原文地址:http://www.eswick.com/2014/06/inside-swift/

 

Inside Swift

Swift is Apple’s new programming language, said by many to ‘replace’ Objective-C. This is not the case. I’ve spent some time reverse engineering Swift binaries and the runtime, and I’ve found out quite a bit about it. So far, the verdict is this; Swift is Objective-C without messages.

Objects

Believe it or not, Swift objects are actually Objective-C objects. In a Mach-O binary, the__objc_classlist section contains data for each class in the binary. The structure is like so:

struct objc_class {uint64_t isa;uint64_t superclass;uint64_t cache;uint64_t vtable;uint64_t data;};

(note: all structures are from 64-bit builds)

Note the data entry. It points to a structure listing the methods, ivars, protocols, etc. of the class. Normally, data is 8-byte-aligned. However, for Swift classes, the last bit of data will be 1.

Classes

The actual structure for Swift classes is a bit odd. Swift classes have no Objective-C methods. We’ll get to that later. Variables for Swift classes are stored as ivars. The Swift getter and setter methods actually modify the ivar values. Oddly, ivars for Swift classes have no type encoding. The pointer that is normally supposed to point to the type encoding is NULL. This is presumably due to the fact that the Objective-C runtime is not supposed to deal with Swift variables itself.

Inheritance

Inheritance in Swift is as you would expect. In Swift, a Square that is a subclass of Shape will also be a subclass of Shape in the Objective-C class. However, what if a class in Swift doesn’t have a superclass?

e.g.

class Shape { }

In this case, the Shape class would be a subclass of SwiftObjectSwiftObject is a root Objective-C class, similar to NSObject. It has no superclass, meaning the isa points to itself. Its purpose is to use Swift runtime methods for things like allocation and deallocation, instead of the standard Objective-C runtime. For example, - (void)retain does not call objc_retain, but instead callsswift_retain.

Class Methods

Like I mentioned earlier, classes for Swift objects have no methods. Instead, they have been replaced with C++-like functions, mangling and all. This is likely why Swift has been said to be much faster than Objective-C; there is no more need for objc_msgSend to find and call method implementations.

In Objective-C, method implementations are like so:

type method(id self, SEL _cmd, id arg1, id arg2, ...)

Swift methods are very similar, but with a slightly different argument layout. self is passed as the last argument, and there is no selector.

type method(id arg1, id arg2, ..., id self)

vtable

Just like in C++, Swift classes have a vtable which lists the methods in the class. It is located directly after the class data in the binary, and looks something like this:

struct swift_vtable_header {uint32_t vtable_size;uint32_t unknown_000;uint32_t unknown_001;uint32_t unknown_002;void* nominalTypeDescriptor;// vtable pointers}

From what I can tell, the vtable for a Swift class is only used when it is visible during compile time. Otherwise, it finds the mangled symbol.

Name Mangling

Swift keeps metadata about functions (and more) in their respective symbols, which is called name mangling. This metadata includes the function’s name (obviously), attributes, module name, argument types, return type, and more. Take this for example:

classShape{
func numberOfSides()->Int{return5}}

The mangled name for the simpleDescription method is_TFC9swifttest5Shape17simpleDescriptionfS0_FT_Si. Here’s the breakdown:

_T – The prefix for all Swift symbols. Everything will start with this.

F – Function.

C – Function of a class. (method)

9swifttest – The module name, with a prefixed length.

5Shape – The class name the function belongs to, again, with a prefixed length.

17simpleDescription – The function name.

f – The function attribute. In this case it’s ‘f’, which is just a normal function. We’ll get to that in a minute.

S0_FT – I’m not exactly sure what this means, but it appears to mark the start of the arguments and return type.

‘_’ – This underscore separates the argument types from the return type. Since the function takes no arguments, it comes directly after S0_FT.

S – This is the beginning of the return type. The ‘S’ stands for Swift; the return type is a Swift builtin type. The next character determines the type.

i – This is the Swift builtin type. A lowercase ‘I’, which stands for Int.

Function Attributes

Character
Type
f Normal Function
s Setter
g Getter
d Destructor
D Deallocator
c Constructor
C Allocator

Swift Builtins

Character
Type
a Array
b Bool
c UnicodeScalar
d Double
f Float
i Int
u UInt
Q ImplicitlyUnwrappedOptional
S String

There’s a lot more to name mangling than just functions, but I’ve just given a brief overview.

Function Hooking

Enough with semantics, let’s get to the fun part! Let’s say we have a class like so:

classShape{var numberOfSides:Int;

    init(){
numberOfSides =5;}}

Let’s say we want to change the numberOfSides to 4. There are multiple ways to do this. We could use MobileSubstrate to hook into the getter method, and change the return value, like so:

int(*numberOfSides)(id self);MSHook(int, numberOfSides, id self){return4;}%ctor{
numberOfSides =(int(*)(id self)) dlsym(RTLD_DEFAULT,"_TFC9swifttest5Shapeg13numberOfSidesSi");MSHookFunction(numberOfSides,MSHake(numberOfSides));}

If we create an instance of Shape and print out the value of numberOfSides, we see 4! That wasn’t so bad, was it? Now, I know what you’re thinking; “aren’t you supposed to return an object instead of a 4 literal?”

Well, in Swift, a lot of the builtin types are literals. An Int, for example, is the same as an int in C (although it could be a long – don’t hold me to that). A little note, the String type is a little bit odd; it’s a little-endian UTF-16 string, so no C literals can be used.

Let’s do the same thing, but this time, we’ll hook the setter instead of the getter.

void(*setNumberOfSides)(int newNumber, id self);MSHook(void, setNumberOfSides,int newNumber, id self){
_setNumberOfSides(4,self);}%ctor {
setNumberOfSides =(void(*)(int newNumber, id self)) dlsym(RTLD_DEFAULT,"_TFC9swifttest5Shapes13numberOfSidesSi");MSHookFunction(setNumberOfSides,MSHake(setNumberOfSides));}

Try it again and….it’s still 5. What is happening, you ask? Well, in certain places in Swift, functions are inlined. The class constructor is one of these places. It directly sets the numberOfSides ivar. So, the setter will only be called if the number is set again from the top level code. Call it from there and, what do you know, we get 4.

Finally, let’s change numberOfSides by directly setting the ivar.

void(*setNumberOfSides)(int newNumber, id self);MSHook(void, setNumberOfSides,int newNumber, id self){MSHookIvar<int>(self,"numberOfSides")=4;}%ctor {
setNumberOfSides =(void(*)(int newNumber, id self)) dlsym(RTLD_DEFAULT,"_TFC9swifttest5Shapes13numberOfSidesSi");MSHookFunction(setNumberOfSides,MSHake(setNumberOfSides));}

This works. It’s not recommended, but it works.

That’s all I have to write about for now. There’s quite a few other things that I’m looking at, including witness tables, but I don’t know enough about them to write. A lot of things in this post are subject to change. They’re just what I’ve reverse engineered so far by looking at the runtime and binaries compiled with Swift.

What I’ve found here is very good. It means that MobileSubstrate will not die along with Objective-C, and tweaks can still be made! I wonder what the future has in store for the jailbreaking scene… maybe Logos could be updated to automatically mangle names? Or even a library that deals with common Swift types…

If you find out more about how Swift works, don’t hesitate to let me know!

[转]Inside Swift的更多相关文章

  1. 窥探Swift编程之别样的HelloWorld

    从今天就开始陆陆续续的发布一些有关Swift语言的东西,虽然目前在公司项目开发中Objective-C还是iOS开发的主力军,但是在不久的将来Swift将会成为iOS开发中的新生宠儿.所以在在Xcod ...

  2. 使用 Swift 在 iOS 10 中集成 Siri —— SiriKit 教程

    下载 Xcode 8,配置 iOS 10 和 Swift 3 (可选)通过命令行编译 除 非你想使用命令行编译,使用 Swift 3.0 的工具链并不需要对项目做任何改变.如果你想的话,打开 Xcod ...

  3. Send Push Notifications to iOS Devices using Xcode 8 and Swift 3, APNs Auth Key

    Send Push Notifications to iOS Devices using Xcode 8 and Swift 3 OCT 6, 2016 Push notifications are ...

  4. Swift 用Delegate和Block实现回调的Demo

    一.有关回调 我们知道,执行函数的时候,一般都有return作为返回参数了,那有return了为什么还要回调呢? 回调是为了实现异步的返回,在某些特殊的情况下,比如你执行的函数是一个长时间运行的函数, ...

  5. Swift 1.0: missing argument label 'xxx' in call

    注意,这个问题是在swift1.0时发生的,swift2.0中,好像统一了function 和 method 的定义,具体待正式版发布后研究一下! 今天在使用swift时发现,写的func总是要求写出 ...

  6. 弱引用?强引用?未持有?额滴神啊-- Swift 引用计数指导

    ARC ARC 苹果版本的自动内存管理的编译时间特性.它代表了自动引用计数(Automatic Reference Counting).也就是对于一个对象来说,只有在引用计数为0的情况下内存才会被释放 ...

  7. swift混编oc碰到的问题

    在swift中混编苹果官方的Reachability OC文件. 因为swift工程的target是生成framework而非app,framework中调用oc与app中使用桥接文件还不一样,参考: ...

  8. swift SDWebImage使用

    Web image(网络图像) 该库提供了一个支持来自Web的远程图像的UIImageView类别它提供了: 添加网络图像和缓存管理到Cocoa Touch framework的UIImageView ...

  9. Swift学习笔记十三

    初始化 初始化是一个在类.结构体或枚举的实例对象创建之前,对它进行预处理的过程,包括给那个对象的每一个存储式属性设定初始值,以及进行一些其他的准备操作. 通过定义初始化器(initializer)来实 ...

随机推荐

  1. java 选择文件夹对话框

    java swing 选择文件夹对话框 import java.io.File; import javax.swing.JFileChooser; public class Test2 { publi ...

  2. linux_UBUNTU 12.04 上使用 SQUID 架设HTTP正向代理服务器

    配置普通HTTP正向代理 安装   1 sudo apt-get install squid squid-common 配置 squid3   1 sudo vim /etc/squid3/squid ...

  3. linux_增加用户组_删除用户

    添加账号组 /usr/sbin/groupadd iknow 添加账号 /usr/sbin/useradd  -g iknow -d /home/iknow/ iknow 更改密码 passwd 选项 ...

  4. 通过私有协议Chrome浏览器页面打开本地程序

    近期方有这样的要求:这两个系统,根据一组Chrome开展,根据一组IE开展,需要Chrome添加一个链接,然后进入IE该系统的开发.这,需要Chrome跳转到创建一个链接IE浏览器指定的页面.同时也实 ...

  5. Largest Rectangular Area in a Histogram

    题目地址:https://oj.leetcode.com/problems/largest-rectangle-in-histogram/ ,刚開始事实上没做这个题,而是在做https://oj.le ...

  6. 新版live555代理server

    好久没搞流媒体了,近期又回归了,已经把live555代理服务器更新到最新的live555代码(V0.82). 改进了一大坨问题,还去掉了一个类,代码更精简了. 改进了命令行參数格式,仅仅要这样:rts ...

  7. windows下用c实现Socket通信

    原文:windows下用c实现Socket通信 原本以为c是跨平台,所以,c在windows下和linux下的程序应该是类似于Java,什么都不用改变的,今儿才恍然大悟,他们的类库不一样啊-- 下面我 ...

  8. SICP 锻炼 (1.45)解决摘要

    SICP 1.45是对前面非常多关于不动点的习题的总结. 题目回想了我们之前在1.3.3节使用的不动点寻找方法.当寻找y -> x/y 的不动点的时候,这个变换本身不收敛.须要做一次平均阻尼才干 ...

  9. 四大OLAP工具选型浅析

    OLAP(在线分析处理)这个名词是在1993年由E.F.Codd提出来的,只是,眼下市场上的主流产品差点儿都是在1993年之前就已出来,有的甚至已有三十多年的历史了.OLAP产品不少,本文将主要涉及C ...

  10. SQL点滴18—SqlServer中的merge操作,相当地风骚

    原文:SQL点滴18-SqlServer中的merge操作,相当地风骚 今天在一个存储过程中看见了merge这个关键字,第一个想法是,这个是配置管理中的概念吗,把相邻两次的更改合并到一起.后来在tec ...