我們一定要給自己提出這樣的任務：第一，學習，第二是學習，第三還是學習。 —— 列寧

前面幾章大概的說了一下iOS的一些底層原理,包括消息發送轉發機制,類的結構之類的,今天和大家分享一個框架Aspects,更加詳細的請移步霜神-iOS 如何實現Aspect Oriented Programming (上)

一:Aspects是什么?

Aspects是一個開源的的庫,面向切面編程,它能允許你在每一個類和每一個實例中存在的方法里面加入任何代碼。可以在方法執行之前或者之后執行,也可以替換掉原有的方法。通過Runtime消息轉發實現Hook。Aspects會自動處理超類,比常規方法調用更容易使用,github上Star已經超過6000多,已經比較穩定了;

先從源碼入手,最后再進行總結,如果對源碼不感興趣的可以直接跳到文章末尾去查看具體流程

二:Aspects是Hook前的準備工作

+ (id<AspectToken>)aspect_hookSelector:(SEL)selector
                      withOptions:(AspectOptions)options
                       usingBlock:(id)block
                            error:(NSError **)error {
    return aspect_add((id)self, selector, options, block, error);
}
- (id<AspectToken>)aspect_hookSelector:(SEL)selector
                      withOptions:(AspectOptions)options
                       usingBlock:(id)block
                            error:(NSError **)error {
    return aspect_add(self, selector, options, block, error);
}

通過上面的方法添加Hook,傳入SEL(要Hook的方法), options(遠方法調用調用之前或之后調用或者是替換),block(要執行的代碼),error(錯誤信息)

static id aspect_add(id self, SEL selector, AspectOptions options, id block, NSError **error) {
    NSCParameterAssert(self);
    NSCParameterAssert(selector);
    NSCParameterAssert(block);

    __block AspectIdentifier *identifier = nil;
    aspect_performLocked(^{
        //先判斷參數的合法性,如果不合法直接返回nil
        if (aspect_isSelectorAllowedAndTrack(self, selector, options, error)) {
            //參數合法
            //創建容器
            AspectsContainer *aspectContainer = aspect_getContainerForObject(self, selector);
            //創建一個AspectIdentifier對象(保存hook內容)
            identifier = [AspectIdentifier identifierWithSelector:selector object:self options:options block:block error:error];
            if (identifier) {
                //把identifier添加到容器中(根據options,添加到不同集合中)
                [aspectContainer addAspect:identifier withOptions:options];

                // Modify the class to allow message interception.
                aspect_prepareClassAndHookSelector(self, selector, error);
            }
        }
    });
    return identifier;
}

上面的方法主要是分為以下幾步:

• 判斷上面傳入的方法的合法性
• 如果合法就創建AspectsContainer容器類,這個容器會根據傳入的切片時機進行分類,添加到對應的集合中去
• 創建AspectIdentifier對象保存hook內容
• 如果AspectIdentifier對象創建成功,就把AspectIdentifier根據options添加到對應的數組中
• 最終調用aspect_prepareClassAndHookSelector(self, selector, error);開始進行hook

接下來就對上面的步驟一一解讀

一:判斷傳入方法的合法性

/*
 判斷參數的合法性:
 1.先將retain,release,autorelease,forwardInvocation添加到數組中,如果SEL是數組中的某一個,報錯
并返回NO,這幾個全是不能進行Swizzle的方法
 2.傳入的時機是否正確,判斷SEL是否是dealloc,如果是dealloc,選擇的調用時機必須是AspectPositionBefore
 3.判斷類或者類對象是否響應傳入的sel
 4.如果替換的是類方法,則進行是否重復替換的檢查
 */
static BOOL aspect_isSelectorAllowedAndTrack(NSObject *self, SEL selector, AspectOptions options, NSError **error) {
    static NSSet *disallowedSelectorList;
    static dispatch_once_t pred;
    dispatch_once(&pred, ^{
        disallowedSelectorList = [NSSet setWithObjects:@"retain", @"release", @"autorelease", @"forwardInvocation:", nil];
    });

    // Check against the blacklist.
    NSString *selectorName = NSStringFromSelector(selector);
    if ([disallowedSelectorList containsObject:selectorName]) {
        NSString *errorDescription = [NSString stringWithFormat:@"Selector %@ is blacklisted.", selectorName];
        AspectError(AspectErrorSelectorBlacklisted, errorDescription);
        return NO;
    }

    // Additional checks.
    AspectOptions position = options&AspectPositionFilter;
    //如果是dealloc必須是AspectPositionBefore,不然報錯
    if ([selectorName isEqualToString:@"dealloc"] && position != AspectPositionBefore) {
        NSString *errorDesc = @"AspectPositionBefore is the only valid position when hooking dealloc.";
        AspectError(AspectErrorSelectorDeallocPosition, errorDesc);
        return NO;
    }
    //判斷是否可以響應方法,respondsToSelector(判斷對象是否響應某個方法),instancesRespondToSelector(判斷類能否響應某個方法)
    if (![self respondsToSelector:selector] && ![self.class instancesRespondToSelector:selector]) {
        NSString *errorDesc = [NSString stringWithFormat:@"Unable to find selector -[%@ %@].", NSStringFromClass(self.class), selectorName];
        AspectError(AspectErrorDoesNotRespondToSelector, errorDesc);
        return NO;
    }

    // Search for the current class and the class hierarchy IF we are modifying a class object
    //判斷是不是元類,
    if (class_isMetaClass(object_getClass(self))) {
        Class klass = [self class];
        //創建字典
        NSMutableDictionary *swizzledClassesDict = aspect_getSwizzledClassesDict();
        Class currentClass = [self class];
        do {
            AspectTracker *tracker = swizzledClassesDict[currentClass];
            if ([tracker.selectorNames containsObject:selectorName]) {

                // Find the topmost class for the log.
                if (tracker.parentEntry) {
                    AspectTracker *topmostEntry = tracker.parentEntry;
                    while (topmostEntry.parentEntry) {
                        topmostEntry = topmostEntry.parentEntry;
                    }
                    NSString *errorDescription = [NSString stringWithFormat:@"Error: %@ already hooked in %@. A method can only be hooked once per class hierarchy.", selectorName, NSStringFromClass(topmostEntry.trackedClass)];
                    AspectError(AspectErrorSelectorAlreadyHookedInClassHierarchy, errorDescription);
                    return NO;
                }else if (klass == currentClass) {
                    // Already modified and topmost!
                    return YES;
                }
            }
        }while ((currentClass = class_getSuperclass(currentClass)));

        // Add the selector as being modified.
//到此就表示傳入的參數合法,并且沒有被hook過,就可以把信息保存起來了
        currentClass = klass;
        AspectTracker *parentTracker = nil;
        do {
            AspectTracker *tracker = swizzledClassesDict[currentClass];
            if (!tracker) {
                tracker = [[AspectTracker alloc] initWithTrackedClass:currentClass parent:parentTracker];
                swizzledClassesDict[(id<NSCopying>)currentClass] = tracker;
            }
            [tracker.selectorNames addObject:selectorName];
            // All superclasses get marked as having a subclass that is modified.
            parentTracker = tracker;
        }while ((currentClass = class_getSuperclass(currentClass)));
    }

    return YES;
}

上面代碼主要干了一下幾件事:

• 把"retain", "release", "autorelease", "forwardInvocation:這幾個加入集合中,判斷集合中是否包含傳入的selector,如果包含返回NO,這也說明Aspects不能對這幾個函數進行hook操作;
• 判斷selector是不是dealloc方法,如果是切面時機必須是AspectPositionBefore,要不然就會報錯并返回NO,dealloc之后對象就銷毀,所以切片時機只能是在原方法調用之前調用
• 判斷類和實例對象是否可以響應傳入的selector,不能就返回NO
• 判斷是不是元類,如果是元類,判斷方法有沒有被hook過,如果沒有就保存數據,一個方法在一個類的層級里面只能hook一次

2.創建AspectsContainer容器類

// Loads or creates the aspect container.
static AspectsContainer *aspect_getContainerForObject(NSObject *self, SEL selector) {
    NSCParameterAssert(self);
    //拼接字符串aspects__viewDidAppear:
    SEL aliasSelector = aspect_aliasForSelector(selector);
    //獲取aspectContainer對象
    AspectsContainer *aspectContainer = objc_getAssociatedObject(self, aliasSelector);
    //如果上面沒有獲取到就創建
    if (!aspectContainer) {
        aspectContainer = [AspectsContainer new];
        objc_setAssociatedObject(self, aliasSelector, aspectContainer, OBJC_ASSOCIATION_RETAIN);
    }
    return aspectContainer;
}

獲得其對應的AssociatedObject關聯對象，如果獲取不到，就創建一個關聯對象。最終得到selector有"aspects_"前綴，對應的aspectContainer。

3.創建AspectIdentifier對象保存hook內容

+ (instancetype)identifierWithSelector:(SEL)selector object:(id)object options:(AspectOptions)options block:(id)block error:(NSError **)error {
    NSCParameterAssert(block);
    NSCParameterAssert(selector);
//    /把blcok轉換成方法簽名
    NSMethodSignature *blockSignature = aspect_blockMethodSignature(block, error); // TODO: check signature compatibility, etc.
    //aspect_isCompatibleBlockSignature 對比要替換方法的block和原方法,如果不一樣,不繼續進行
    //如果一樣,把所有的參數賦值給AspectIdentifier對象
    if (!aspect_isCompatibleBlockSignature(blockSignature, object, selector, error)) {
        return nil;
    }

    AspectIdentifier *identifier = nil;
    
    if (blockSignature) {
        identifier = [AspectIdentifier new];
        identifier.selector = selector;
        identifier.block = block;
        identifier.blockSignature = blockSignature;
        identifier.options = options;
        identifier.object = object; // weak
    }
    return identifier;
}
/*
 1.把原方法轉換成方法簽名
 2.然后比較兩個方法簽名的參數數量,如果不相等,說明不一樣
 3.如果參數個數相同,再比較blockSignature的第一個參數
 */
static BOOL aspect_isCompatibleBlockSignature(NSMethodSignature *blockSignature, id object, SEL selector, NSError **error) {
    NSCParameterAssert(blockSignature);
    NSCParameterAssert(object);
    NSCParameterAssert(selector);

    BOOL signaturesMatch = YES;
    //把原方法轉化成方法簽名
    NSMethodSignature *methodSignature = [[object class] instanceMethodSignatureForSelector:selector];
    //判斷兩個方法編號的參數數量
    if (blockSignature.numberOfArguments > methodSignature.numberOfArguments) {
        signaturesMatch = NO;
    }else {
        //取出blockSignature的第一個參數是不是_cmd,對應的type就是'@',如果不等于'@',也不匹配
        if (blockSignature.numberOfArguments > 1) {
            const char *blockType = [blockSignature getArgumentTypeAtIndex:1];
            if (blockType[0] != '@') {
                signaturesMatch = NO;
            }
        }
        // Argument 0 is self/block, argument 1 is SEL or id<AspectInfo>. We start comparing at argument 2.
        // The block can have less arguments than the method, that's ok.
        //如果signaturesMatch = yes,下面才是比較嚴格的比較
        if (signaturesMatch) {
            for (NSUInteger idx = 2; idx < blockSignature.numberOfArguments; idx++) {
                const char *methodType = [methodSignature getArgumentTypeAtIndex:idx];
                const char *blockType = [blockSignature getArgumentTypeAtIndex:idx];
                // Only compare parameter, not the optional type data.
                if (!methodType || !blockType || methodType[0] != blockType[0]) {
                    signaturesMatch = NO; break;
                }
            }
        }
    }
    //如果經過上面的對比signaturesMatch都為NO,拋出異常
    if (!signaturesMatch) {
        NSString *description = [NSString stringWithFormat:@"Blog signature %@ doesn't match %@.", blockSignature, methodSignature];
        AspectError(AspectErrorIncompatibleBlockSignature, description);
        return NO;
    }
    return YES;
}
//把blcok轉換成方法簽名
#pragma mark 把blcok轉換成方法簽名
static NSMethodSignature *aspect_blockMethodSignature(id block, NSError **error) {
    AspectBlockRef layout = (__bridge void *)block;
    //判斷是否有AspectBlockFlagsHasSignature標志位,沒有報不包含方法簽名的error
    if (!(layout->flags & AspectBlockFlagsHasSignature)) {
        NSString *description = [NSString stringWithFormat:@"The block %@ doesn't contain a type signature.", block];
        AspectError(AspectErrorMissingBlockSignature, description);
        return nil;
    }
    void *desc = layout->descriptor;
    desc += 2 * sizeof(unsigned long int);
    if (layout->flags & AspectBlockFlagsHasCopyDisposeHelpers) {
        desc += 2 * sizeof(void *);
    }
    if (!desc) {
        NSString *description = [NSString stringWithFormat:@"The block %@ doesn't has a type signature.", block];
        AspectError(AspectErrorMissingBlockSignature, description);
        return nil;
    }
    const char *signature = (*(const char **)desc);
    return [NSMethodSignature signatureWithObjCTypes:signature];
}

這個方法先把block轉換成方法簽名,然后和原來的方法簽名進行對比,如果不一樣返回NO,一樣就進行賦值操作

4.把AspectIdentifier根據options添加到對應的數組中

- (void)addAspect:(AspectIdentifier *)aspect withOptions:(AspectOptions)options {
    NSParameterAssert(aspect);
    NSUInteger position = options&AspectPositionFilter;
    switch (position) {
        case AspectPositionBefore:  self.beforeAspects  = [(self.beforeAspects ?:@[]) arrayByAddingObject:aspect]; break;
        case AspectPositionInstead: self.insteadAspects = [(self.insteadAspects?:@[]) arrayByAddingObject:aspect]; break;
        case AspectPositionAfter:   self.afterAspects   = [(self.afterAspects  ?:@[]) arrayByAddingObject:aspect]; break;
    }
}

根據傳入的切面時機,進行對應數組的存儲;

5.開始進行hook

aspect_prepareClassAndHookSelector(self, selector, error);

小節一下:Aspects在hook之前會對傳入的參數的合法性進行校驗,然后把傳入的block(就是在原方法調用之前,之后調用,或者替換原方法的代碼塊)和原方法都轉換成方法簽名進行對比,如果一致就把所有信息保存到AspectIdentifier這個類里面(后期調用這個block的時候會用到這些信息),然后會根據傳進來的切面時機保存到AspectsContainer這個類里對應的數組中(最后通過遍歷,獲取到其中的一個AspectIdentifier對象,調用invokeWithInfo方法),準備工作做完以后開始對類和方法進行Hook操作了

二:Aspects是怎么對類和方法進行Hook的?

先對class進行hook再對selector進行hook

1.Hook Class

static Class aspect_hookClass(NSObject *self, NSError **error) {
    NSCParameterAssert(self);
    //獲取類
    Class statedClass = self.class;
    //獲取類的isa指針
    Class baseClass = object_getClass(self);
    
    NSString *className = NSStringFromClass(baseClass);

    // Already subclassed
    //判斷是否包含_Aspects_,如果包含,就說明被hook過了,
    //如果不包含_Aspects_,再判斷是不是元類,如果是元類調用aspect_swizzleClassInPlace
    //如果不包含_Aspects_,也不是元類,再判斷statedClass和baseClass是否相等,如果不相等,說明是被kvo過的對象因為kvo對象的isa指針指向了另一個中間類,調用aspect_swizzleClassInPlace
    
    if ([className hasSuffix:AspectsSubclassSuffix]) {
        return baseClass;

        // We swizzle a class object, not a single object.
    }else if (class_isMetaClass(baseClass)) {
        return aspect_swizzleClassInPlace((Class)self);
        // Probably a KVO'ed class. Swizzle in place. Also swizzle meta classes in place.
    }else if (statedClass != baseClass) {
        return aspect_swizzleClassInPlace(baseClass);
    }

    // Default case. Create dynamic subclass.
    //如果不是元類,也不是被kvo過的類,也沒有被hook過,就繼續往下執行,創建一個子類,
    //拼接類名為XXX_Aspects_
    const char *subclassName = [className stringByAppendingString:AspectsSubclassSuffix].UTF8String;
    //根據拼接的類名獲取類
    Class subclass = objc_getClass(subclassName);
    //如果上面獲取到的了為nil
    if (subclass == nil) {
        //baseClass = MainViewController,創建一個子類MainViewController_Aspects_
        subclass = objc_allocateClassPair(baseClass, subclassName, 0);
        //如果子類創建失敗,報錯
        if (subclass == nil) {
            NSString *errrorDesc = [NSString stringWithFormat:@"objc_allocateClassPair failed to allocate class %s.", subclassName];
            AspectError(AspectErrorFailedToAllocateClassPair, errrorDesc);
            return nil;
        }

        aspect_swizzleForwardInvocation(subclass);
        //把subclass的isa指向了statedClass
        aspect_hookedGetClass(subclass, statedClass);
        //subclass的元類的isa，也指向了statedClass。
        aspect_hookedGetClass(object_getClass(subclass), statedClass);
        //注冊剛剛新建的子類subclass，再調用object_setClass(self, subclass);把當前self的isa指向子類subclass
        objc_registerClassPair(subclass);
    }

    object_setClass(self, subclass);
    return subclass;
}

• 判斷className中是否包含_Aspects_,如果包含就說明這個類已經被Hook過了直接返回這個類的isa指針
• 如果不包含判斷在判斷是不是元類,如果是就調用aspect_swizzleClassInPlace()
• 如果不包含也不是元類,再判斷baseClass和statedClass是否相等,如果不相等,說明是被KVO過的對象
• 如果不是元類也不是被kvo過的類就繼續向下執行,創建一個子類,類名為原來類名+_Aspects_,創建成功調用aspect_swizzleForwardInvocation()交換IMP,把新建類的forwardInvocationIMP替換為__ASPECTS_ARE_BEING_CALLED__,然后把subClass的isa指針指向statedCass,subclass的元類的isa指針也指向statedClass,然后注冊新創建的子類subClass,再調用object_setClass(self, subclass);把當前self的isa指針指向子類subClass

aspect_swizzleClassInPlace()

static Class aspect_swizzleClassInPlace(Class klass) {
    NSCParameterAssert(klass);
    NSString *className = NSStringFromClass(klass);
    //創建無序集合
    _aspect_modifySwizzledClasses(^(NSMutableSet *swizzledClasses) {
        //如果集合中不包含className,添加到集合中
        if (![swizzledClasses containsObject:className]) {
            aspect_swizzleForwardInvocation(klass);
            [swizzledClasses addObject:className];
        }
    });
    return klass;
}

這個函數主要是:通過調用aspect_swizzleForwardInvocation ()函數把類的forwardInvocationIMP替換為__ASPECTS_ARE_BEING_CALLED__,然后把類名添加到集合中(這個集合后期刪除Hook的時候會用到的)

aspect_swizzleForwardInvocation(Class klass)

static void aspect_swizzleForwardInvocation(Class klass) {
    NSCParameterAssert(klass);
    // If there is no method, replace will act like class_addMethod.
    //把forwardInvocation的IMP替換成__ASPECTS_ARE_BEING_CALLED__
    //class_replaceMethod返回的是原方法的IMP
    IMP originalImplementation = class_replaceMethod(klass, @selector(forwardInvocation:), (IMP)__ASPECTS_ARE_BEING_CALLED__, "v@:@");
   // originalImplementation不為空的話說明原方法有實現，添加一個新方法__aspects_forwardInvocation:指向了原來的originalImplementation，在__ASPECTS_ARE_BEING_CALLED__那里如果不能處理，判斷是否有實現__aspects_forwardInvocation，有的話就轉發。
 
    if (originalImplementation) {
        class_addMethod(klass, NSSelectorFromString(AspectsForwardInvocationSelectorName), originalImplementation, "v@:@");
    }
    AspectLog(@"Aspects: %@ is now aspect aware.", NSStringFromClass(klass));
}

交換方法實現IMP,把forwardInvocation:的IMP替換成__ASPECTS_ARE_BEING_CALLED__,這樣做的目的是:在把selector進行hook以后會把原來的方法的IMP指向objc_forward,然后就會調用forwardInvocation :,因為forwardInvocation :的IMP指向的是__ASPECTS_ARE_BEING_CALLED__函數,最終就會調用到這里來,在這里面執行hook代碼和原方法,如果原來的類有實現forwardInvocation :這個方法,就把這個方法的IMP指向__aspects_forwardInvocation:

aspect_hookedGetClass

static void aspect_hookedGetClass(Class class, Class statedClass) {
    NSCParameterAssert(class);
    NSCParameterAssert(statedClass);
    Method method = class_getInstanceMethod(class, @selector(class));
    IMP newIMP = imp_implementationWithBlock(^(id self) {
        return statedClass;
    });
    class_replaceMethod(class, @selector(class), newIMP, method_getTypeEncoding(method));
}

根據傳遞的參數,把新創建的類和該類的元類的class方法的IMP指向原來的類(以后新建的類再調用class方法,返回的都是statedClass)

object_setClass(self, subclass);

把原來類的isa指針指向新創建的類

接下來再說說是怎么對method進行hook的

static void aspect_prepareClassAndHookSelector(NSObject *self, SEL selector, NSError **error) {
    NSCParameterAssert(selector);
    Class klass = aspect_hookClass(self, error);
    Method targetMethod = class_getInstanceMethod(klass, selector);
    IMP targetMethodIMP = method_getImplementation(targetMethod);
    if (!aspect_isMsgForwardIMP(targetMethodIMP)) {
        // Make a method alias for the existing method implementation, it not already copied.
        const char *typeEncoding = method_getTypeEncoding(targetMethod);
        SEL aliasSelector = aspect_aliasForSelector(selector);
        //子類里面不能響應aspects_xxxx，就為klass添加aspects_xxxx方法，方法的實現為原生方法的實現
        if (![klass instancesRespondToSelector:aliasSelector]) {
            __unused BOOL addedAlias = class_addMethod(klass, aliasSelector, method_getImplementation(targetMethod), typeEncoding);
            NSCAssert(addedAlias, @"Original implementation for %@ is already copied to %@ on %@", NSStringFromSelector(selector), NSStringFromSelector(aliasSelector), klass);
        }

        // We use forwardInvocation to hook in.
        class_replaceMethod(klass, selector, aspect_getMsgForwardIMP(self, selector), typeEncoding);
        AspectLog(@"Aspects: Installed hook for -[%@ %@].", klass, NSStringFromSelector(selector));
    }
}

上面的代碼主要是對selector進行hook,首先獲取到原來的方法,然后判斷判斷是不是指向了_objc_msgForward,沒有的話,就獲取原來方法的方法編碼,為新建的子類添加一個方法aspects__xxxxx,并將新建方法的IMP指向原來方法,再把原來類的方法的IMP指向_objc_msgForward,hook完畢

三:ASPECTS_ARE_BEING_CALLED

static void __ASPECTS_ARE_BEING_CALLED__(__unsafe_unretained NSObject *self, SEL selector, NSInvocation *invocation) {
    NSCParameterAssert(self);
    NSCParameterAssert(invocation);
    //獲取原始的selector
    SEL originalSelector = invocation.selector;
    //獲取帶有aspects_xxxx前綴的方法
    SEL aliasSelector = aspect_aliasForSelector(invocation.selector);
    //替換selector
    invocation.selector = aliasSelector;
    //獲取實例對象的容器objectContainer，這里是之前aspect_add關聯過的對象
    AspectsContainer *objectContainer = objc_getAssociatedObject(self, aliasSelector);
    //獲取獲得類對象容器classContainer
    AspectsContainer *classContainer = aspect_getContainerForClass(object_getClass(self), aliasSelector);
    //初始化AspectInfo，傳入self、invocation參數
    AspectInfo *info = [[AspectInfo alloc] initWithInstance:self invocation:invocation];
    NSArray *aspectsToRemove = nil;

    // Before hooks.
    //調用宏定義執行Aspects切片功能
    //宏定義里面就做了兩件事情，一個是執行了[aspect invokeWithInfo:info]方法，一個是把需要remove的Aspects加入等待被移除的數組中。
    aspect_invoke(classContainer.beforeAspects, info);
    aspect_invoke(objectContainer.beforeAspects, info);

    // Instead hooks.
    BOOL respondsToAlias = YES;
    if (objectContainer.insteadAspects.count || classContainer.insteadAspects.count) {
        aspect_invoke(classContainer.insteadAspects, info);
        aspect_invoke(objectContainer.insteadAspects, info);
    }else {
        Class klass = object_getClass(invocation.target);
        do {
            if ((respondsToAlias = [klass instancesRespondToSelector:aliasSelector])) {
                [invocation invoke];
                break;
            }
        }while (!respondsToAlias && (klass = class_getSuperclass(klass)));
    }

    // After hooks.
    aspect_invoke(classContainer.afterAspects, info);
    aspect_invoke(objectContainer.afterAspects, info);

    // If no hooks are installed, call original implementation (usually to throw an exception)
    if (!respondsToAlias) {
        invocation.selector = originalSelector;
        SEL originalForwardInvocationSEL = NSSelectorFromString(AspectsForwardInvocationSelectorName);
        if ([self respondsToSelector:originalForwardInvocationSEL]) {
            ((void( *)(id, SEL, NSInvocation *))objc_msgSend)(self, originalForwardInvocationSEL, invocation);
        }else {
            [self doesNotRecognizeSelector:invocation.selector];
        }
    }

    // Remove any hooks that are queued for deregistration.
    [aspectsToRemove makeObjectsPerformSelector:@selector(remove)];
}
#define aspect_invoke(aspects, info) \
for (AspectIdentifier *aspect in aspects) {\
    [aspect invokeWithInfo:info];\
    if (aspect.options & AspectOptionAutomaticRemoval) { \
        aspectsToRemove = [aspectsToRemove?:@[] arrayByAddingObject:aspect]; \
    } \
}
- (BOOL)invokeWithInfo:(id<AspectInfo>)info {
    NSInvocation *blockInvocation = [NSInvocation invocationWithMethodSignature:self.blockSignature];
    NSInvocation *originalInvocation = info.originalInvocation;
    NSUInteger numberOfArguments = self.blockSignature.numberOfArguments;

    // Be extra paranoid. We already check that on hook registration.
    if (numberOfArguments > originalInvocation.methodSignature.numberOfArguments) {
        AspectLogError(@"Block has too many arguments. Not calling %@", info);
        return NO;
    }

    // The `self` of the block will be the AspectInfo. Optional.
    if (numberOfArguments > 1) {
        [blockInvocation setArgument:&info atIndex:1];
    }
    
    void *argBuf = NULL;
    //把originalInvocation中的參數
    for (NSUInteger idx = 2; idx < numberOfArguments; idx++) {
        const char *type = [originalInvocation.methodSignature getArgumentTypeAtIndex:idx];
        NSUInteger argSize;
        NSGetSizeAndAlignment(type, &argSize, NULL);
        
        if (!(argBuf = reallocf(argBuf, argSize))) {
            AspectLogError(@"Failed to allocate memory for block invocation.");
            return NO;
        }
        
        [originalInvocation getArgument:argBuf atIndex:idx];
        [blockInvocation setArgument:argBuf atIndex:idx];
    }
    
    [blockInvocation invokeWithTarget:self.block];
    
    if (argBuf != NULL) {
        free(argBuf);
    }
    return YES;
}

獲取數據傳遞到aspect_invoke里面,調用invokeWithInfo,執行切面代碼塊,執行完代碼塊以后,獲取到新創建的類,判斷是否可以響應aspects__xxxx方法,現在aspects__xxxx方法指向的是原來方法實現的IMP,如果可以響應,就通過[invocation invoke];調用這個方法,如果不能響應就調用__aspects_forwardInvocation:這個方法,這個方法在hookClass的時候提到了,它的IMP指針指向了原來類中的forwardInvocation:實現,可以響應就去執行,不能響應就拋出異常doesNotRecognizeSelector;
整個流程差不多就這些,最后還有一個移除的操作

四:移除Aspects

- (BOOL)remove {
    return aspect_remove(self, NULL);
}
static BOOL aspect_remove(AspectIdentifier *aspect, NSError **error) {
    NSCAssert([aspect isKindOfClass:AspectIdentifier.class], @"Must have correct type.");

    __block BOOL success = NO;
    aspect_performLocked(^{
        id self = aspect.object; // strongify
        if (self) {
            AspectsContainer *aspectContainer = aspect_getContainerForObject(self, aspect.selector);
            success = [aspectContainer removeAspect:aspect];

            aspect_cleanupHookedClassAndSelector(self, aspect.selector);
            // destroy token
            aspect.object = nil;
            aspect.block = nil;
            aspect.selector = NULL;
        }else {
            NSString *errrorDesc = [NSString stringWithFormat:@"Unable to deregister hook. Object already deallocated: %@", aspect];
            AspectError(AspectErrorRemoveObjectAlreadyDeallocated, errrorDesc);
        }
    });
    return success;
}

調用remove方法,然后清空AspectsContainer里面的數據,調用aspect_cleanupHookedClassAndSelector清除更多的數據

// Will undo the runtime changes made.
static void aspect_cleanupHookedClassAndSelector(NSObject *self, SEL selector) {
    NSCParameterAssert(self);
    NSCParameterAssert(selector);

    Class klass = object_getClass(self);
    BOOL isMetaClass = class_isMetaClass(klass);
    if (isMetaClass) {
        klass = (Class)self;
    }

    // Check if the method is marked as forwarded and undo that.
    Method targetMethod = class_getInstanceMethod(klass, selector);
    IMP targetMethodIMP = method_getImplementation(targetMethod);
    //判斷selector是不是指向了_objc_msgForward
    if (aspect_isMsgForwardIMP(targetMethodIMP)) {
        // Restore the original method implementation.
        //獲取到方法編碼
        const char *typeEncoding = method_getTypeEncoding(targetMethod);
        //拼接selector
        SEL aliasSelector = aspect_aliasForSelector(selector);
        Method originalMethod = class_getInstanceMethod(klass, aliasSelector);
        //獲取新添加類中aspects__xxxx方法的IMP
        IMP originalIMP = method_getImplementation(originalMethod);
        NSCAssert(originalMethod, @"Original implementation for %@ not found %@ on %@", NSStringFromSelector(selector), NSStringFromSelector(aliasSelector), klass);
        //把aspects__xxxx方法的IMP指回元類類的方法
        class_replaceMethod(klass, selector, originalIMP, typeEncoding);
        AspectLog(@"Aspects: Removed hook for -[%@ %@].", klass, NSStringFromSelector(selector));
    }

    // Deregister global tracked selector
    aspect_deregisterTrackedSelector(self, selector);

    // Get the aspect container and check if there are any hooks remaining. Clean up if there are not.
    AspectsContainer *container = aspect_getContainerForObject(self, selector);
    if (!container.hasAspects) {
        // Destroy the container
        aspect_destroyContainerForObject(self, selector);

        // Figure out how the class was modified to undo the changes.
        NSString *className = NSStringFromClass(klass);
        if ([className hasSuffix:AspectsSubclassSuffix]) {
            Class originalClass = NSClassFromString([className stringByReplacingOccurrencesOfString:AspectsSubclassSuffix withString:@""]);
            NSCAssert(originalClass != nil, @"Original class must exist");
            object_setClass(self, originalClass);
            AspectLog(@"Aspects: %@ has been restored.", NSStringFromClass(originalClass));

            // We can only dispose the class pair if we can ensure that no instances exist using our subclass.
            // Since we don't globally track this, we can't ensure this - but there's also not much overhead in keeping it around.
            //objc_disposeClassPair(object.class);
        }else {
            // Class is most likely swizzled in place. Undo that.
            if (isMetaClass) {
                aspect_undoSwizzleClassInPlace((Class)self);
            }
        }
    }
}

上述代碼主要做以下幾件事:

• 獲取原來類的方法的IMP是不是指向了_objc_msgForward,如果是就把該方法的IMP再指回去
• 如果是元類就刪除swizzledClasses里面的數據
• 把新建類的isa指針指向原來類
  其實就是把hook的時候做的處理,又還原了

大概就那么多東西了,如果有不明白,或者寫錯的地方歡迎大家指出,共同學習,共同成長...