第二部分：

uintptr_t
_main(const macho_header* mainExecutableMH, uintptr_t mainExecutableSlide, int argc, const char* argv[], const char* envp[], const char* apple[], uintptr_t* startGlue)
{
    /*
     *省略了前面的全部代碼
     */

  char dyldPathBuffer[MAXPATHLEN+1];
        
  int len = proc_regionfilename(getpid(), (uint64_t)(long)addressInDyld, dyldPathBuffer, MAXPATHLEN);
        
  if ( len > 0 ) {
    dyldPathBuffer[len] = '\0'; // proc_regionfilename() does not zero terminate returned string
    if ( strcmp(dyldPathBuffer, gProcessInfo->dyldPath) != 0 )  
        gProcessInfo->dyldPath = strdup(dyldPathBuffer);
      }

        /* **********************循環(huán)加載插入的libraries*************************/
      // load any inserted libraries
      if    ( sEnv.DYLD_INSERT_LIBRARIES != NULL ) {
            
           for (const char* const* lib = sEnv.DYLD_INSERT_LIBRARIES; *lib != NULL; ++lib)   
               loadInsertedDylib(*lib);
             }
          // record count of inserted libraries so that a flat search will look at     
         // inserted libraries, then main, then others.
        sInsertedDylibCount = sAllImages.size()-1;

        // link main executable
        
        gLinkContext.linkingMainExecutable = true;
#if SUPPORT_ACCELERATE_TABLES
          if ( mainExcutableAlreadyRebased ) {
            // previous link() on main executable has already adjusted its internal pointers for ASLR
            // work around that by rebasing by inverse amount
            sMainExecutable->rebase(gLinkContext, -mainExecutableSlide);
        }
#endif
        /* **********************鏈接主程序*************************/
        
        link(sMainExecutable, sEnv.DYLD_BIND_AT_LAUNCH, true, ImageLoader::RPathChain(NULL, NULL), -1);
        sMainExecutable->setNeverUnloadRecursive();
        if ( sMainExecutable->forceFlat() ) {
            gLinkContext.bindFlat = true;
            gLinkContext.prebindUsage = ImageLoader::kUseNoPrebinding;
        }

        /* **********************鏈接 所有 插入的 libraries*************************/
        // link any inserted libraries
        // do this after linking main executable so that any dylibs pulled in by inserted 
        // dylibs (e.g. libSystem) will not be in front of dylibs the program uses
        if ( sInsertedDylibCount > 0 ) {
            for(unsigned int i=0; i < sInsertedDylibCount; ++i) {
                ImageLoader* image = sAllImages[i+1];
                link(image, sEnv.DYLD_BIND_AT_LAUNCH, true, ImageLoader::RPathChain(NULL, NULL), -1);
                image->setNeverUnloadRecursive();
            }
            if ( gLinkContext.allowInterposing ) {
                // only INSERTED libraries can interpose
                // register interposing info after all inserted libraries are bound so chaining works
                for(unsigned int i=0; i < sInsertedDylibCount; ++i) {
                    ImageLoader* image = sAllImages[i+1];
                    image->registerInterposing(gLinkContext);
                }
            }
        }

        if ( gLinkContext.allowInterposing ) {
            // <rdar://problem/19315404> dyld should support interposition even without DYLD_INSERT_LIBRARIES
            for (long i=sInsertedDylibCount+1; i < sAllImages.size(); ++i) {
                ImageLoader* image = sAllImages[I];
                if ( image->inSharedCache() )
                    continue;
                image->registerInterposing(gLinkContext);
            }
        }
        

  /*
  *省略了后面的全部代碼
  */
}

第二部分是插入動(dòng)態(tài)庫(kù)和鏈接過(guò)程，先插入了所有動(dòng)態(tài)庫(kù)废恋，然后連接了主程序以及所有動(dòng)態(tài)庫(kù)谈秫。

第三部分：

uintptr_t
_main(const macho_header* mainExecutableMH, uintptr_t mainExecutableSlide, int argc, const char* argv[], const char* envp[], const char* apple[], uintptr_t* startGlue)
{

/*
*省略了前面的全部代碼
*/

// apply interposing to initial set of images
        for(int i=0; i < sImageRoots.size(); ++i) {
            sImageRoots[i]->applyInterposing(gLinkContext);
        }
        ImageLoader::applyInterposingToDyldCache(gLinkContext);

        /* **********************綁定 通知主程序interposing 已經(jīng)注冊(cè)完畢*************************/
        
        // Bind and notify for the main executable now that interposing has been registered
        uint64_t bindMainExecutableStartTime = mach_absolute_time();
        sMainExecutable->recursiveBindWithAccounting(gLinkContext, sEnv.DYLD_BIND_AT_LAUNCH, true);
        uint64_t bindMainExecutableEndTime = mach_absolute_time();
        ImageLoaderMachO::fgTotalBindTime += bindMainExecutableEndTime - bindMainExecutableStartTime;
        gLinkContext.notifyBatch(dyld_image_state_bound, false);

        // Bind and notify for the inserted images now interposing has been registered
        if ( sInsertedDylibCount > 0 ) {
            for(unsigned int i=0; i < sInsertedDylibCount; ++i) {
                ImageLoader* image = sAllImages[i+1];
                image->recursiveBind(gLinkContext, sEnv.DYLD_BIND_AT_LAUNCH, true, nullptr);
            }
        }
        
        /* ****************** 弱綁定 ********************/
        
        // <rdar://problem/12186933> do weak binding only after all inserted images linked
        sMainExecutable->weakBind(gLinkContext);
        gLinkContext.linkingMainExecutable = false;

        sMainExecutable->recursiveMakeDataReadOnly(gLinkContext);

        CRSetCrashLogMessage("dyld: launch, running initializers");
        
/*
* 省略下面代碼 就是從 上面綁定開(kāi)始的代碼
*/
        
}

第三部分是做弱綁定以及通知。

第四部分：

uintptr_t
_main(const macho_header* mainExecutableMH, uintptr_t mainExecutableSlide, int argc, const char* argv[], const char* envp[], const char* apple[], uintptr_t* startGlue)
{

/*
*省略了前面的全部代碼
*/

/* ****************** 不是iphone ********************/
    #if SUPPORT_OLD_CRT_INITIALIZATION
        // Old way is to run initializers via a callback from crt1.o
        if ( ! gRunInitializersOldWay ) 
            initializeMainExecutable(); 
    #else
        
        /* ****************** 是iphone ********************/
        /* ****************** 運(yùn)行所有的初始化 重點(diǎn) ********************/
        // run all initializers
        initializeMainExecutable(); 
    #endif

        /* ****************** 通知所有監(jiān)控進(jìn)程/dyld 該進(jìn)程即將進(jìn)入main() ********************/
        
        // notify any montoring proccesses that this process is about to enter main()
        notifyMonitoringDyldMain();
        
        if (dyld3::kdebug_trace_dyld_enabled(DBG_DYLD_TIMING_LAUNCH_EXECUTABLE)) {
            dyld3::kdebug_trace_dyld_duration_end(launchTraceID, DBG_DYLD_TIMING_LAUNCH_EXECUTABLE, 0, 0, 2);
        }
        ARIADNEDBG_CODE(220, 1);

#if TARGET_OS_OSX
        if ( gLinkContext.driverKit ) {
            result = (uintptr_t)sEntryOverride;
            if ( result == 0 )
                halt("no entry point registered");
            *startGlue = (uintptr_t)gLibSystemHelpers->startGlueToCallExit;
        }
        else
#endif
        {
            // find entry point for main executable
            result = (uintptr_t)sMainExecutable->getEntryFromLC_MAIN();
            if ( result != 0 ) {
                // main executable uses LC_MAIN, we need to use helper in libdyld to call into main()
                if ( (gLibSystemHelpers != NULL) && (gLibSystemHelpers->version >= 9) )
                    *startGlue = (uintptr_t)gLibSystemHelpers->startGlueToCallExit;
                else
                    halt("libdyld.dylib support not present for LC_MAIN");
            }
            else {
                // main executable uses LC_UNIXTHREAD, dyld needs to let "start" in program set up for main()
                result = (uintptr_t)sMainExecutable->getEntryFromLC_UNIXTHREAD();
                *startGlue = 0;
            }
        }
    }
/*
* 省略下面代碼 就是從 上面綁定開(kāi)始的代碼
*/
        
}

第四部分是開(kāi)始運(yùn)行所有的初始化鱼鼓，并且通知所有的dyld監(jiān)控進(jìn)程即將進(jìn)入到mian函數(shù)了拟烫。這里也是我們研究的重點(diǎn)，因?yàn)閺倪@里initializeMainExecutable(); 開(kāi)始就是真正的從dyld進(jìn)入到了objc的入口了蚓哩。

重點(diǎn)：initializeMainExecutable();

void initializeMainExecutable()
{
    // record that we've reached this step
    gLinkContext.startedInitializingMainExecutable = true;

    
    /* ****************   運(yùn)行所有鏡像文件 runInitializers  *******************/
    
    // run initialzers for any inserted dylibs
    ImageLoader::InitializerTimingList initializerTimes[allImagesCount()];
    initializerTimes[0].count = 0;
    const size_t rootCount = sImageRoots.size();
    if ( rootCount > 1 ) {
        for(size_t i=1; i < rootCount; ++i) {
            sImageRoots[i]->runInitializers(gLinkContext, initializerTimes[0]);
        }
    }
    
    /* ****************   運(yùn)行所有主程序初始化 和他所攜帶的一切 sMainExecutable->runInitializers *******************/
    
    // run initializers for main executable and everything it brings up 
    sMainExecutable->runInitializers(gLinkContext, initializerTimes[0]);
    
    // register cxa_atexit() handler to run static terminators in all loaded images when this process exits
    if ( gLibSystemHelpers != NULL ) 
        (*gLibSystemHelpers->cxa_atexit)(&runAllStaticTerminators, NULL, NULL);

    // dump info if requested
    if ( sEnv.DYLD_PRINT_STATISTICS )
        ImageLoader::printStatistics((unsigned int)allImagesCount(), initializerTimes[0]);
    if ( sEnv.DYLD_PRINT_STATISTICS_DETAILS )
        ImageLoaderMachO::printStatisticsDetails((unsigned int)allImagesCount(), initializerTimes[0]);
}

在這個(gè)方法中我們看到首先for循環(huán)運(yùn)行了所有鏡像文件的初始化:sImageRoots[i]->runInitializers构灸；然后就運(yùn)行主城的初始化和主程序攜帶的一切東西:sMainExecutable->runInitializers(gLinkContext, initializerTimes[0]);。并且發(fā)現(xiàn)調(diào)用的都是同一個(gè)方法。我們跟蹤這個(gè)runInitializers方法:

ImageLoader::runInitializers

void ImageLoader::runInitializers(const LinkContext& context, InitializerTimingList& timingInfo)
{
    uint64_t t1 = mach_absolute_time();
    mach_port_t thisThread = mach_thread_self();
    ImageLoader::UninitedUpwards up;
    up.count = 1;
    up.imagesAndPaths[0] = { this, this->getPath() };

    /* ************    處理喜颁、準(zhǔn)備所有的  Initializers   *************/
    processInitializers(context, thisThread, timingInfo, up);
    
    /* ***********   發(fā)送通知       **************/
    context.notifyBatch(dyld_image_state_initialized, false);

    mach_port_deallocate(mach_task_self(), thisThread);
    uint64_t t2 = mach_absolute_time();
    fgTotalInitTime += (t2 - t1);
}

在這個(gè)方法我們看到主要是processInitializers 方法的處理稠氮、準(zhǔn)備所有的Initializers；和context.notifyBatch(dyld_image_state_initialized, false);發(fā)送通知半开。

我們看下processInitializers:

// <rdar://problem/14412057> upward dylib initializers can be run too soon
// To handle dangling dylibs which are upward linked but not downward, all upward linked dylibs
// have their initialization postponed until after the recursion through downward dylibs
// has completed.
void ImageLoader::processInitializers(const LinkContext& context, mach_port_t thisThread,
                                     InitializerTimingList& timingInfo, ImageLoader::UninitedUpwards& images)
{
    uint32_t maxImageCount = context.imageCount()+2;
    ImageLoader::UninitedUpwards upsBuffer[maxImageCount];
    ImageLoader::UninitedUpwards& ups = upsBuffer[0];
    ups.count = 0;
    
    /* ***************     對(duì)圖像列表中的所有圖像調(diào)用遞歸init隔披，構(gòu)建一個(gè)未初始化的向上依賴(lài)項(xiàng)的新列表。        ******************/
    // Calling recursive init on all images in images list, building a new list of
    // uninitialized upward dependencies.
    for (uintptr_t i=0; i < images.count; ++i) {
        images.imagesAndPaths[i].first->recursiveInitialization(context, thisThread, images.imagesAndPaths[i].second, timingInfo, ups);
    }
    // If any upward dependencies remain, init them.
    if ( ups.count > 0 )
        processInitializers(context, thisThread, timingInfo, ups);
}

在上面這個(gè)方法我們看到主要是利用一個(gè)for循環(huán)來(lái)遞歸init所有鏡像列表中的鏡像寂拆。我們繼續(xù)跟蹤下recursiveInitialization方法：

recursiveInitialization：

void ImageLoader::recursiveInitialization(const LinkContext& context, mach_port_t this_thread, const char* pathToInitialize,
                                          InitializerTimingList& timingInfo, UninitedUpwards& uninitUps)
{
    recursive_lock lock_info(this_thread);
    recursiveSpinLock(lock_info);

    if ( fState < dyld_image_state_dependents_initialized-1 ) {
        uint8_t oldState = fState;
        // break cycles
        fState = dyld_image_state_dependents_initialized-1;
        try {
            // initialize lower level libraries first
            for(unsigned int i=0; i < libraryCount(); ++i) {
                ImageLoader* dependentImage = libImage(i);
                if ( dependentImage != NULL ) {
                    // don't try to initialize stuff "above" me yet
                    if ( libIsUpward(i) ) {
                        uninitUps.imagesAndPaths[uninitUps.count] = { dependentImage, libPath(i) };
                        uninitUps.count++;
                    }
                    else if ( dependentImage->fDepth >= fDepth ) {
                        dependentImage->recursiveInitialization(context, this_thread, libPath(i), timingInfo, uninitUps);
                    }
                }
            }
            
            // record termination order
            if ( this->needsTermination() )
                context.terminationRecorder(this);

            /* **********  告訴objc知道我們要初始化這個(gè)鏡像 注入通知 context.notifySingle   ***************/
            // let objc know we are about to initialize this image
            uint64_t t1 = mach_absolute_time();
            fState = dyld_image_state_dependents_initialized;
            oldState = fState;
            context.notifySingle(dyld_image_state_dependents_initialized, this, &timingInfo);
            
            /* **********  doInitialization  initialize this image 這里進(jìn)入調(diào)用objc_init()   ***************/
            // initialize this image
            bool hasInitializers = this->doInitialization(context);

            // let anyone know we finished initializing this image
            fState = dyld_image_state_initialized;
            oldState = fState;
            context.notifySingle(dyld_image_state_initialized, this, NULL);
            
            if ( hasInitializers ) {
                uint64_t t2 = mach_absolute_time();
                timingInfo.addTime(this->getShortName(), t2-t1);
            }
        }
        catch (const char* msg) {
            // this image is not initialized
            fState = oldState;
            recursiveSpinUnLock();
            throw;
        }
    }
    
    recursiveSpinUnLock();
}

ImageLoader::recursiveInitialization這個(gè)方法主要點(diǎn)在告訴objc知道我們要初始化這個(gè)鏡像 注入通知context.notifySingle奢米，并且調(diào)用了doInitialization方法來(lái) initialize this image 。

我們先看看context.notifySingle這個(gè)通知到底做了什么：

context.notifySingle():

static void notifySingle(dyld_image_states state, const ImageLoader* image, ImageLoader::InitializerTimingList* timingInfo)
{
    //dyld::log("notifySingle(state=%d, image=%s)\n", state, image->getPath());
    std::vector<dyld_image_state_change_handler>* handlers = stateToHandlers(state, sSingleHandlers);
    if ( handlers != NULL ) {
        dyld_image_info info;
        info.imageLoadAddress   = image->machHeader();
        info.imageFilePath      = image->getRealPath();
        info.imageFileModDate   = image->lastModified();
        for (std::vector<dyld_image_state_change_handler>::iterator it = handlers->begin(); it != handlers->end(); ++it) {
            const char* result = (*it)(state, 1, &info);
            if ( (result != NULL) && (state == dyld_image_state_mapped) ) {
                //fprintf(stderr, "  image rejected by handler=%p\n", *it);
                // make copy of thrown string so that later catch clauses can free it
                const char* str = strdup(result);
                throw str;
            }
        }
    }
    if ( state == dyld_image_state_mapped ) {
        // <rdar://problem/7008875> Save load addr + UUID for images from outside the shared cache
        // <rdar://problem/50432671> Include UUIDs for shared cache dylibs in all image info when using private mapped shared caches
        if (!image->inSharedCache()
            || (gLinkContext.sharedRegionMode == ImageLoader::kUsePrivateSharedRegion)) {
            dyld_uuid_info info;
            if ( image->getUUID(info.imageUUID) ) {
                info.imageLoadAddress = image->machHeader();
                addNonSharedCacheImageUUID(info);
            }
        }
    }
    
    /* ******接收到dyld_image_state_dependents_initialized 通知 *********/
    if ( (state == dyld_image_state_dependents_initialized) && (sNotifyObjCInit != NULL) && image->notifyObjC() ) {
        uint64_t t0 = mach_absolute_time();
        dyld3::ScopedTimer timer(DBG_DYLD_TIMING_OBJC_INIT, (uint64_t)image->machHeader(), 0, 0);
        /* ***********   sNotifyObjCInit 對(duì)鏡像文件的通知處理     *****************/
        
        /* ***********      static _dyld_objc_notify_init       sNotifyObjCInit;     *****************/
        (*sNotifyObjCInit)(image->getRealPath(), image->machHeader());
        
        uint64_t t1 = mach_absolute_time();
        uint64_t t2 = mach_absolute_time();
        uint64_t timeInObjC = t1-t0;
        uint64_t emptyTime = (t2-t1)*100;
        if ( (timeInObjC > emptyTime) && (timingInfo != NULL) ) {
            timingInfo->addTime(image->getShortName(), timeInObjC);
        }
    }
    
    // mach message csdlc about dynamically unloaded images
    if ( image->addFuncNotified() && (state == dyld_image_state_terminated) ) {
        notifyKernel(*image, false);
        const struct mach_header* loadAddress[] = { image->machHeader() };
        const char* loadPath[] = { image->getPath() };
        notifyMonitoringDyld(true, 1, loadAddress, loadPath);
    }
}

找到這個(gè)notifySingle()方法的實(shí)現(xiàn)纠永。并且發(fā)現(xiàn)對(duì)應(yīng)我們上面方法通知的類(lèi)型dyld_image_state_dependents_initialized下方的通知是利用(*sNotifyObjCInit)(image->getRealPath(), image->machHeader());這樣一個(gè)通知來(lái)處理的鬓长。所以我們繼續(xù)查找下sNotifyObjCInit。全局查找發(fā)現(xiàn)了以下代碼：

static _dyld_objc_notify_init       sNotifyObjCInit;

和

// _dyld_objc_notify_init
void registerObjCNotifiers(_dyld_objc_notify_mapped mapped, _dyld_objc_notify_init init, _dyld_objc_notify_unmapped unmapped)
{
    // record functions to call
    sNotifyObjCMapped   = mapped;
    sNotifyObjCInit     = init;
    sNotifyObjCUnmapped = unmapped;

    // call 'mapped' function with all images mapped so far
    try {
        notifyBatchPartial(dyld_image_state_bound, true, NULL, false, true);
    }
    catch (const char* msg) {
        // ignore request to abort during registration
    }

    // <rdar://problem/32209809> call 'init' function on all images already init'ed (below libSystem)
    for (std::vector<ImageLoader*>::iterator it=sAllImages.begin(); it != sAllImages.end(); it++) {
        ImageLoader* image = *it;
        if ( (image->getState() == dyld_image_state_initialized) && image->notifyObjC() ) {
            dyld3::ScopedTimer timer(DBG_DYLD_TIMING_OBJC_INIT, (uint64_t)image->machHeader(), 0, 0);
            (*sNotifyObjCInit)(image->getRealPath(), image->machHeader());
        }
    }
}

也就是說(shuō)sNotifyObjCInit只是_dyld_objc_notify_init定義出來(lái)的尝江。并且在registerObjCNotifiers()方法賦值：sNotifyObjCInit = init;涉波。既然如此我們繼續(xù)反推溯源，追蹤registerObjCNotifiers()方法炭序。

_dyld_objc_notify_register()：

// _dyld_objc_notify_register
void _dyld_objc_notify_register(_dyld_objc_notify_mapped    mapped,
                                _dyld_objc_notify_init      init,
                                _dyld_objc_notify_unmapped  unmapped)
{
    dyld::registerObjCNotifiers(mapped, init, unmapped);
}

經(jīng)過(guò)全局搜索找到了上面的方法調(diào)用了registerObjCNotifiers()啤覆。可是當(dāng)我們?cè)俅稳ニ阉?code>_dyld_objc_notify_register()方法的時(shí)候并沒(méi)有可以繼續(xù)提供我們追蹤的方法了惭聂。至此已經(jīng)沒(méi)有路可走了窗声。那我們就轉(zhuǎn)頭先看看doInitialization方法：

我們繼續(xù)跟蹤這個(gè)doInitialization方法：

ImageLoaderMachO::doInitialization:

bool ImageLoaderMachO::doInitialization(const LinkContext& context)
{
    CRSetCrashLogMessage2(this->getPath());

    // mach-o has -init and static initializers
    doImageInit(context);
    doModInitFunctions(context);
    
    CRSetCrashLogMessage2(NULL);
    
    return (fHasDashInit || fHasInitializers);
}

這個(gè)方法我們也可以看到主要是對(duì)mach-o的一個(gè)讀取初始化doImageInit(context);以及一些方法的初始化調(diào)用doModInitFunctions(context);。我們就來(lái)看看這個(gè)doModInitFunctions辜纲。

ImageLoaderMachO::doModInitFunctions:

void ImageLoaderMachO::doModInitFunctions(const LinkContext& context)
{
    if ( fHasInitializers ) {
        const uint32_t cmd_count = ((macho_header*)fMachOData)->ncmds;
        const struct load_command* const cmds = (struct load_command*)&fMachOData[sizeof(macho_header)];
        const struct load_command* cmd = cmds;
        for (uint32_t i = 0; i < cmd_count; ++i) {
            if ( cmd->cmd == LC_SEGMENT_COMMAND ) {
                const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
                const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
                const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
                for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
                    const uint8_t type = sect->flags & SECTION_TYPE;
                    if ( type == S_MOD_INIT_FUNC_POINTERS ) {
                        Initializer* inits = (Initializer*)(sect->addr + fSlide);
                        const size_t count = sect->size / sizeof(uintptr_t);
                        // <rdar://problem/23929217> Ensure __mod_init_func section is within segment
                        if ( (sect->addr < seg->vmaddr) || (sect->addr+sect->size > seg->vmaddr+seg->vmsize) || (sect->addr+sect->size < sect->addr) )
                            dyld::throwf("__mod_init_funcs section has malformed address range for %s\n", this->getPath());
                        for (size_t j=0; j < count; ++j) {
                            Initializer func = inits[j];
                            // <rdar://problem/8543820&9228031> verify initializers are in image
                            if ( ! this->containsAddress(stripPointer((void*)func)) ) {
                                dyld::throwf("initializer function %p not in mapped image for %s\n", func, this->getPath());
                            }
                            if ( ! dyld::gProcessInfo->libSystemInitialized ) {
                                // <rdar://problem/17973316> libSystem initializer must run first
                                const char* installPath = getInstallPath();
                                if ( (installPath == NULL) || (strcmp(installPath, libSystemPath(context)) != 0) )
                                    dyld::throwf("initializer in image (%s) that does not link with libSystem.dylib\n", this->getPath());
                            }
                            if ( context.verboseInit )
                                dyld::log("dyld: calling initializer function %p in %s\n", func, this->getPath());
                            bool haveLibSystemHelpersBefore = (dyld::gLibSystemHelpers != NULL);
                            {
                                dyld3::ScopedTimer(DBG_DYLD_TIMING_STATIC_INITIALIZER, (uint64_t)fMachOData, (uint64_t)func, 0);
                                func(context.argc, context.argv, context.envp, context.apple, &context.programVars);
                            }
                            bool haveLibSystemHelpersAfter = (dyld::gLibSystemHelpers != NULL);
                            if ( !haveLibSystemHelpersBefore && haveLibSystemHelpersAfter ) {
                                // now safe to use malloc() and other calls in libSystem.dylib
                                dyld::gProcessInfo->libSystemInitialized = true;
                            }
                        }
                    }
                    else if ( type == S_INIT_FUNC_OFFSETS ) {
                        const uint32_t* inits = (uint32_t*)(sect->addr + fSlide);
                        const size_t count = sect->size / sizeof(uint32_t);
                        // Ensure section is within segment
                        if ( (sect->addr < seg->vmaddr) || (sect->addr+sect->size > seg->vmaddr+seg->vmsize) || (sect->addr+sect->size < sect->addr) )
                            dyld::throwf("__init_offsets section has malformed address range for %s\n", this->getPath());
                        if ( seg->initprot & VM_PROT_WRITE )
                            dyld::throwf("__init_offsets section is not in read-only segment %s\n", this->getPath());
                        for (size_t j=0; j < count; ++j) {
                            uint32_t funcOffset = inits[j];
                            // verify initializers are in image
                            if ( ! this->containsAddress((uint8_t*)this->machHeader() + funcOffset) ) {
                                dyld::throwf("initializer function offset 0x%08X not in mapped image for %s\n", funcOffset, this->getPath());
                            }
                            if ( ! dyld::gProcessInfo->libSystemInitialized ) {
                                // <rdar://problem/17973316> libSystem initializer must run first
                                const char* installPath = getInstallPath();
                                if ( (installPath == NULL) || (strcmp(installPath, libSystemPath(context)) != 0) )
                                    dyld::throwf("initializer in image (%s) that does not link with libSystem.dylib\n", this->getPath());
                            }
                            Initializer func = (Initializer)((uint8_t*)this->machHeader() + funcOffset);
                            if ( context.verboseInit )
                                dyld::log("dyld: calling initializer function %p in %s\n", func, this->getPath());
#if __has_feature(ptrauth_calls)
                            func = (Initializer)__builtin_ptrauth_sign_unauthenticated((void*)func, ptrauth_key_asia, 0);
#endif
                            bool haveLibSystemHelpersBefore = (dyld::gLibSystemHelpers != NULL);
                            {
                                dyld3::ScopedTimer(DBG_DYLD_TIMING_STATIC_INITIALIZER, (uint64_t)fMachOData, (uint64_t)func, 0);
                                func(context.argc, context.argv, context.envp, context.apple, &context.programVars);
                            }
                            bool haveLibSystemHelpersAfter = (dyld::gLibSystemHelpers != NULL);
                            if ( !haveLibSystemHelpersBefore && haveLibSystemHelpersAfter ) {
                                // now safe to use malloc() and other calls in libSystem.dylib
                                dyld::gProcessInfo->libSystemInitialized = true;
                            }
                        }
                    }
                }
            }
            cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
        }
    }
}

到這個(gè)方法我們就有點(diǎn)蒙了笨觅。到這里再也沒(méi)有很清晰的步驟和線(xiàn)路能讓我們直接追蹤下去了∏惹福可是到這里我們也只是找到了我們前言部分利用bt打印的dyld的一些步驟屋摇。至于系統(tǒng)在dyld運(yùn)行之后怎么進(jìn)入objc的步驟已然沒(méi)法從這里探索得知了。這個(gè)時(shí)候我們不如換個(gè)方向幽邓。我們直接去objc源碼里運(yùn)行然后打斷點(diǎn)到objc_init方法炮温。看看在進(jìn)入這個(gè)方法之前堆棧的一些運(yùn)行這樣我們說(shuō)不定可以知道在進(jìn)入objc之前都做了什么牵舵。如下圖：

9.png

從上圖我們可知姥饰，果然這種方法是可行的菱属。我們發(fā)現(xiàn)在進(jìn)入ocjc_init之前還經(jīng)歷了兩個(gè)庫(kù)楷拳，一個(gè)是libSystem讨衣，一個(gè)是libdispatch。并且剛好libSystem庫(kù)的libSystem_initializer方法緊跟著上面的ImageLoaderMachO::doModInitFunctions方法没炒。所以我們的流程貌似又接回來(lái)了涛癌。我們直接去下載一個(gè)libSystem庫(kù)。和一個(gè)之后要用的libdispatch庫(kù)。

10.png

打開(kāi)libdispatch庫(kù)我們搜索堆棧信息中的_os_object_init方法：
_os_object_init(void)：

void
_os_object_init(void)
{
    _objc_init();
    Block_callbacks_RR callbacks = {
        sizeof(Block_callbacks_RR),
        (void (*)(const void *))&objc_retain,
        (void (*)(const void *))&objc_release,
        (void (*)(const void *))&_os_objc_destructInstance
    };
    _Block_use_RR2(&callbacks);
#if DISPATCH_COCOA_COMPAT
    const char *v = getenv("OBJC_DEBUG_MISSING_POOLS");
    if (v) _os_object_debug_missing_pools = _dispatch_parse_bool(v);
    v = getenv("DISPATCH_DEBUG_MISSING_POOLS");
    if (v) _os_object_debug_missing_pools = _dispatch_parse_bool(v);
    v = getenv("LIBDISPATCH_DEBUG_MISSING_POOLS");
    if (v) _os_object_debug_missing_pools = _dispatch_parse_bool(v);
#endif
}

在這個(gè)方法我們看到確實(shí)調(diào)用了objc_init方法初始化進(jìn)入了objc源碼拳话。我們可以驗(yàn)證下objc_init確實(shí)是調(diào)用objc源碼的先匪。全局搜索objc_init發(fā)現(xiàn)以下代碼：

#if __has_include(<objc/objc-internal.h>)
#include <objc/objc-internal.h>
#else
extern id _Nullable objc_retain(id _Nullable obj) __asm__("_objc_retain");
extern void objc_release(id _Nullable obj) __asm__("_objc_release");
extern void _objc_init(void);
extern void _objc_atfork_prepare(void);
extern void _objc_atfork_parent(void);
extern void _objc_atfork_child(void);
#endif // __has_include(<objc/objc-internal.h>)
#include <objc/objc-exception.h>
#include <Foundation/NSString.h>

從上面的代碼可以證明在_os_object_init里調(diào)用的_objc_init()確實(shí)是從objc引入過(guò)來(lái)的。這樣我們就把objc源碼和libDispatch聯(lián)系起來(lái)了弃衍。接下來(lái)我們繼續(xù)查找_os_object_init是被誰(shuí)調(diào)用的呀非。

DISPATCH_EXPORT DISPATCH_NOTHROW
void
libdispatch_init(void)
{
    /*
       * 省略前面的代碼
       */
    _dispatch_hw_config_init();
    _dispatch_time_init();
    _dispatch_vtable_init();
    _os_object_init();
    _voucher_init();
    _dispatch_introspection_init();
}

通過(guò)全局搜索我們發(fā)現(xiàn)是libdispatch_init方法里調(diào)用了_os_object_init();這也剛好驗(yàn)證了我們上面在objc源碼里bt打印的堆棧步驟信息。

在上面的堆棧信息打印中我們發(fā)現(xiàn)調(diào)用libdispatch_init方法之前的堆棧已然不在libdispatch這個(gè)庫(kù)了镜盯，而是libSystem庫(kù)岸裙。所以我們?cè)俅无D(zhuǎn)到libSystem庫(kù)查找libdispatch_init方法。

進(jìn)入libSystem庫(kù)全局搜索libdispatch_init發(fā)現(xiàn)以下代碼：

extern void libdispatch_init(void);     // from libdispatch.dylib

以及調(diào)用

// libsyscall_initializer() initializes all of libSystem.dylib
// <rdar://problem/4892197>
__attribute__((constructor))
static void
libSystem_initializer(int argc,
              const char* argv[],
              const char* envp[],
              const char* apple[],
              const struct ProgramVars* vars)
{
    static const struct _libkernel_functions libkernel_funcs = {
        .version = 4,
        // V1 functions

       /*
        * 省略前面部分代碼
        */
    libdispatch_init();
    _libSystem_ktrace_init_func(LIBDISPATCH);

        /*
         * 省略后面部分代碼
         */
    _libSystem_ktrace0(ARIADNE_LIFECYCLE_libsystem_init | DBG_FUNC_END);

    /* <rdar://problem/11588042>
     * C99 standard has the following in section 7.5(3):
     * "The value of errno is zero at program startup, but is never set
     * to zero by any library function."
     */
    errno = 0;
}

我們從上面的代碼可以看出：libDispatch庫(kù)的init方法確實(shí)是在libSystyem庫(kù)引入并且調(diào)用速缆。

到這里我們已經(jīng)從把兩頭的方法和步驟排查了一遍降允，理通了從libSystem庫(kù)->libDispatch庫(kù)->objc庫(kù) 的流程，并且在dyld庫(kù)我們也理通了從dyldbootstrap_start->_dyld_objc_notify_register->doModInitFunctions激涤。但是從dyld庫(kù)到libSystem庫(kù)的步驟我們還是沒(méi)有理清楚拟糕。所以我們接下來(lái)回到dyld繼續(xù)查看下 有沒(méi)有地方涉及到libSystem的地方尤其是在doModInitFunctions方法之后判呕。

我們回到上面我們斷路的ImageLoaderMachO::doModInitFunctions方法倦踢，因?yàn)榭炊褩Ｐ畔⒁彩沁@個(gè)方法之后就進(jìn)入了libSystem庫(kù)了。

ps：因?yàn)樯厦嬉呀?jīng)貼了完整的方法這里就把重點(diǎn)進(jìn)入libSystem的代碼貼出來(lái)侠草。

ImageLoaderMachO::doModInitFunctions

void ImageLoaderMachO::doModInitFunctions(const LinkContext& context)
{
    if ( fHasInitializers ) {
        const uint32_t cmd_count = ((macho_header*)fMachOData)->ncmds;
        const struct load_command* const cmds = (struct load_command*)&fMachOData[sizeof(macho_header)];
        const struct load_command* cmd = cmds;
        for (uint32_t i = 0; i < cmd_count; ++i) {

//省略部分代碼
                for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
                    const uint8_t type = sect->flags & SECTION_TYPE;
                          if ( type == S_MOD_INIT_FUNC_POINTERS ) {
                        //省略部分代碼
                    }
                    else if ( type == S_INIT_FUNC_OFFSETS ) {

                        //省略部分代碼

                            if ( ! dyld::gProcessInfo->libSystemInitialized ) {
                                // <rdar://problem/17973316> libSystem initializer must run first
                                const char* installPath = getInstallPath();
                                if ( (installPath == NULL) || (strcmp(installPath, libSystemPath(context)) != 0) )
                                    dyld::throwf("initializer in image (%s) that does not link with libSystem.dylib\n", this->getPath());
                            }
                            Initializer func = (Initializer)((uint8_t*)this->machHeader() + funcOffset);
                            if ( context.verboseInit )
                                dyld::log("dyld: calling initializer function %p in %s\n", func, this->getPath());
#if __has_feature(ptrauth_calls)
                            func = (Initializer)__builtin_ptrauth_sign_unauthenticated((void*)func, ptrauth_key_asia, 0);
#endif
                            bool haveLibSystemHelpersBefore = (dyld::gLibSystemHelpers != NULL);
                            {
                                dyld3::ScopedTimer(DBG_DYLD_TIMING_STATIC_INITIALIZER, (uint64_t)fMachOData, (uint64_t)func, 0);
                                func(context.argc, context.argv, context.envp, context.apple, &context.programVars);
                            }
                            bool haveLibSystemHelpersAfter = (dyld::gLibSystemHelpers != NULL);
                            if ( !haveLibSystemHelpersBefore && haveLibSystemHelpersAfter ) {
                                // now safe to use malloc() and other calls in libSystem.dylib
                                dyld::gProcessInfo->libSystemInitialized = true;
                            }
                        }
                    }
                }
            }
            cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
        }
    }
}

在上面的簡(jiǎn)化方法中辱挥，我們仔細(xì)看可以發(fā)現(xiàn)有這樣一句代碼和注釋?zhuān)?/p>

if ( ! dyld::gProcessInfo->libSystemInitialized ) { 
// <rdar://problem/17973316> libSystem initializer must run first
/*
*省略代碼
*/
}

表示在執(zhí)行下面的if之前必須先要初始化libSystem。而剛好在下面有這樣一句代碼：

Initializer func = (Initializer)((uint8_t*)this->machHeader() + funcOffset);

從machHeader中初始化了一個(gè)方法边涕，并且在下面調(diào)用了：

#if __has_feature(ptrauth_calls)
    
  func = (Initializer)__builtin_ptrauth_sign_unauthenticated((void*)func, ptrauth_key_asia, 0);
#endif
    
  bool haveLibSystemHelpersBefore = (dyld::gLibSystemHelpers != NULL);
  {
      dyld3::ScopedTimer(DBG_DYLD_TIMING_STATIC_INITIALIZER, (uint64_t)fMachOData, (uint64_t)func, 0);

     func(context.argc, context.argv, context.envp, context.apple, &context.programVars);
   }
  
bool haveLibSystemHelpersAfter = (dyld::gLibSystemHelpers != NULL);
                
if ( !haveLibSystemHelpersBefore && haveLibSystemHelpersAfter ) {                   
  // now safe to use malloc() and other calls in libSystem.dylib                    
    dyld::gProcessInfo->libSystemInitialized = true;    
}

從上面可以看出 在沒(méi)有初始化libSystem的時(shí)候是沒(méi)辦法執(zhí)行某些代碼的晤碘。并且后面也直接從machHeader初始化了一個(gè)方法fun。而且調(diào)用這個(gè)fun之后就可以把dyld::gProcessInfo->libSystemInitialized = true;設(shè)置為true了功蜓。所以我們可以確定這里就是初始化libSystem的一處地方园爷。這樣也就串聯(lián)起來(lái)了我們的整個(gè)流程。這個(gè)流程跨越了dyld->libSystem->libDispatch->objc四大系統(tǒng)庫(kù)式撼。

整個(gè)應(yīng)用程序加載的流程圖如下：

dyld&libSystem&libDispatch&objc流程圖.png

文章至此結(jié)束童社，這篇文章花了我不少時(shí)間，希望能給自己理解這個(gè)流程更有幫助著隆，如果能給你帶來(lái)些許啟發(fā)就更讓我欣喜了扰楼。

遇事不決，可問(wèn)春風(fēng)美浦。站在巨人的肩膀上學(xué)習(xí)弦赖，如有疏忽或者錯(cuò)誤的地方還請(qǐng)多多指教。謝謝浦辨！