截屏2022-04-21 下午1.54.23.png
通过调试父获取isa指针
(lldb) x/4gx person
0x600000890650: 0x0000000100380460 0x0000000000000000
0x600000890660: 0x0000000100000000 0x0000000000000000
使用x/4gx person 获取了person对象的16进制的地址。第一个值就是对象的isa指针。那接下来 如何通过对象的 isa指针获取类对象呢。我们需要位运算的与运算。
1，首先我们要获取isa指针的掩码。这个掩码是根据当前所用的运行机器的cup类型来获取的。如果是arm64的cpu那么掩码就是0x007ffffffffffff8ULL
#if SUPPORT_PACKED_ISA
//根据机器的类型，悬着正确的掩码
// extra_rc must be the MSB-most field (so it matches carry/overflow flags)
// nonpointer must be the LSB (fixme or get rid of it)
// shiftcls must occupy the same bits that a real class pointer would
// bits + RC_ONE is equivalent to extra_rc + 1
// RC_HALF is the high bit of extra_rc (i.e. half of its range)
// future expansion:
// uintptr_t fast_rr : 1; // no r/r overrides
// uintptr_t lock : 2; // lock for atomic property, @synch
// uintptr_t extraBytes : 1; // allocated with extra bytes
# if __arm64__
// ARM64 simulators have a larger address space, so use the ARM64e
// scheme even when simulators build for ARM64-not-e.
# if __has_feature(ptrauth_calls) || TARGET_OS_SIMULATOR
# define ISA_MASK 0x007ffffffffffff8ULL
# define ISA_MAGIC_MASK 0x0000000000000001ULL
# define ISA_MAGIC_VALUE 0x0000000000000001ULL
# define ISA_HAS_CXX_DTOR_BIT 0
# define ISA_BITFIELD \
uintptr_t nonpointer : 1; \
uintptr_t has_assoc : 1; \
uintptr_t weakly_referenced : 1; \
uintptr_t shiftcls_and_sig : 52; \
uintptr_t has_sidetable_rc : 1; \
uintptr_t extra_rc : 8
# define RC_ONE (1ULL<<56)
# define RC_HALF (1ULL<<7)
# else
# define ISA_MASK 0x0000000ffffffff8ULL
# define ISA_MAGIC_MASK 0x000003f000000001ULL
# define ISA_MAGIC_VALUE 0x000001a000000001ULL
# define ISA_HAS_CXX_DTOR_BIT 1
# define ISA_BITFIELD \
uintptr_t nonpointer : 1; \
uintptr_t has_assoc : 1; \
uintptr_t has_cxx_dtor : 1; \
uintptr_t shiftcls : 33; /*MACH_VM_MAX_ADDRESS 0x1000000000*/ \
uintptr_t magic : 6; \
uintptr_t weakly_referenced : 1; \
uintptr_t unused : 1; \
uintptr_t has_sidetable_rc : 1; \
uintptr_t extra_rc : 19
# define RC_ONE (1ULL<<45)
# define RC_HALF (1ULL<<18)
# endif
# elif __x86_64__
# define ISA_MASK 0x00007ffffffffff8ULL
# define ISA_MAGIC_MASK 0x001f800000000001ULL
# define ISA_MAGIC_VALUE 0x001d800000000001ULL
# define ISA_HAS_CXX_DTOR_BIT 1
# define ISA_BITFIELD \
uintptr_t nonpointer : 1; \
uintptr_t has_assoc : 1; \
uintptr_t has_cxx_dtor : 1; \
uintptr_t shiftcls : 44; /*MACH_VM_MAX_ADDRESS 0x7fffffe00000*/ \
uintptr_t magic : 6; \
uintptr_t weakly_referenced : 1; \
uintptr_t unused : 1; \
uintptr_t has_sidetable_rc : 1; \
uintptr_t extra_rc : 8
# define RC_ONE (1ULL<<56)
# define RC_HALF (1ULL<<7)
# else
# error unknown architecture for packed isa
# endif
// SUPPORT_PACKED_ISA
#endif
2, 通过与运算。获取到一个内存地址。
//使用p/x 获取到一个16进制形式的内存地址
(lldb) p/x 0x0000000100380460 & 0x007ffffffffffff8ULL
(unsigned long long) $1 = 0x0000000100380460
//使用po打印一下内存地址。获得 一个LGPersion的类对象
(lldb) po 0x0000000100380460
LGPersion
同样的步骤。通过x/4gx获取类对象的isa指针，然后通过位与运算。获取到了类对象指向元类的内存地址。
(lldb) x/4gx 0x0000000104bfc460
0x104bfc460: 0x0000000104bfc438 0x000000010d6e1310
0x104bfc470: 0x0000600002bef8c0 0x0001801000000003
(lldb) p/x 0x0000000104bfc438 & 0x007ffffffffffff8ULL
(unsigned long long) $3 = 0x0000000104bfc438
(lldb) po 0x0000000104bfc438
LGPersion
可以说，实例对象的isa指向 了类对象的内存地址。类对象的内存地址通过实例对象的isa指针与运算isa掩码。得到 类对象的内存地址。然后通过类对象的isa指针找到元类的内存地址
(lldb) x/4gx 0x0000000104bfc438
0x104bfc438: 0x000000010d6e12c0 0x000000010d6e12c0
0x104bfc448: 0x0000600002bfbe00 0x0002c03100000003
(lldb) p/x 0x000000010d6e12c0 & 0x007ffffffffffff8ULL
(unsigned long long) $5 = 0x000000010d6e12c0
(lldb) po 0x000000010d6e12c0
NSObject
通过同样的方式，可以获取到元类 的isa指针指向的内存地址 是NSObject.那么NSObject就是根元类。继续上面的过程我们可以看到根源类isa指针指向的内存地址是根源类本身。那么就说明根源类的isa指针指向了自己。
(lldb) x/4gx 0x000000010d6e12c0
0x10d6e12c0: 0x000000010d6e12c0 0x000000010d6e1310
0x10d6e12d0: 0x00006000002bf200 0x0008c0310000000f
(lldb) p/x 0x000000010d6e12c0 & 0x007ffffffffffff8ULL
(unsigned long long) $7 = 0x000000010d6e12c0
(lldb) po 0x000000010d6e12c0
NSObject
上面打印出来的NSObject和我们认识的类NSObject有什么不同呢。首先我们获取一下类对象的内存地址
(lldb) p/x NSObject.class
(Class) $9 = 0x000000010d6e1310 NSObject
//可以看到改内存地址和上面内存地址是不相同的。那么我们继续获取NSObject类的元类
(lldb) x/4gx 0x000000010d6e1310
0x10d6e1310: 0x000000010d6e12c0 0x0000000000000000
0x10d6e1320: 0x00007f97b0711130 0x000680100000001f
(lldb) p/x 0x000000010d6e12c0 & 0x007ffffffffffff8ULL
(unsigned long long) $10 = 0x000000010d6e12c0
(lldb) po 0x000000010d6e12c0
NSObject
//我们可以看到元类指向的是元类，并不是指向的类
我们可以 根据下面的打印公式来看一下实例对象，类对象。元类，根源类之间的继承关系
//NSobject 类对象
NSObject *objc = [NSObject new];
// 获取类对象
Class class = object_getClass(objc);
// 获取类对象的元类
Class metaClass = object_getClass(class);
// 获取子类的元类
Class pMetaClass = objc_getMetaClass(@"LGPersion");
// 获取元类的父类
Class pMetaSuperClass = class_getSuperclass(pMetaClass);
1682758-675c67c6868038d1.jpeg
