们已知arm64下指针占用8字节。我们来看下结构体需要占用多少

-	_maybeMask	_flags
类型	uint32_t	uint16_t
大小（字节）	4	2

结构体大小 8 字节，联合体大小为8字节

3.3 结构总结#

-	_bucketsAndMaybeMask	union
说明	指针(做什么的还需要研究)	联合体
大小（字节）	long类型 8	8

cache_t大小为16字节

四、objc_class : class_data_bits_t 的内存结构#

核心数据结构如下

1
struct class_data_bits_t {
2
  ...
3
  // Values are the FAST_ flags above.
4
  uintptr_t bits;
5
  ...
6
}

我们发现内部只有一个指针bits，那么如何通过它获取到类的详细信息呢？

我们发现这样一个函数，通过bits与上FAST_DATA_MASK可以获得class_rw_t。和我们找ISA的过程比较类似。

那么它是做什么的呢？

1
class_rw_t* data() const {
2
    return (class_rw_t *)(bits & FAST_DATA_MASK);
3
}

FAST_DATA_MASK在LP64下的定义

1
#if __LP64__
2
...
3
// data pointer
4
#define FAST_DATA_MASK          0x00007ffffffffff8UL

五、class_data_bits_t : class_rw_t#

rw: read-write

5.1 class_rw_t的内存结构#

1
struct class_rw_t {
2
  // Be warned that Symbolication knows the layout of this structure.
3
  // 标志位，如是否是元类，是否实现了等
4
  uint32_t flags;
5
  uint16_t witness;
6

7
  explicit_atomic<uintptr_t> ro_or_rw_ext; //
8

9
  Class firstSubclass;
10
  Class nextSiblingClass;
11

12
}

5.2 一些重要函数#

这里我们会看到一些眼熟的函数，在methods() properties() protocols()中我们发现了另一个重要的类型class_rw_ext_t

1
class_rw_ext_t *deepCopy(const class_ro_t *ro) {
2
    return extAlloc(ro, true);
3
}
4

5
const method_array_t methods() const {
6
    auto v = get_ro_or_rwe();
7
    if (v.is<class_rw_ext_t *>()) {
8
        return v.get<class_rw_ext_t *>(&ro_or_rw_ext)->methods;
9
    } else {
10
        return method_array_t{v.get<const class_ro_t *>(&ro_or_rw_ext)->baseMethods()};
11
    }
12
}
13

14
const property_array_t properties() const {
15
    ...
16
}
17

18
const protocol_array_t protocols() const {
19
    ...
20
}

六、class_data_bits_t : class_rw_t : class_rw_ext_t#

1
struct class_rw_ext_t {
2
    DECLARE_AUTHED_PTR_TEMPLATE(class_ro_t)
3
    class_ro_t_authed_ptr<const class_ro_t> ro;// 成员变量
4
    method_array_t methods;
5
    property_array_t properties;
6
    protocol_array_t protocols;
7
    char *demangledName;
8
    uint32_t version;
9
};

6.1 list_array_tt#

method_array_t/property_array_t/protocol_array_t 都是继承于 list_array_tt 的，通过泛型来完成不同的定义。

源码核心部分：

1
template <typename Element, typename List, template<typename> class Ptr>
2
class list_array_tt {
3
  ...
4
  private:
5
    union {
6
        Ptr<List> list;
7
        uintptr_t arrayAndFlag;
8
    };
9
  ...
10
}

method_array_t

1
class method_array_t :
2
    public list_array_tt<method_t, method_list_t, method_list_t_authed_ptr> {...}

property_array_t

1
class property_array_t :
2
    public list_array_tt<property_t, property_list_t, RawPtr> {...}

protocol_array_t

1
class protocol_array_t :
2
    public list_array_tt<protocol_ref_t, protocol_list_t, RawPtr> {...}

6.2 class_ro_t#

源码核心部分：

1
struct class_ro_t {
2
  ...
3
  const ivar_list_t * ivars; // 成员变量
4
  ...
5
}

七、LLDB调试Class内存结构#

结构图#

Class的内存结构

有这样的一个类

1
@interface RYModel : NSObject
2

3
@property (nonatomic, copy) NSString *name;
4
@property (nonatomic, assign) NSInteger age;
5
@property (nonatomic, assign) float height;
6
@property (nonatomic, strong) RYModel *father;
7
@property (nonatomic, assign) BOOL isBoy;
8

9
- (void)dosomething;
10

11
- (void)dosomethingWith:(NSString *)title;
12

13
+ (void)classDoSomething;
14

15
- (NSString *)sayMyName;
16

17
@end

7.1 成员变量#

获取class_data_bits_t

这里通过内存偏移的方式找到class_data_bits_t，如前文所述：bits所在位置的偏移为8+8+16=32字节。

那么我们理论上可以通过对象地址+0x20计算出它的位置。

1
(lldb) p/x RYModel.class
2
(Class) $0 = 0x00000001000083e0 RYModel
3

4
(lldb) x/4gx 0x00000001000083e0
5
0x1000083e0: 0x00000001000083b8 0x000000010036a140
6
0x1000083f0: 0x000000010073c2d0 0x0004803400000007
7

8
// 计算bits
9
(lldb) p/x 0x1000083e0 + 0x20
10
(long) $1 = 0x0000000100008400
11

12
// 这里转换一下类型便于后面继续调试
13
(lldb) p (class_data_bits_t *)0x0000000100008400
14
(class_data_bits_t *) $2 = 0x0000000100008400

通过 data() 方法获取 class_rw_t

1
(lldb) p (class_data_bits_t *)0x0000000100008400
2
(class_data_bits_t *) $4 = 0x0000000100008400
3

4
(lldb) p $4->data()
5
(class_rw_t *) $5 = 0x000000010073c040

通过 properties 获取属性列表容器

1
(lldb) p $5->properties
2
(const property_array_t) $6 = {
3
  list_array_tt<property_t, property_list_t, RawPtr> = {
4
     = {
5
      list = {
6
        ptr = 0x0000000100008280
7
      }
8
      arrayAndFlag = 4295000704
9
    }
10
  }
11
}
12
  Fix-it applied, fixed expression was:
13
    $5->properties()

取出 list

1
(lldb) p $6.list
2
(const RawPtr<property_list_t>) $7 = {
3
  ptr = 0x0000000100008280
4
}

取出 ptr

1
(lldb) p $7.ptr
2
(property_list_t *const) $8 = 0x0000000100008280

取出 ptr 内的值

1
(lldb) p *$8
2
(property_list_t) $9 = {
3
  entsize_list_tt<property_t, property_list_t, 0, PointerModifierNop> = (entsizeAndFlags = 16, count = 5)
4
}

通过下标取出属性

1
(lldb) p $9.get(0)
2
(property_t) $10 = (name = "name", attributes = "T@\"NSString\",C,N,V_name")
3
(lldb) p $9.get(1)
4
(property_t) $11 = (name = "age", attributes = "Tq,N,V_age")
5
(lldb) p $9.get(2)
6
(property_t) $12 = (name = "height", attributes = "Tf,N,V_height")
7
(lldb) p $9.get(3)
8
(property_t) $13 = (name = "father", attributes = "T@\"RYModel\",&,N,V_father")
9
(lldb) p $9.get(4)
10
(property_t) $14 = (name = "isBoy", attributes = "Tc,N,V_isBoy")

7.2 实例方法列表#

前面一些相似的步骤我们省略掉

从 class_rw_t -> methods 获取 方法列表容器

1
(lldb) p $5->methods
2
(const method_array_t) $6 = {
3
  list_array_tt<method_t, method_list_t, method_list_t_authed_ptr> = {
4
     = {
5
      list = {
6
        ptr = 0x00000001000080e8
7
      }
8
      arrayAndFlag = 4295000296
9
    }
10
  }
11
}
12
  Fix-it applied, fixed expression was:
13
    $5->methods()

取出 list

1
(lldb) p $6.list
2
(const method_list_t_authed_ptr<method_list_t>) $14 = {
3
  ptr = 0x00000001000080e8
4
}

取出 ptr

1
(lldb) p $14.ptr
2
(method_list_t *const) $15 = 0x00000001000080e8

取出 ptr 中的数据 method_list_t

1
(lldb) p *$15
2
(method_list_t) $16 = {
3
  entsize_list_tt<method_t, method_list_t, 4294901763, method_t::pointer_modifier> = (entsizeAndFlags = 27, count = 14)
4
}

获取方法数量

1
(lldb) p $16.count
2
(uint32_t) $29 = 14

通过c++函数get()与big()单个获取类的实例方法

这里除了我们自己定义的一些实例方法，还看到了一些列属性自动生成的set、get方法，以及析构函数

1
(lldb) p $16.get(0).big()
2
(method_t::big) $19 = {
3
  name = "setFather:"
4
  types = 0x0000000100003f60 "v24@0:8@16"
5
  imp = 0x0000000100003cc0 (ObjcBuild`-[RYModel setFather:])
6
}
7
(lldb) p $16.get(1).big()
8
(method_t::big) $20 = {
9
  name = "father"
10
  types = 0x0000000100003f6b "@16@0:8"
11
  imp = 0x0000000100003ca0 (ObjcBuild`-[RYModel father])
12
}
13

14
... // 省略一些Set、get
15

16
(lldb) p $16.get(3).big()
17
(method_t::big) $22 = {
18
  name = "dosomething"
19
  types = 0x0000000100003f3b "v16@0:8"
20
  imp = 0x0000000100003b30 (ObjcBuild`-[RYModel dosomething])
21
}
22
(lldb) p $16.get(4).big()
23
(method_t::big) $23 = {
24
  name = "dosomethingWith:"
25
  types = 0x0000000100003f60 "v24@0:8@16"
26
  imp = 0x0000000100003b40 (ObjcBuild`-[RYModel dosomethingWith:])
27
}
28

29
...
30

31
(lldb) p $16.get(8).big()
32
(method_t::big) $27 = {
33
  name = ".cxx_destruct"
34
  types = 0x0000000100003f3b "v16@0:8"
35
  imp = 0x0000000100003d30 (ObjcBuild`-[RYModel .cxx_destruct])
36
}
37

38
... // 省略一些Set、get

7.3 协议列表#

前面一些相似的步骤我们省略掉

从 class_rw_t -> protocols 获取 协议列表容器

1
(lldb) p $2->protocols()
2
(const protocol_array_t) $3 = {
3
  list_array_tt<unsigned long, protocol_list_t, RawPtr> = {
4
     = {
5
      list = {
6
        ptr = 0x00000001000083b8
7
      }
8
      arrayAndFlag = 4295001016
9
    }
10
  }
11
}

取出 list

1
(lldb) p $3.list
2
(const RawPtr<protocol_list_t>) $4 = {
3
  ptr = 0x00000001000083b8
4
}

取出 ptr

1
(lldb) p $4.ptr
2
(protocol_list_t *const) $5 = 0x00000001000083b8

取出 ptr 中的数据 protocol_list_t

1
(lldb) p *$5
2
(protocol_list_t) $6 = (count = 1, list = protocol_ref_t [] @ 0x00007f9a62cb8778)

这里可以发现，里面的list中存了一个指针，并不是完整的一个数据结构。我们找到了这样的定义：

typedef uintptr_t protocol_ref_t; // protocol_t *, but unremapped

获取 protocol_t *

1
(lldb) p (protocol_t *)$6.list[0]
2
(protocol_t *) $7 = 0x00000001000088a0

读取数据

1
(lldb) p *$7
2
(protocol_t) $8 = {
3
  objc_object = {
4
    isa = {
5
      bits = 4298547400
6
      cls = Protocol
7
       = {
8
        nonpointer = 0
9
        has_assoc = 0
10
        has_cxx_dtor = 0
11
        shiftcls = 537318425
12
        magic = 0
13
        weakly_referenced = 0
14
        unused = 0
15
        has_sidetable_rc = 0
16
        extra_rc = 0
17
      }
18
    }
19
  }
20
  mangledName = 0x0000000100003e71 "RYProtocol"
21
  protocols = 0x0000000100008310
22
  instanceMethods = 0x0000000100008328
23
  classMethods = nil
24
  optionalInstanceMethods = nil
25
  optionalClassMethods = nil
26
  instanceProperties = nil
27
  size = 96
28
  flags = 0
29
  _extendedMethodTypes = 0x0000000100008348
30
  _demangledName = 0x0000000000000000
31
  _classProperties = nil
32
}

7.4 成员变量#

前面一些相似的步骤我们省略掉

从 class_rw_t -> ro() 获取 成员变量列表容器

1
(lldb) p $4->ro()
2
(const class_ro_t *) $18 = 0x00000001000083d0

class_ro_t -> ivars 获取成员变量列表

1
(lldb) p $18->ivars
2
(const ivar_list_t *const) $19 = 0x0000000100008570
3

4
(lldb) p *$19
5
(const ivar_list_t) $20 = {
6
  entsize_list_tt<ivar_t, ivar_list_t, 0, PointerModifierNop> = (entsizeAndFlags = 32, count = 5)
7
}

从成员变量列表中获取成员变量

1
(lldb) p $20.count
2
(const uint32_t) $21 = 5
3

4
(lldb) p $20.get(0)
5
(ivar_t) $22 = {
6
  offset = 0x0000000100008770
7
  name = 0x0000000100003de7 "_isBoy"
8
  type = 0x0000000100003f47 "c"
9
  alignment_raw = 0
10
  size = 1
11
}
12
(lldb) p $20.get(1)
13
(ivar_t) $23 = {
14
  offset = 0x0000000100008778
15
  name = 0x0000000100003dee "_height"
16
  type = 0x0000000100003f49 "f"
17
  alignment_raw = 2
18
  size = 4
19
}
20
(lldb) p $20.get(2)
21
(ivar_t) $24 = {
22
  offset = 0x0000000100008780
23
  name = 0x0000000100003df6 "_name"
24
  type = 0x0000000100003f4b "@\"NSString\""
25
  alignment_raw = 3
26
  size = 8
27
}
28
(lldb) p $20.get(3)
29
(ivar_t) $25 = {
30
  offset = 0x0000000100008788
31
  name = 0x0000000100003dfc "_age"
32
  type = 0x0000000100003f57 "q"
33
  alignment_raw = 3
34
  size = 8
35
}
36
(lldb) p $20.get(4)
37
(ivar_t) $26 = {
38
  offset = 0x0000000100008790
39
  name = 0x0000000100003e01 "_father"
40
  type = 0x0000000100003f59 "@\"RYModel\""
41
  alignment_raw = 3
42
  size = 8
43
}

7.5 类方法#

类方法我们需要到元类中进行查找

获取元类类信息

1
(lldb) p/x RYModel.class
2
(Class) $67 = 0x00000001000087c0 RYModel
3
(lldb) x/4gx 0x00000001000087c0
4
0x1000087c0: 0x0000000100008798 0x000000010036a140
5
0x1000087d0: 0x00000001010695c0 0x0004803400000007
6
(lldb) p/x 0x0000000100008798 & 0x00007ffffffffff8ULL
7
(unsigned long long) $68 = 0x0000000100008798
8
(lldb) p 0x0000000100008798 + 0x20
9
(long) $70 = 4295002040
10
(lldb) p/x 0x0000000100008798 + 0x20
11
(long) $71 = 0x00000001000087b8
12
(lldb) p (class_data_bits_t *)0x00000001000087b8
13
(class_data_bits_t *) $72 = 0x00000001000087b8
14

15
(lldb) p $72->data()
16
(class_rw_t *) $73 = 0x0000000101069510
17
(lldb) p $73->methods()
18
(const method_array_t) $74 = {
19
  list_array_tt<method_t, method_list_t, method_list_t_authed_ptr> = {
20
     = {
21
      list = {
22
        ptr = 0x0000000100008398
23
      }
24
      arrayAndFlag = 4295000984
25
    }
26
  }
27
}

获取元类方法列表（类方法）

1
(lldb) p $74.list
2
(const method_list_t_authed_ptr<method_list_t>) $75 = {
3
  ptr = 0x0000000100008398
4
}
5
(lldb) p $75.ptr
6
(method_list_t *const) $76 = 0x0000000100008398
7
(lldb) p *$76
8
(method_list_t) $77 = {
9
  entsize_list_tt<method_t, method_list_t, 4294901763, method_t::pointer_modifier> = (entsizeAndFlags = 27, count = 1)
10
}

输出方法信息

1
(lldb) p $77.get(0).big()
2
(method_t::big) $78 = {
3
  name = "classDoSomething"
4
  types = 0x0000000100003f3f "v16@0:8"
5
  imp = 0x0000000100003920 (ObjcBuild`+[RYModel classDoSomething])
6
}