现在看看defaultTitle。
defaultTitle设置默认标题时，readTitle必须为false才会生效
这是其堆栈
通过前面的断点很容易发现走了一个新方法，并且已经有值了
-[NBViewControllerProxy initUI:delegate:]
void -[NBViewControllerProxy initUI:delegate:](void * self, void * _cmd, void * arg2, void * arg3) {
rcx = arg3;
r14 = [arg2 retain];
objc_storeWeak(*ivar_offset(_psdView) + self, arg2);
r15 = [[arg2 contentView] retain];
[r14 release];
rbx = *ivar_offset(_contentView) + self;
objc_storeWeak(rbx, r15);
[r15 release];
r15 = rbx;
rbx = objc_loadWeakRetained(rbx);
[rbx setAutoresizingMask:0x12];
[rbx release];
var_-56 = self;
r14 = [[self channelId] retain];
rbx = objc_loadWeakRetained(r15);
[rbx setChannelId:r14];
[rbx release];
[r14 release];
r14 = [[self options] retain];
r12 = [[r14 nbl_id] retain];
rbx = objc_loadWeakRetained(r15);
[rbx setNbl_id:r12];
[rbx release];
[r12 release];
[r14 release];
r14 = [[var_-56 pvReporter] retain];
rbx = objc_loadWeakRetained(r15);
[rbx setPageDelegate:r14];
[rbx release];
[r14 release];
r14 = [[var_-56 options] retain];
rbx = [r14 canPullDown];
r12 = objc_loadWeakRetained(r15);
r13 = [[r12 scrollView] retain];
[r13 setBounces:rbx & 0xff];
[r13 release];
[r12 release];
[r14 release];
r14 = objc_loadWeakRetained(r15);
[r14 setScalesPageToFit:0x1];
[r14 release];
r14 = objc_loadWeakRetained(r15);
[var_-56 setCustomUserAgentWithContentView:r14];
[r14 release];
r14 = [[var_-56 viewController] retain];
r12 = [[r14 view] retain];
rbx = objc_loadWeakRetained(r15);
[r12 addSubview:rbx];
[rbx release];
[r12 release];
[r14 release];
rbx = objc_loadWeakRetained(r15);
[rbx contentViewDidLoad];
[rbx release];
rax = [var_-56 psdSession];
rax = [rax retain];
r15 = [[rax session] retain];
r14 = [[r15 context] retain];
r13 = [[r14 nbl_id] retain];
rbx = [[var_-56 pvReporter] retain];
[rbx setNbl_id:r13];
[rbx release];
[r13 release];
[r14 release];
[r15 release];
[rax release];
r14 = [[var_-56 options] retain];
r15 = [[r14 url] retain];
rbx = [[var_-56 pvReporter] retain];
rdx = r15;
[rbx setEntranceUrl:rdx];
[rbx release];
[r15 release];
rbx = var_-56;
[r14 release];
if ([rbx->_myFlags isInited] == 0x0) {
[rbx sendCreateNavigationTitleViewEvent];
rax = [rbx options];
rax = [rax retain];
var_-48 = rax;
rax = [rax defaultTitle];
rax = [rax retain];
var_-80 = rax;
r14 = [rax length];
rax = [rbx options];
rax = [rax retain];
var_-72 = rax;
if (r14 != 0x0) {
r13 = [[rax defaultTitle] retain];
var_-64 = 0x1;
var_-60 = 0x0;
}
else {
r13 = [[rax titleImage] retain];
var_-60 = 0x1;
var_-64 = 0x0;
}
r12 = [[rbx options] retain];
r14 = [[r12 defaultSubtitle] retain];
rdx = r13;
rcx = r14;
[rbx sendSetMainTitleEvent:rdx subtitle:rcx];
[r14 release];
[r12 release];
if (var_-60 != 0x0) {
[r13 release];
[var_-72 release];
}
if (var_-64 != 0x0) {
[r13 release];
[var_-72 release];
}
[var_-80 release];
[var_-48 release];
rbx = var_-56;
[rbx sendCreateLeftItemsEvent];
[rbx sendCreateRightItemsEvent];
[rbx sendCreateToolbarEvent];
}
rbx = [[rbx viewController] retain];
[rbx nbViewDidLoad];
[rbx release];
return;
}通过断点位置可以看到调用方法在最后的"sendSetMainTitleEvent:subtitle:"处，
最上面代码看到var_38 = self;
取值的代码就是 [[self options] defaultTitle]
那options的值在哪里获取的呢
可以看到是在-[NBViewControllerProxy associateWeakScene:sceneParam:]设置的
void -[NBViewControllerProxy associateWeakScene:sceneParam:](void * self, void * _cmd, void * arg2, void * arg3) {
var_30 = [arg2 retain];
r13 = [arg3 retain];
[arg2 addEventListener:@"navigation.*" withListener:self useCapture:0x0];
r12 = self;
rcx = r12;
[arg2 addEventListener:@"page.*" withListener:rcx useCapture:0x0];
objc_storeWeak(*ivar_offset(_psdScene) + r12, arg2);
rbx = [[arg2 parentKernelObject] retain];
[var_30 release];
objc_storeWeak(*ivar_offset(_psdSession) + r12, rbx);
[rbx release];
var_30 = r13;
r13 = [[r13 expandParams] retain];
rbx = [[r13 objectForKey:@"kNBSceneOptionsParam"] retain];
[r13 release];
if (rbx == 0x0) {
rbx = [_NBServiceConfigurationGet() retain];
r14 = r12;
r12 = [rbx optionsClass];
[rbx release];
r12 = [r12 alloc];
r13 = [[var_30 expandParams] retain];
rdi = r12;
r12 = r14;
rbx = [rdi initWithDictionary:r13];
[r13 release];
}
var_50 = rbx;
rdx = rbx;
[r12 setOptions:rdx];
rbx = [[r12 viewController] retain];
[rbx nbViewControllerInit];
[rbx release];
rbx = [_NBServiceConfigurationGet() retain];
var_40 = [[rbx userAgent] retain];
[rbx release];
var_38 = r12;
r13 = [[r12 psdScene] retain];
r14 = [[r13 uniqueId] retain];
rbx = [NSString stringWithFormat:rdx];
r12 = [rbx retain];
[r14 release];
[r13 release];
objc_storeStrong(*ivar_offset(_channelId) + var_38, rbx);
r13 = [[NSString stringWithFormat:@"%@(0)", @"ChannelId"] retain];
var_48 = r12;
rcx = r12;
r12 = [_objc_msgSend(var_40, @selector(stringByReplacingOccurrencesOfString:withString:)) retain];
[var_40 release];
[r13 release];
rbx = [[var_38 viewController] retain];
r14 = [[rbx nbUserAgentSuffix] retain];
[rbx release];
if ([r14 length] != 0x0) {
rbx = [[r12 stringByAppendingString:r14] retain];
[r12 release];
r12 = rbx;
}
var_38->_customUserAgent = r12;
[var_38->_customUserAgent release];
[r14 release];
[var_48 release];
[var_50 release];
[var_30 release];
return;
}这地方出现一个分支
看一下该走哪里
可以看到r13有值，不走括号内
总结：options = [arg2 expandParams] [@"kNBSceneOptionsParam"];
后面可以看到arg2是PSDSceneParam类型
arg2来自于哪里呢？ 下面显示来自sceneParam
void -[UIViewController associateWeakScene:sceneParam:](void * self, void * _cmd, void * arg2, void * arg3) {
var_-48 = [arg2 retain];
r15 = [arg3 retain];
r12 = [[NBWeakObject weakObject:arg2] retain];
objc_setAssociatedObject(self, @"kViewController_Lifecycle_PSDDelegate", r12, 0x1);
r14 = [[self lazyViewControllerProxy] retain];
[r14 associateWeakScene:var_-48 sceneParam:r15];
[r15 release];
[var_-48 release];
[r14 release];
[r12 release];
return;
}可以看到UIViewController只是做了一个转发
继续下一个方法
void * -[PSDScene initWithSceneParam:parentObject:](void * self, void * _cmd, void * arg2, void * arg3) {
rcx = arg3;
r14 = self;
r12 = [arg2 retain];
r13 = [rcx retain];
if (r12 == 0x0) {
rcx = "-[PSDScene initWithSceneParam:parentObject:]";
rbx = [[NSString stringWithFormat:cfstring__] retain];
NSLog(@"%@", rbx);
[rbx release];
}
var_80 = r14;
*(&var_80 + 0x8) = _OBJC_CLASS_$_PSDScene;
r15 = [[&var_80 super] init];
if (r15 != 0x0) {
rax = [r15 jsApiManager];
rax = [rax retain];
var_40 = r13;
var_30 = r12;
[rax setScope:@"scene"];
[rax release];
rbx = [[r15 jsApiManager] retain];
[rbx registerDefaultJsApis];
[rbx release];
rbx = [[r15 pluginManager] retain];
[rbx setScope:@"scene"];
[rbx release];
rbx = [[r15 pluginManager] retain];
[rbx registerDefaultPlugins];
[rbx release];
[var_40 addSubObject:r15];
[r15 setSceneParam:var_30];
r12 = [[r15 sceneParam] retain];
rbx = [[[r12 viewControllerCls] alloc] init];
[r15 setPsdViewController:rbx];
[rbx release];
[r12 release];
rbx = [[r15 psdViewController] retain];
[rbx setEdgesForExtendedLayout:0x0];
[rbx release];
rbx = [[r15 psdViewController] retain];
rdx = @selector(associateWeakScene:sceneParam:);
r13 = [rbx respondsToSelector:rdx];
[rbx release];
r14 = var_30;
if (r13 != 0x0) {
rbx = [[r15 psdViewController] retain];
rdx = r15;
rcx = r14;
[rbx associateWeakScene:rdx sceneParam:rcx];
[rbx release];
}
rbx = [[PSDSceneEvent createEvent] retain];
[r15 dispatchEvent:rbx, rcx];
[rbx release];
r12 = [[PSDViewParam alloc] init];
rdx = [r14 contentViewCls];
[r12 setContentViewCls:rdx, rcx];
r14 = [[r15 sceneParam] retain];
rbx = [[r14 url] retain];
var_38 = r12;
[r12 setUrl:rbx, rcx];
[rbx release];
[r14 release];
r14 = [[r15 viewController] retain];
r12 = [[r14 view] retain];
var_48 = r15;
if (r12 != 0x0) {
[&var_70 bounds];
}
else {
var_60 = intrinsic_movaps(var_60, 0x0);
var_70 = intrinsic_movaps(var_70, 0x0);
}
[var_38 setFrame:var_70, var_60];
rsp = (rsp - 0x20) + 0x20;
[r12 release];
[r14 release];
r14 = [[var_48 sceneParam] retain];
rbx = [[r14 expandParams] retain];
[var_38 setExpandParams:rbx];
[rbx release];
[r14 release];
r15 = var_48;
r12 = [[PSDView viewWithViewParam:var_38 parentObject:r15] retain];
r14 = [[UIColor clearColor] retain];
rbx = [[r12 contentView] retain];
[rbx setBackgroundColor:r14];
[rbx release];
[r14 release];
[r15 setPsdView:r12];
rbx = [[r15 psdViewController] retain];
[rbx initUI:r12 delegate:r15];
[rbx release];
rbx = [[PSDSceneEvent readyEvent] retain];
[r15 dispatchEvent:rbx];
[rbx release];
rbx = [[PSDSceneEvent startFirstRequestEvent] retain];
if ([r15 dispatchEvent:rbx] != 0x0) {
[r12 startLoadRequest];
}
[rbx release];
[r12 release];
[var_38 release];
r12 = var_30;
r13 = var_40;
}
[r13 release];
[r12 release];
rax = r15;
return rax;
}代码调用在中等偏上，第三个psdViewController后面
看来参数是上个方法直接传过来的，第一个参数initWithSceneParam:
void * +[PSDScene sceneWithSceneParam:parentObject:](void * self, void * _cmd, void * arg2, void * arg3) {
r14 = [arg2 retain];
objc_initWeak(&var_28, arg3);
r15 = [PSDScene alloc];
rbx = objc_loadWeakRetained(&var_28);
r15 = [r15 initWithSceneParam:r14 parentObject:rbx];
[rbx release];
objc_destroyWeak(&var_28);
[r14 release];
rax = [r15 autorelease];
return rax;
}接着参数是上个方法直接传过来的，第一个参数createSceneWithSceneParam
void * -[PSDService createSceneWithSceneParam:parentObject:](void * self, void * _cmd, void * arg2, void * arg3) {
r15 = self;
r12 = [arg2 retain];
r14 = [arg3 retain];
if (r12 == 0x0) {
rbx = [[NSString stringWithFormat:cfstring__] retain];
NSLog(@"%@", rbx);
[rbx release];
}
if ((*(int8_t *)&r15->_myFlags & 0x1) == 0x0) {
rbx = [[NSString stringWithFormat:cfstring__] retain];
NSLog(@"%@", rbx);
[rbx release];
}
rbx = [[PSDScene sceneWithSceneParam:r12 parentObject:r14] retain];
[r14 release];
[r12 release];
rax = [rbx autorelease];
return rax;
}还是 参数是上个方法直接传过来的
void * -[PSDSession createScene:preRenderParams:kickOut:isHit:](void * self, void * _cmd, void * arg2, void * arg3, void * arg4, bool * arg5) {
r8 = arg4;
rcx = arg3;
var_40 = arg5;
var_38 = [arg2 retain];
r14 = [rcx retain];
r12 = [[self preRenderQueue] retain];
var_30 = self;
r13 = [[self taskId:r14] retain];
[r14 release];
rdx = r13;
rbx = [[r12 task:rdx] retain];
[r13 release];
[r12 release];
r12 = [[rbx scene] retain];
if (r12 != 0x0) {
rdi = var_30;
rax = var_40;
if (rax != 0x0) {
*(int8_t *)rax = 0x1;
}
r14 = [[rdi preRenderQueue] retain];
rax = [rbx taskId];
rax = [rax retain];
rcx = _objc_msgSend;
r13 = rbx;
rbx = rax;
rsi = @selector(remove:);
rdx = rbx;
[[_objc_msgSend(r14, rsi, rdx, rcx) retain] release];
[rbx release];
[r14 release];
r14 = var_38;
}
else {
rax = [PSDService sharedInstance];
rax = [rax retain];
r8 = _objc_msgSend;
r13 = rbx;
rsi = @selector(createSceneWithSceneParam:parentObject:);
r14 = var_38;
rdx = r14;
rcx = var_30;
var_30 = [_objc_msgSend(rax, rsi, rdx, rcx, r8) retain];
[r12 release];
[rax release];
r12 = var_30;
}
[r13 release];
[r14 release];
rax = [r12 autorelease];
return rax;
}接下来应该看PSDSceneParam在[JsApiHandler4PushWindow handler:context:callback:]如何创建的
void -[JsApiHandler4PushWindow handler:context:callback:](void * self, void * _cmd, void * arg2, void * arg3, void * arg4) {
r14 = [arg2 retain];
rbx = [arg3 retain];
rax = [arg4 retain];
r15 = r14;
var_140 = rax;
var_188 = self;
var_248 = self;
*(&var_248 + 0x8) = _OBJC_CLASS_$_JsApiHandler4PushWindow;
var_160 = rbx;
[[&var_248 super] handler:r15 context:rbx callback:rax];
rbx = [[H5Configs sharedConfigs] retain];
r14 = [[rbx stripLandingConfig] retain];
[rbx release];
r12 = [[r15 objectForKeyedSubscript:@"url"] retain];
rax = [r12 length];
var_180 = r14;
if (rax != 0x0) {
var_128 = r15;
r15 = [r14 boolForKey:@"pushWindowNormal"];
[r12 release];
if (r15 != 0x0) {
rbx = [[var_128 objectForKeyedSubscript:@"url"] retain];
r12 = [_H5StripLandingURL() retain];
[rbx release];
r15 = [[NSURL URLWithString:r12] retain];
rbx = [[var_128 objectForKeyedSubscript:@"url"] retain];
var_1C8 = r12;
rax = [r12 isEqualToString:rbx];
var_158 = r15;
if (rax != 0x0) {
[rbx release];
r15 = var_128;
}
else {
r12 = [[r14 objectForKeyedSubscript:@"scheme"] retain];
r14 = [[r15 scheme] retain];
r13 = [r12 containsObject:r14];
[r14 release];
[r12 release];
[rbx release];
if (r13 != 0x0) {
rbx = [var_128 mutableCopy];
var_138 = rbx;
[rbx setValue:var_1C8 forKey:@"url"];
rbx = [rbx copy];
var_148 = rbx;
[var_128 release];
r14 = [[rbx objectForKeyedSubscript:@"url"] retain];
rbx = [[NSString stringWithFormat:@"origUrl=%@^parsedUrl=%@^result=1^in=pushWindowNormal"] retain];
var_178 = rbx;
[r14 release];
var_50 = @"seedId";
var_40 = @"H5_STRPLANDING_RESULT";
*(&var_50 + 0x8) = @"logStr";
*(&var_40 + 0x8) = rbx;
r12 = [[NSDictionary dictionaryWithObjects:@"origUrl=%@^parsedUrl=%@^result=1^in=pushWindowNormal" forKeys:r14 count:0x2] retain];
r15 = [[var_160 currentScene] retain];
r13 = [[r15 psdView] retain];
rbx = [[r13 page] retain];
[H5AutoLogger logWithOptions:r12 inPage:rbx];
[rbx release];
[r13 release];
[r15 release];
[r12 release];
[var_178 release];
[var_138 release];
r15 = var_148;
}
else {
r15 = var_128;
}
}
[var_158 release];
[var_1C8 release];
}
else {
r15 = var_128;
}
}
else {
[r12 release];
}
rbx = [[r15 objectForKeyedSubscript:@"url"] retain];
rdx = rbx;
r14 = [[NSURL URLWithString:rdx] retain];
[rbx release];
rbx = [[r14 scheme] retain];
rax = [rbx length];
var_128 = r15;
var_1C8 = r14;
if (rax == 0x0) goto loc_10058f253;
loc_10058f204:
r15 = [[r14 scheme] retain];
if ([r15 hasPrefix:@"http"] == 0x0) goto loc_10058f265;
loc_10058f230:
[r15 release];
[rbx release];
r12 = var_140;
r15 = var_128;
goto loc_10058f2c3;
loc_10058f2c3:
rdx = r15;
[H5LaunchParamChecker checkURLParmaWithData:rdx];
goto loc_10058f2da;
loc_10058f2da:
rbx = [[var_188 pushWindowTask] retain];
r14 = [rbx isFinished];
[rbx release];
if (r14 == 0x0) goto loc_10058f513;
loc_10058f318:
if ([r15 isKindOfClass:[NSDictionary class]] == 0x0) goto loc_10058f595;
loc_10058f341:
r14 = [[r15 objectForKey:@"param"] retain];
if (r14 == 0x0) goto loc_10058f3d4;
loc_10058f36b:
rbx = [[r15 objectForKey:@"param"] retain];
r15 = [rbx isKindOfClass:[NSDictionary class]];
[rbx release];
[r14 release];
r12 = var_140;
COND = r15 == 0x0;
r15 = var_128;
if (COND) goto loc_10058f595;
loc_10058f3d4:
rbx = [[r15 objectForKeyedSubscript:@"url"] retain];
if ([rbx length] == 0x0) goto loc_10058f5f7;
loc_10058f409:
r14 = [[NSCharacterSet whitespaceAndNewlineCharacterSet] retain];
r12 = [[rbx stringByTrimmingCharactersInSet:r14] retain];
[rbx release];
[r14 release];
r15 = r12;
rdx = r15;
rbx = var_160;
rcx = rbx;
if ([var_188 shouldStartApp:rdx context:rcx] == 0x0) goto loc_10058f68a;
loc_10058f47c:
var_80 = @"success";
r14 = r15;
r15 = [@(YES) retain];
var_78 = r15;
rbx = [[NSDictionary dictionaryWithObjects:&var_78 forKeys:&var_80 count:0x1] retain];
r12 = var_140;
(*(r12 + 0x10))(r12, rbx);
[rbx release];
rdi = r15;
r15 = var_128;
[rdi release];
var_158 = r14;
goto loc_10058f67e;
loc_10058f67e:
r14 = var_180;
goto loc_100591566;
loc_100591566:
[var_158 release];
goto loc_10058f5a9;
loc_10058f5a9:
[var_1C8 release];
[r14 release];
[r12 release];
[var_160 release];
[r15 release];
if (*___stack_chk_guard != *___stack_chk_guard) {
__stack_chk_fail();
}
return;
loc_10058f68a:
rbx = [[rbx currentSession] retain];
var_178 = [[rbx subObjects] retain];
[rbx release];
rbx = [[var_128 objectForKeyedSubscript:@"param", rcx] retain];
r14 = [[NSMutableDictionary dictionaryWithDictionary:rbx, rcx] retain];
[rbx release];
rbx = [[r14 objectForKey:@"closeAllWindow", rcx] retain];
[rbx release];
var_150 = 0x0;
var_148 = r14;
var_158 = r15;
if (rbx != 0x0) {
rbx = [[r14 objectForKey:@"closeAllWindow"] retain];
var_170 = [rbx boolValue];
[rbx release];
}
else {
var_170 = 0x0;
}
r15 = [[var_128 objectForKey:@"popToIndex"] retain];
r12 = _objc_release;
[r15 release];
rbx = [[var_128 objectForKey:@"popToIndex"] retain];
var_138 = [rbx intValue];
[rbx release];
var_1A8 = r15;
if (r15 == 0x0) goto loc_10058f9d1;
loc_10058f81b:
r15 = [var_178 count];
r14 = [[var_160 currentSession] retain];
rbx = [[r14 subObjects] retain];
[r14 release];
var_130 = rbx;
r13 = [[rbx firstObject] retain];
r12 = [[r13 viewController] retain];
r14 = [r12 childTabCount];
[r12 release];
[r13 release];
rax = r14 + (0x1 - r15);
r15 = r15 - r14 - 0x1;
if (r15 >= 0x0) {
rax = r15;
}
rcx = var_138;
if (rcx <= rax) goto loc_10058f9a0;
loc_10058f8e5:
var_A0 = @"error";
r12 = [@(0xa) retain];
rdx = &var_90;
*rdx = r12;
*(&var_A0 + 0x8) = @"errorMessage";
*(rdx + 0x8) = cfstring__eHe_vi;
r8 = 0x2;
rcx = &var_A0;
r15 = [[NSDictionary dictionaryWithObjects:rdx forKeys:rcx count:r8] retain];
rsi = r15;
(*(var_140 + 0x10))(var_140, rsi);
[r15 release];
rdi = r12;
r12 = var_140;
[rdi release];
[var_130 release];
r14 = var_180;
r15 = var_128;
goto loc_100591554;
loc_100591554:
[var_148 release];
[var_178 release];
goto loc_100591566;
loc_10058f9a0:
rax = (SAR(rcx, 0x1f) & r15) + rcx;
r14 = r14 + rax;
if (rax == 0x0) {
r14 = rax;
}
var_150 = r14;
[var_130 release];
r12 = _objc_release;
goto loc_10058f9d1;
loc_10058f9d1:
r15 = [[var_160 currentViewController] retain];
[@"" retain];
r14 = [[r15 psdView] retain];
rbx = [[r14 contentView] retain];
rdx = [UIWebView class];
var_130 = [rbx isKindOfClass:rdx, @selector(isKindOfClass:)];
(r12)(rbx, @selector(isKindOfClass:), rdx);
(r12)(r14, @selector(isKindOfClass:), rdx);
var_138 = r15;
r14 = [[r15 psdView] retain];
rbx = [[r14 contentView] retain];
if (var_130 != 0x0) {
r15 = [_objc_msgSend(rbx, @selector(stringByEvaluatingJavaScriptFromString:)) retain];
(r12)(@"", @selector(stringByEvaluatingJavaScriptFromString:), @"document.location.href", @selector(isKindOfClass:));
(r12)(rbx, @selector(stringByEvaluatingJavaScriptFromString:), @"document.location.href", @selector(isKindOfClass:));
(r12)(r14, @selector(stringByEvaluatingJavaScriptFromString:), @"document.location.href", @selector(isKindOfClass:));
}
else {
rdx = [WKWebView class];
r15 = [rbx isKindOfClass:rdx, @selector(isKindOfClass:)];
(r12)(rbx, @selector(isKindOfClass:), rdx, @selector(isKindOfClass:));
(r12)(r14, @selector(isKindOfClass:), rdx, @selector(isKindOfClass:));
COND = r15 == 0x0;
r15 = @"";
if (!COND) {
rbx = [[var_138 psdView] retain];
r14 = [[rbx contentView] retain];
[rbx release];
rbx = [[r14 URL] retain];
r12 = [[rbx absoluteString] retain];
[@"" release];
[rbx release];
[r14 release];
r15 = r12;
}
}
rdx = r15;
var_1D8 = [[NSURL URLWithFixedString:rdx] retain];
r12 = [_H5URLString() retain];
[var_158 release];
r14 = [[H5Configs sharedConfigs] retain];
rbx = [[r14 documentRefererWhitelist] retain];
var_158 = r12;
rax = _H5RegexTest();
var_1F8 = r15;
if (rax != 0x0) {
r12 = var_148;
rdx = [NSMutableDictionary class];
r15 = [r12 isKindOfClass:rdx];
[rbx release];
[r14 release];
if (r15 != 0x0) {
rax = [var_160 currentViewController];
rax = [rax retain];
var_130 = rax;
rax = [rax psdView];
rax = [rax retain];
var_1C0 = rax;
rax = [rax contentView];
rax = [rax retain];
var_1B0 = rax;
rax = [rax request];
rax = [rax retain];
var_168 = rax;
rax = [rax URL];
rax = [rax retain];
r15 = [[rax absoluteString] retain];
r14 = [_H5String() retain];
rdx = r14;
[r12 setValue:rdx forKey:@"pushingURLString"];
[r14 release];
[r15 release];
[rax release];
[var_168 release];
[var_1B0 release];
[var_1C0 release];
[var_130 release];
}
else {
rdx = 0x0;
[r12 setValue:rdx forKey:@"pushingURLString"];
}
}
else {
[rbx release];
[r14 release];
r12 = var_148;
rdx = 0x0;
[r12 setValue:rdx forKey:@"pushingURLString"];
}
r14 = r12;
r12 = [[var_138 options] retain];
rbx = [[r12 appId] retain];
rcx = rbx;
r8 = var_158;
[H5LaunchParamsProcessor checkAndProcessLaunchParams:r14 appId:rcx urlString:r8];
[rbx release];
[r12 release];
rdx = @"launchParamsTag";
rbx = [[var_128 objectForKeyedSubscript:rdx, rcx] retain];
var_1C0 = rbx;
if (rbx != 0x0) {
rdx = [NSString class];
r12 = var_140;
if ([rbx isKindOfClass:rdx, rcx, r8] != 0x0) {
rax = [var_138 psdSession];
rax = [rax retain];
var_130 = rax;
rax = [rax session];
rax = [rax retain];
r12 = [[rax context] retain];
rbx = [[r12 appConfigManager] retain];
rdx = r14;
rcx = var_1C0;
r14 = [[rbx mergeParams:rdx withTag:rcx] retain];
[rbx release];
rdi = r12;
r12 = var_140;
[rdi release];
[rax release];
[var_130 release];
rbx = [r14 mutableCopy];
[var_148 release];
[r14 release];
r14 = rbx;
}
}
else {
r12 = var_140;
}
r13 = _objc_msgSend;
rax = _NBServiceConfigurationGet();
rax = [rax retain];
rbx = [[rax optionsClass] alloc];
r15 = [[var_138 options] retain];
var_148 = r14;
rcx = r14;
rbx = [rbx initWithOptions:r15 overrides:rcx];
[r15 release];
[rax release];
r14 = var_158;
[rbx setUrl:r14, rcx];
var_130 = [rbx transparent];
var_1B0 = rbx;
if ([rbx transparent] != 0x0) {
r15 = var_138;
r14 = var_130;
}
else {
r12 = [_H5OptionsWithURL(r14) retain];
r15 = [[r12 objectForKeyedSubscript:@"transparent", rcx] retain];
if ([r15 boolValue] != 0x0) {
rbx = _objc_msgSend;
[r15 release];
r14 = 0x1;
}
else {
r14 = [[r12 objectForKeyedSubscript:@"tt"] retain];
rbx = _objc_msgSend;
r13 = [r14 boolValue];
[r14 release];
[r15 release];
r14 = var_130;
if (r13 != 0x0) {
r14 = 0x1;
}
}
[r12 release];
r12 = var_140;
r13 = rbx;
r15 = var_138;
}
rbx = [[r15 navigationController] retain];
if (rbx == 0x0) goto loc_1005902fd;
loc_100590155:
if (r14 != 0x0) goto loc_100590324;
loc_10059015e:
var_130 = r14;
[rbx release];
goto loc_10059016e;
loc_10059016e:
r14 = [(r13)(var_160, @selector(currentSession)) retain];
r15 = [(r13)(r14, @selector(subObjects)) retain];
rbx = [(r13)(r15, @selector(firstObject)) retain];
[r15 release];
[r14 release];
rdx = (r13)(@class(PSDScene), @selector(class));
if ((r13)(rbx, @selector(isKindOfClass:), rdx) == 0x0) {
[rbx release];
rbx = 0x0;
}
var_1D0 = rbx;
r14 = [(r13)(rbx, @selector(viewController), rdx) retain];
rbx = [(r13)(r14, @selector(options), rdx) retain];
r15 = (r13)(rbx, @selector(transparent), rdx);
[rbx release];
[r14 release];
if (r15 == 0x0) goto loc_100590360;
loc_100590264:
var_E0 = @"error";
r15 = [(r13)(@class(NSNumber), @selector(numberWithInt:), 0x3) retain];
rdx = &var_D0;
*rdx = r15;
*(&var_E0 + 0x8) = @"errorMessage";
*(rdx + 0x8) = cfstring___u__N___f_Wof_NAQ___z_S_Rbc;
r8 = 0x2;
rcx = &var_E0;
rbx = [(r13)(@class(NSDictionary), @selector(dictionaryWithObjects:forKeys:count:), rdx, rcx, r8) retain];
rsi = rbx;
(*(r12 + 0x10))(r12, rsi);
[rbx release];
rdi = r15;
goto loc_1005912d2;
loc_1005912d2:
[rdi release];
[var_1D0 release];
r14 = var_180;
r15 = var_128;
r13 = var_1D8;
goto loc_10059152b;
loc_10059152b:
[var_1B0 release];
[var_1C0 release];
[r13 release];
[var_1F8 release];
[var_138 release];
goto loc_100591554;
loc_100590360:
r14 = var_1B0;
r12 = [(r13)(r14, @selector(appId)) retain];
rbx = [(r13)(r14, @selector(url)) retain];
r15 = (r13)(@class(H5WKWebViewManager), @selector(shouldUseWKWebViewWithAppId:url:isSubView:params:), r12, rbx, 0x0, var_148);
[rbx release];
[r12 release];
r12 = (r13)((r13)(@class(PSDSceneParam), @selector(alloc)), @selector(init));
rbx = [_NBServiceConfigurationGet() retain];
rdx = (r13)(rbx, @selector(viewControllerClass));
(r13)(r12, @selector(setViewControllerCls:), rdx);
[rbx release];
rcx = objc_cls_ref_H5WebView;
if (r15 != 0x0) {
rcx = objc_cls_ref_H5WKWebView;
}
(r13)(r12, @selector(setContentViewCls:), (r13)(*rcx, @selector(class), rdx, rcx, 0x0), rcx, 0x0);
rbx = [(r13)(r14, @selector(url), rdx, rcx, 0x0) retain];
(r13)(r12, @selector(setUrl:), rbx, rcx, 0x0);
[rbx release];
var_F0 = @"kNBSceneOptionsParam";
var_E8 = r14;
r14 = [(r13)(@class(NSDictionary), @selector(dictionaryWithObjects:forKeys:count:), &var_E8, &var_F0, 0x1) retain];
rbx = [_H5DictMerge() retain];
var_1B8 = r12;
(r13)(r12, @selector(setExpandParams:), rbx, &var_F0, 0x1);
[rbx release];
[r14 release];
r15 = [(r13)(var_138, @selector(navigationController), rbx, &var_F0, 0x1) retain];
rbx = [(r13)(r15, @selector(viewControllers), rbx, &var_F0, 0x1) retain];
var_168 = [(r13)(@class(NSMutableArray), @selector(arrayWithArray:), rbx, &var_F0, 0x1) retain];
[rbx release];
[r15 release];
r15 = 0x1;
if (var_1A8 != 0x0) {
rbx = sign_extend_64(var_150);
if ([var_178 count] - 0x1 > rbx) {
rbx = [(r13)(var_178, @selector(objectAtIndex:), rbx) retain];
r14 = [(r13)(rbx, @selector(viewController)) retain];
[rbx release];
rbx = (r13)(var_168, @selector(indexOfObject:), r14);
if (rbx == 0x7fffffffffffffff) {
r13 = 0x7fffffffffffffff;
r15 = 0x1;
if ([r14 isSubViewMode] != 0x0) {
rbx = [[r14 parentViewController] retain];
[rbx release];
if (rbx != 0x0) {
r15 = [[r14 parentViewController] retain];
rbx = [var_168 indexOfObject:r15];
[r15 release];
r15 = 0x1;
if (rbx != r13) {
[var_168 count] - rbx + 0x1;
[var_168 removeObjectsInRange:rbx + 0x1];
r15 = 0x0;
}
}
else {
r15 = 0x1;
}
}
}
else {
[var_168 count] - rbx + 0x1;
[var_168 removeObjectsInRange:rbx + 0x1];
r15 = 0x0;
}
[r14 release];
r13 = _objc_msgSend;
}
}
rbx = var_1B8;
if (var_170 != 0x0) {
rax = [var_178 count];
var_150 = rax;
if (rax > 0x0) {
r12 = 0x0;
do {
rbx = [(r13)(var_178, @selector(objectAtIndex:), r12) retain];
rdx = (r13)(@class(PSDScene), @selector(class));
if ((r13)(rbx, @selector(isKindOfClass:), rdx) != 0x0) {
r15 = [(r13)(rbx, @selector(viewController), rdx) retain];
(r13)(var_168, @selector(removeObject:), r15);
[r15 release];
}
[rbx release];
r12 = r12 + 0x1;
} while (var_150 != r12);
r15 = 0x0;
rbx = var_1B8;
}
else {
r15 = 0x0;
}
}
var_1A8 = r15;
r12 = var_128;
rcx = r12;
r15 = [(r13)(@class(H5PreRenderEvent), @selector(preRenderEventWithSceneParam:data:), rbx, rcx) retain];
rbx = [(r13)(var_138, @selector(scene)) retain];
rdx = r15;
r14 = (r13)(rbx, @selector(dispatchEvent:), rdx);
[rbx release];
var_1F0 = r15;
if (r14 == 0x0) goto loc_1005909e7;
loc_10059098c:
var_190 = 0x0;
rbx = [(r13)(var_160, @selector(currentSession), rdx, rcx) retain];
var_150 = [(r13)(rbx, @selector(createScene:preRenderParams:kickOut:isHit:), var_1B8, r12, @"first", &var_190) retain];
rdi = rbx;
goto loc_100590a94;
loc_100590a94:
[rdi release];
goto loc_100590a9a;
loc_100590a9a:
r14 = [(r13)(r12, @selector(objectForKeyedSubscript:), @"passData") retain];
rdx = &var_198;
rcx = rdx;
rbx = [(r13)(@class(NSDictionary), @selector(dictionaryWithObjects:forKeys:count:), rdx, rcx, 0x0) retain];
r15 = [_NBDictionary() retain];
[rbx release];
[r14 release];
r12 = var_150;
if (r15 != 0x0) {
r14 = [(r13)(r12, @selector(viewController), rdx, rcx, 0x0) retain];
rbx = [(r13)(r14, @selector(viewControllerProxy), rdx, rcx, 0x0) retain];
rcx = r15;
(r13)(rbx, @selector(setExpando:withValue:), @"kNBViewControllerProxyPassData", rcx, 0x0);
[rbx release];
[r14 release];
}
var_1E8 = r15;
rax = (r13)(r12, @selector(getExpando:), @"kPSDSceneFinishRender", rcx, 0x0);
rax = [rax retain];
[rax release];
var_170 = 0x0;
r8 = rax != 0x0 ? 0x1 : 0x0;
rax = (r13)(@class(NSString), @selector(stringWithFormat:), @"hitPreRender=%d^finishRender=%d", 0x0 & 0xff, r8);
rax = [rax retain];
rbx = &var_120;
*rbx = @"logStr";
r14 = &var_108;
var_1E0 = rax;
*r14 = rax;
*(rbx + 0x8) = @"extPram2";
rcx = var_128;
rax = @"";
if (rcx != 0x0) {
rax = rcx;
}
*(r14 + 0x8) = rax;
*(rbx + 0x10) = @"lid";
r13 = [(r13)(@class(NSNumber), @selector(numberWithInt:), 0x13ed, rcx, r8) retain];
*(r14 + 0x10) = r13;
r8 = 0x3;
r14 = [[NSDictionary dictionaryWithObjects:r14 forKeys:rbx count:r8] retain];
r15 = [[r12 psdView] retain];
rbx = [[r15 page] retain];
rcx = rbx;
[H5AutoLogger logWithOptions:r14 inPage:rcx];
[rbx release];
[r15 release];
[r14 release];
[r13 release];
rbx = [[var_128 objectForKey:@"waitRender"] retain];
[rbx doubleValue];
var_1A0 = intrinsic_movsd(@class(H5AutoLogger), xmm0);
[rbx release];
xmm0 = intrinsic_xorpd(xmm0, xmm0);
if (0x0 != 0x0) {
xmm0 = intrinsic_xorpd(xmm0, xmm0);
}
else {
xmm1 = intrinsic_movsd(xmm1, var_1A0);
xmm1 = intrinsic_maxsd(xmm1, xmm0);
xmm0 = intrinsic_movsd(xmm0, *0x100999d08);
xmm0 = intrinsic_minsd(xmm0, xmm1);
xmm0 = intrinsic_divsd(xmm0, *0x100980c48);
}
var_1A0 = intrinsic_movsd(var_1A0, xmm0);
r12 = var_140;
r14 = var_148;
rbx = [[r14 objectForKeyedSubscript:@"closeCurrentWindow"] retain];
r15 = [rbx respondsToSelector:@selector(boolValue)];
[rbx release];
if (r15 != 0x0) {
rbx = [[r14 objectForKeyedSubscript:@"closeCurrentWindow"] retain];
r14 = [rbx boolValue];
[rbx release];
if (r14 != 0x0) {
r12 = [[var_160 currentViewController] retain];
rax = [r12 cachedParentViewController];
rax = [rax retain];
rcx = _objc_msgSend;
r13 = rax;
rbx = [[var_160 currentViewController] retain];
if (r13 != 0x0) {
r14 = [[rbx cachedParentViewController] retain];
[rbx release];
rbx = r14;
}
[r13 release];
[r12 release];
[var_168 removeObject:rbx];
[rbx release];
var_170 = 0x1;
var_1A8 = 0x0;
r12 = var_140;
}
else {
var_170 = 0x0;
}
}
rbx = var_148;
r15 = [[rbx objectForKeyedSubscript:@"animationType"] retain];
if ([r15 isKindOfClass:[NSString class]] != 0x0) {
rbx = [[rbx objectForKeyedSubscript:@"animationType"] retain];
r14 = [rbx isEqualToString:@"none"];
[rbx release];
}
else {
r14 = 0x0;
}
[r15 release];
rbx = [[var_188 pushWindowTask] retain];
if (r14 != 0x0) {
rdx = 0x1;
}
else {
rdx = 0x0;
}
[rbx setAnimationType:rdx];
[rbx release];
rbx = [[var_148 objectForKeyedSubscript:@"endJS"] retain];
rdx = [NSString class];
r14 = [rbx isKindOfClass:rdx];
[rbx release];
if (r14 != 0x0) {
rbx = [[var_148 objectForKeyedSubscript:@"endJS"] retain];
rdx = @"endJS";
rcx = rbx;
[var_150 setExpando:rdx withValue:rcx];
[rbx release];
}
rbx = var_150;
if (var_170 != 0x0) {
rdx = @"kPSDSceneFromRedirectOrRelanch";
rcx = @"1";
[rbx setExpando:rdx withValue:rcx];
}
rax = [var_188 pushWindowTask];
rax = [rax retain];
var_150 = rbx;
intrinsic_movsd(xmm0, var_1A0);
[rax setWaitRender:rdx, rcx];
[rax release];
rbx = [[var_188 pushWindowTask] retain];
[rbx setTransparent:var_130 & 0xff, rcx];
[rbx release];
rbx = [[var_188 pushWindowTask] retain];
[rbx setIsNormalPush:var_1A8 & 0xff, rcx];
[rbx release];
rbx = [[var_188 pushWindowTask] retain];
[rbx setCurrentVC:var_138, rcx];
[rbx release];
rbx = [[var_188 pushWindowTask] retain];
[rbx setScene:var_150, rcx];
[rbx release];
rax = [UIApplication sharedApplication];
rax = [rax retain];
r15 = [[rax keyWindow] retain];
rbx = [[var_188 pushWindowTask] retain];
[rbx setKeyWindow:r15, rcx];
[rbx release];
[r15 release];
[rax release];
rbx = [[var_188 pushWindowTask] retain];
rdx = var_168;
[rbx setViewControllers:rdx, rcx];
[rbx release];
r14 = [[var_188 pushWindowTask] retain];
rsi = @selector(run);
_objc_msgSend(r14, rsi, rdx, rcx);
[r14 release];
[var_1E0 release];
[var_1E8 release];
[var_1F0 release];
[var_150 release];
[var_168 release];
rdi = var_1B8;
goto loc_1005912d2;
loc_1005909e7:
rbx = [[r15 preRenderScene] retain];
[rbx release];
if (rbx == 0x0) goto loc_100590a37;
loc_100590a13:
var_150 = [[r15 preRenderScene] retain];
r12 = var_128;
goto loc_100590a9a;
loc_100590a37:
var_190 = 0x0;
r15 = [(r13)(var_160, @selector(currentSession)) retain];
r12 = var_128;
var_150 = [(r13)(r15, @selector(createScene:preRenderParams:kickOut:isHit:), var_1B8, r12, @"first", &var_190) retain];
rdi = r15;
goto loc_100590a94;
loc_100590324:
rax = [r15 presentingViewController];
rax = [rax retain];
if (rax == 0x0) goto loc_1005907eb;
loc_100590345:
[rax release];
[rbx release];
goto loc_100590833;
loc_100590833:
[@"" retain];
goto loc_100590840;
loc_100590840:
rax = [r15 presentingViewController];
rax = [rax retain];
if (rax == 0x0) goto loc_100590868;
loc_10059085d:
[rax release];
goto loc_100590891;
loc_100590891:
r15 = cfstring_S_MRV;
goto loc_100590898;
loc_100590898:
[r15 retain];
[@"" release];
goto loc_100591478;
loc_100591478:
var_C0 = @"error";
r12 = [(r13)(@class(NSNumber), @selector(numberWithInt:), 0x3, rcx, r8) retain];
rdx = &var_B0;
*rdx = r12;
*(&var_C0 + 0x8) = @"errorMessage";
*(rdx + 0x8) = r15;
r8 = 0x2;
rcx = &var_C0;
rbx = [(r13)(@class(NSDictionary), @selector(dictionaryWithObjects:forKeys:count:), rdx, rcx, r8) retain];
rsi = rbx;
(*(var_140 + 0x10))(var_140, rsi);
[rbx release];
[r12 release];
goto loc_100591506;
loc_100591506:
r13 = var_1D8;
[r15 release];
r12 = var_140;
r14 = var_180;
r15 = var_128;
goto loc_10059152b;
loc_100590868:
rbx = [[r15 presentedViewController] retain];
[rbx release];
if (rbx == 0x0) goto loc_1005908b3;
goto loc_100590891;
loc_1005908b3:
r12 = 0x1;
goto loc_1005908b6;
loc_1005908b6:
if (r15 == 0x0) goto loc_100590905;
loc_1005908bb:
if ([r15 isSubViewMode] == 0x0) goto loc_100591352;
loc_1005908d6:
rax = [r15 parentViewController];
rax = [rax retain];
if (rax == 0x0) goto loc_1005912fb;
loc_1005908f7:
[rax release];
goto loc_100591352;
loc_100591352:
if (_H5ConfigServiceBool() == 0x0) goto loc_1005913a5;
loc_100591362:
rbx = [[r15 navigationController] retain];
r12 = r12 | (rbx != 0x0 ? 0x1 : 0x0);
if ((r12 != 0x0) || ([r15 isSubViewMode] != 0x0)) goto loc_10059139c;
loc_100591578:
if ([r15 isTagViewReady] != 0x0) goto loc_1005913a5;
loc_100591590:
objc_initWeak(&var_190, var_188);
*(&var_200 + 0xffffffffffffffc8) = __NSConcreteStackBlock;
*(&var_200 + 0xffffffffffffffd0) = 0xc2000000;
*(&var_200 + 0xffffffffffffffd8) = ___52-[JsApiHandler4PushWindow handler:context:callback:]_block_invoke;
*(&var_200 + 0xffffffffffffffe0) = ___block_descriptor_tmp;
objc_copyWeak(&var_200, &var_190);
[var_128 retain];
*(&var_200 + 0xffffffffffffffe8) = var_128;
*(&var_200 + 0xfffffffffffffff0) = [var_160 retain];
*(&var_200 + 0xfffffffffffffff8) = [var_140 retain];
rax = objc_retainBlock(&var_238);
r12 = [[r15 delayExecList] retain];
rbx = objc_retainBlock(rax);
rsi = @selector(addObject:);
rdx = rbx;
_objc_msgSend(r12, rsi);
[rbx release];
[r12 release];
[rax release];
[var_208 release];
[var_210 release];
[var_218 release];
objc_destroyWeak(&var_200);
objc_destroyWeak(&var_190);
r15 = @"";
goto loc_100591506;
loc_1005913a5:
r12 = [(r13)(@class(NSNumber), @selector(numberWithBool:), (r13)(r15, @selector(isSubViewMode)) & 0xff) retain];
rax = (r13)(r15, @selector(parentViewController));
rax = [rax retain];
r14 = r13;
r13 = [(r13)(@class(NSNumber), @selector(numberWithInt:), rax != 0x0 ? 0x1 : 0x0) retain];
rcx = r12;
r8 = r13;
r15 = [(r14)(@class(NSString), @selector(stringWithFormat:), cfstring_____V, rcx, r8) retain];
[@"" release];
rdi = r13;
r13 = r14;
[rdi release];
[rax release];
[r12 release];
goto loc_100591478;
loc_10059139c:
[rbx release];
goto loc_1005913a5;
loc_1005912fb:
r15 = [_DTContextGet() retain];
rbx = [[r15 navigationController] retain];
[rbx release];
rdi = r15;
r15 = var_138;
[rdi release];
if (rbx == 0x0) goto loc_1005916b2;
goto loc_100591352;
loc_1005916b2:
r15 = cfstring_____V;
goto loc_100590898;
loc_100590905:
r15 = cfstring_____V;
goto loc_100590898;
loc_1005907eb:
var_130 = r14;
r14 = [[r15 presentedViewController] retain];
[r14 release];
[rbx release];
r15 = var_138;
if (r14 == 0x0) goto loc_10059016e;
goto loc_100590833;
loc_1005902fd:
[rbx release];
[@"" retain];
if (r14 != 0x0) goto loc_100590840;
loc_10059031c:
r12 = 0x0;
goto loc_1005908b6;
loc_10058f5f7:
var_158 = rbx;
var_70 = @"error";
r15 = [@(0x2) retain];
var_68 = r15;
rbx = [[NSDictionary dictionaryWithObjects:&var_68 forKeys:&var_70 count:0x1] retain];
(*(r12 + 0x10))(r12, rbx);
[rbx release];
rdi = r15;
r15 = var_128;
[rdi release];
goto loc_10058f67e;
loc_10058f595:
_ErrorCallback();
goto loc_10058f5a2;
loc_10058f5a2:
r14 = var_180;
goto loc_10058f5a9;
loc_10058f513:
var_60 = @"error";
r15 = [@(0xb) retain];
var_58 = r15;
rbx = [[NSDictionary dictionaryWithObjects:&var_58 forKeys:&var_60 count:0x1] retain];
(*(r12 + 0x10))(r12, rbx);
[rbx release];
rdi = r15;
r15 = var_128;
[rdi release];
goto loc_10058f5a2;
loc_10058f265:
r14 = [[r14 scheme] retain];
rdx = @"https";
var_158 = [r14 hasPrefix:rdx];
[r14 release];
[r15 release];
[rbx release];
r12 = var_140;
r15 = var_128;
if (var_158 != 0x0) {
rdx = r15;
[H5LaunchParamChecker checkURLParmaWithData:rdx];
}
goto loc_10058f2da;
loc_10058f253:
[rbx release];
r12 = var_140;
goto loc_10058f2c3;
}来了一个长方法，
代码在第一个createScene:preRenderParams:kickOut:isHit:的地方
hook一下JsApiHandler4PushWindow handler:context:callback:
可以看到
[(r13)(var_-352, @selector(currentSession), rdx, rcx) retain];
var_-336 = [(r13)(rbx, @selector(createScene:preRenderParams:kickOut:isHit:), var_-440, r12, @"first", &var_-400) retain];
是var_-352调用的currentSession方法 传入 rdx, rcx获取创建的session
rbx = [arg3 retain]; var_-352 = rbx; v352就是handler:context:callback:的context:的值
疑问： rdx, rcx做啥的？
不对
var_-440才是要找的
var_-240 = @"kNBSceneOptionsParam";
这地方赋值(r13)(r12, @selector(setExpandParams:), rbx, &var_F0, 0x1);
rbx = [_H5DictMerge() retain];
int _H5DictMerge() {
rbx = [rdi retain];
var_C8 = [rsi retain];
var_D8 = rbx;
if (rbx != 0x0) {
rax = [rbx mutableCopy];
}
else {
rax = [NSMutableDictionary dictionary];
rax = [rax retain];
}
var_C0 = rax;
*(int128_t *)(&var_130 + 0x30) = intrinsic_movaps(*(int128_t *)(&var_130 + 0x30), 0x0);
*(int128_t *)(&var_130 + 0x20) = intrinsic_movaps(*(int128_t *)(&var_130 + 0x20), 0x0);
*(int128_t *)(&var_130 + 0x10) = intrinsic_movaps(*(int128_t *)(&var_130 + 0x10), 0x0);
var_130 = intrinsic_movaps(var_130, 0x0);
rax = [var_C8 allKeys];
rax = [rax retain];
var_B8 = rax;
rax = [rax countByEnumeratingWithState:&var_130 objects:&var_B0 count:0x10];
var_D0 = rax;
if (rax != 0x0) {
var_E0 = **(&var_130 + 0x10);
do {
r13 = 0x0;
do {
if (*var_120 != var_E0) {
objc_enumerationMutation(var_B8);
}
rbx = [[var_C8 objectForKeyedSubscript:*(var_128 + r13 * 0x8)] retain];
[var_C0 setObject:rbx forKeyedSubscript:*(var_128 + r13 * 0x8)];
[rbx release];
r13 = r13 + 0x1;
} while (r13 < var_D0);
rax = [var_B8 countByEnumeratingWithState:&var_130 objects:&var_B0 count:0x10];
var_D0 = rax;
} while (rax != 0x0);
}
[var_B8 release];
r14 = [var_C0 copy];
[var_C0 release];
[var_C8 release];
[var_D8 release];
if (*___stack_chk_guard == *___stack_chk_guard) {
rax = [r14 autorelease];
}
else {
rax = __stack_chk_fail();
}
return rax;
}这是一个c方法，使用了rdi rsi,
r12 = (r13)((r13)(@class(PSDSceneParam), @selector(alloc)), @selector(init));
rbx = [_NBServiceConfigurationGet() retain];
rdx = (r13)(rbx, @selector(viewControllerClass));
(r13)(r12, @selector(setViewControllerCls:), rdx);
[rbx release];
rcx = objc_cls_ref_H5WebView;
if (r15 != 0x0) {
rcx = objc_cls_ref_H5WKWebView;
}
(r13)(r12, @selector(setContentViewCls:), (r13)(*rcx, @selector(class), rdx, rcx, 0x0), rcx, 0x0);
rbx = [(r13)(r14, @selector(url), rdx, rcx, 0x0) retain];
(r13)(r12, @selector(setUrl:), rbx, rcx, 0x0);
[rbx release];
var_F0 = @"kNBSceneOptionsParam";
var_E8 = r14;
r14 = [(r13)(@class(NSDictionary), @selector(dictionaryWithObjects:forKeys:count:), &var_E8, &var_F0, 0x1) retain];
rbx = [_H5DictMerge() retain];
var_1B8 = r12;
(r13)(r12, @selector(setExpandParams:), rbx, &var_F0, 0x1);
rbx = [_H5DictMerge(r14, var_-328) retain];这里用到了r14。
PSDSceneParam 设置参数用到了var_E8 = r14;
然后 rbx = [rbx initWithOptions:r15 overrides:rcx];
void * -[H5Options initWithOptions:overrides:](void * self, void * _cmd, void * arg2, void * arg3) {
r15 = [arg2 retain];
rbx = [arg3 retain];
var_D0 = self;
*(&var_D0 + 0x8) = _OBJC_CLASS_$_H5Options;
r12 = [[&var_D0 super] initWithOptions:r15 overrides:rbx];
if (r12 != 0x0) {
var_58 = [_objc_msgSend(r12, @selector(normalize:)) retain];
[rbx release];
rax = _getMappingDict();
rax = [rax retain];
var_C0 = __NSConcreteStackBlock;
*(&var_C0 + 0x8) = 0xc2000000;
*(&var_C0 + 0x10) = ___39-[H5Options initWithOptions:overrides:]_block_invoke;
r14 = rax;
*(&var_C0 + 0x18) = ___block_descriptor_tmp.1030;
var_80 = r12;
rax = [r12 retain];
var_50 = rax;
*(&var_C0 + 0x20) = rax;
r12 = [var_58 retain];
*(&var_C0 + 0x28) = r12;
var_88 = r15;
rax = [r15 retain];
var_68 = rax;
*(&var_C0 + 0x30) = rax;
var_70 = r14;
[r14 enumerateKeysAndObjectsUsingBlock:&var_C0];
r14 = [_getPramField(@"kIsAutoSetNavBarStyle") retain];
var_58 = r12;
rbx = [[r12 objectForKeyedSubscript:r14] retain];
[var_50 setIsAutoSetNavBarStyle:_GetBool() & 0xff];
[rbx release];
[r14 release];
rax = _getPramField(@"kUrl");
rax = [rax retain];
var_60 = rax;
rax = [r12 objectForKeyedSubscript:rax];
rax = [rax retain];
r15 = [_GetString(rax, 0x0) retain];
r13 = [_TrimTailingWhiteSpace() retain];
r12 = [[var_68 url] retain];
r14 = [_GetString(r13, r12) retain];
[var_50 setUrl:r14];
[r14 release];
[r12 release];
[r13 release];
[r15 release];
[rax release];
[var_60 release];
rax = _getPramField(@"kBackBehavior");
rax = [rax retain];
var_60 = rax;
r12 = [[var_58 objectForKeyedSubscript:rax] retain];
r14 = var_68;
r15 = [[r14 backBehavior] retain];
rcx = r15;
if (r15 == 0x0) {
rcx = @"pop";
}
var_48 = rcx;
*(int128_t *)(&var_48 + 0x8) = intrinsic_movdqu(*(int128_t *)(&var_48 + 0x8), intrinsic_punpcklqdq(zero_extend_64(@"pop"), zero_extend_64(@"back")));
r13 = [[NSArray arrayWithObjects:&var_48 count:0x3] retain];
rbx = [_SelectString() retain];
[var_50 setBackBehavior:rbx];
[rbx release];
rdi = r13;
r13 = r14;
[rdi release];
[r15 release];
[r12 release];
[var_60 release];
r14 = [_getPramField(@"kShowToolBar") retain];
r12 = [[var_58 objectForKeyedSubscript:r14] retain];
COND = [r13 transparent] != 0x0;
rax = 0x0;
if (!COND) {
rax = [r13 showToolBar];
}
r15 = r13;
[var_50 setShowToolBar:_GetBool() & 0xff];
rdi = r12;
r12 = var_50;
[rdi release];
[r14 release];
[r12 setShowTitleBar:0x1];
rax = _getPramField(@"kShowProgress");
rax = [rax retain];
var_60 = rax;
r14 = [[var_58 objectForKeyedSubscript:rax] retain];
if ([r15 transparent] != 0x0) {
r15 = [[r12 appId] retain];
rax = _H5IsH5App();
rax = rax ^ 0x1;
r13 = 0x1;
}
else {
rax = [r15 showProgress];
r13 = 0x0;
}
[r12 setShowProgress:_GetBool() & 0xff];
if (r13 != 0x0) {
[r15 release];
}
[r14 release];
[var_60 release];
r12 = [_getPramField(@"kGestureBack") retain];
rbx = [[var_58 objectForKeyedSubscript:r12] retain];
r13 = var_68;
rcx = [r13 transparent];
rax = 0x1;
if (rcx == 0x0) {
rax = [r13 gestureBack];
}
[var_50 setGestureBack:_GetBool() & 0xff];
[rbx release];
[r12 release];
r14 = [_getPramField(@"kReadTitle") retain];
rbx = [[var_58 objectForKeyedSubscript:r14] retain];
[var_50 setReadTitle:_GetBool() & 0xff];
[rbx release];
[r14 release];
r14 = [_getPramField(@"kDefaultTitle") retain];
r15 = [[var_58 objectForKeyedSubscript:r14] retain];
rbx = [_GetString(r15, r13->originDefaultTitle) retain];
[var_50 setDefaultTitle:rbx];
[rbx release];
[r15 release];
[r14 release];
r14 = [_getPramField(@"kPreSSOLoginUrl") retain];
r15 = [[var_58 objectForKeyedSubscript:r14] retain];
r12 = [[r13 preSSOLoginUrl] retain];
r13 = [_GetString(r15, r12) retain];
rbx = [_TrimTailingWhiteSpace() retain];
[var_50 setPreSSOLoginUrl:rbx];
[rbx release];
rdi = r13;
r13 = var_58;
[rdi release];
[r12 release];
[r15 release];
[r14 release];
r14 = [_getPramField(@"kAllowsBounceVertical") retain];
rbx = [[r13 objectForKeyedSubscript:r14] retain];
[r14 release];
var_60 = rbx;
if (rbx != 0x0) {
rdi = @"kAllowsBounceVertical";
}
else {
rdi = @"kCanPullDown";
}
r14 = [_getPramField(rdi) retain];
r12 = [[r13 objectForKeyedSubscript:r14] retain];
r13 = var_68;
rcx = [r13 transparent];
rax = 0x1;
if (rcx == 0x0) {
rax = [r13 canPullDown];
}
[var_50 setCanPullDown:_GetBool() & 0xff];
[r12 release];
[r14 release];
r14 = [_getPramField(@"kShowDomain") retain];
rbx = [[var_58 objectForKeyedSubscript:r14] retain];
rcx = [r13 transparent];
rax = 0x1;
if (rcx == 0x0) {
rax = [r13 showDomain];
}
[var_50 setShowDomain:_GetBool() & 0xff];
[rbx release];
[r14 release];
rbx = [_getPramField(@"kBackgroundColor") retain];
rax = [var_58 objectForKeyedSubscript:rdx];
rax = [rax retain];
*(int8_t *)&var_50->hasBgColor = rax != 0x0 ? 0x1 : 0x0;
[rax release];
[rbx release];
r13 = var_68;
rbx = [var_50 transparent];
r14 = [_getPramField(@"kBackgroundColor") retain];
r12 = [[var_58 objectForKeyedSubscript:r14] retain];
rax = *(int8_t *)&r13->hasBgColor;
if (rbx != 0x0) {
COND = rax == 0x0;
rax = 0xb3000000;
if (!COND) {
rax = [r13 backgroundColor];
}
rbx = var_50;
if (r12 != 0x0) {
rax = [r12 longLongValue];
}
}
else {
if (rax != 0x0) {
rax = [r13 backgroundColor];
}
else {
rax = 0xffffffff;
}
rbx = var_50;
if (r12 != 0x0) {
rax = [r12 longLongValue];
}
}
[rbx setBackgroundColor:rax];
[r12 release];
[r14 release];
[rbx setShowThirdDisclaimerWithDic:var_58 defaultVal:[r13 showThirdDisclaimer] & 0xff];
rax = [r13 shareTokenParams];
r15 = r13;
r13 = rbx;
rbx = [rax retain];
[r13 shareTokenParamsWithDic:var_58 defaultParams:rbx];
[rbx release];
[r13 resetPartialProperties4Transparent];
rdx = var_58;
[r13 changeTitleImage:rdx override:0x0];
r14 = [[r15 viewControllerProxy] retain];
rbx = [[r14 viewController] retain];
rsi = @selector(isApplet);
r15 = _objc_msgSend(rbx, rsi);
[rbx release];
[r14 release];
r12 = var_80;
if (r15 != 0x0) {
var_108 = __NSConcreteStackBlock;
*(&var_108 + 0x8) = 0xc2000000;
*(&var_108 + 0x10) = ___39-[H5Options initWithOptions:overrides:]_block_invoke.1067;
*(&var_108 + 0x18) = ___block_descriptor_tmp.1072;
*(&var_108 + 0x20) = [var_68 retain];
*(&var_108 + 0x28) = [var_58 retain];
*(&var_108 + 0x30) = [var_50 retain];
rsi = @selector(enumerateKeysAndObjectsUsingBlock:);
rdx = &var_108;
_objc_msgSend(var_70, rsi);
[*(&var_108 + 0x30) release];
[*(&var_108 + 0x28) release];
[*(&var_108 + 0x20) release];
}
[var_60 release];
[var_90 release];
[var_98 release];
[var_A0 release];
[var_70 release];
r15 = var_88;
rbx = var_58;
}
[rbx release];
[r15 release];
if (*___stack_chk_guard == *___stack_chk_guard) {
rax = r12;
}
else {
rax = __stack_chk_fail();
}
return rax;
}上边这个方法里的下边四行代码就是
r14 = [_getPramField(@"kDefaultTitle") retain];
r15 = [[var_58 objectForKeyedSubscript:r14] retain];
rbx = [_GetString(r15, r13->originDefaultTitle) retain];
[var_50 setDefaultTitle:rbx];(lldb) po getPramField(@"kDefaultTitle")
defaultTitle
然后var_58是包含默认标题的地方
r15 = [arg2 retain];
rbx = [arg3 retain];
var_D0 = self;
r12 = [[&var_D0 super] initWithOptions:r15 overrides:rbx];
var_58 = [_objc_msgSend(r12, @selector(normalize:)) retain];然后-[NBOptions initWithOptions:overrides:]代码类似
void * -[NBOptions nbNormalize:](void * self, void * _cmd, void * arg2) {
r13 = [arg2 retain];
if (*_nbNormalize:.shortMap == 0x0) {
var_170 = intrinsic_movdqa(var_170, intrinsic_punpcklqdq(zero_extend_64(@"u"), zero_extend_64(@"dt")));
var_D0 = intrinsic_movdqa(var_D0, intrinsic_punpcklqdq(zero_extend_64(@"url"), zero_extend_64(@"defaultTitle")));
*(int128_t *)(&var_170 + 0x10) = intrinsic_movdqa(*(int128_t *)(&var_170 + 0x10), intrinsic_punpcklqdq(zero_extend_64(@"ds"), zero_extend_64(@"st")));
*(int128_t *)(&var_D0 + 0x10) = intrinsic_movdqa(*(int128_t *)(&var_D0 + 0x10), intrinsic_punpcklqdq(zero_extend_64(@"defaultSubtitle"), zero_extend_64(@"showTitleBar")));
*(int128_t *)(&var_170 + 0x20) = intrinsic_movdqa(*(int128_t *)(&var_170 + 0x20), intrinsic_punpcklqdq(zero_extend_64(@"sl"), zero_extend_64(@"cb")));
*(int128_t *)(&var_D0 + 0x20) = intrinsic_movdqa(*(int128_t *)(&var_D0 + 0x20), intrinsic_punpcklqdq(zero_extend_64(@"showLoading"), zero_extend_64(@"closeButtonText")));
*(int128_t *)(&var_170 + 0x30) = intrinsic_movdqa(*(int128_t *)(&var_170 + 0x30), intrinsic_punpcklqdq(zero_extend_64(@"rt"), zero_extend_64(@"bz")));
*(int128_t *)(&var_D0 + 0x30) = intrinsic_movdqa(*(int128_t *)(&var_D0 + 0x30), intrinsic_punpcklqdq(zero_extend_64(@"readTitle"), zero_extend_64(@"bizScenario")));
*(int128_t *)(&var_170 + 0x40) = intrinsic_movdqa(*(int128_t *)(&var_170 + 0x40), intrinsic_punpcklqdq(zero_extend_64(@"bb"), zero_extend_64(@"pr")));
*(int128_t *)(&var_D0 + 0x40) = intrinsic_movdqa(*(int128_t *)(&var_D0 + 0x40), intrinsic_punpcklqdq(zero_extend_64(@"backBehavior"), zero_extend_64(@"pullRefresh")));
*(int128_t *)(&var_170 + 0x50) = intrinsic_movdqa(*(int128_t *)(&var_170 + 0x50), intrinsic_punpcklqdq(zero_extend_64(@"tm"), zero_extend_64(@"sp")));
*(int128_t *)(&var_D0 + 0x50) = intrinsic_movdqa(*(int128_t *)(&var_D0 + 0x50), intrinsic_punpcklqdq(zero_extend_64(@"toolbarMenu"), zero_extend_64(@"showProgress")));
*(int128_t *)(&var_170 + 0x60) = intrinsic_movdqa(*(int128_t *)(&var_170 + 0x60), intrinsic_punpcklqdq(zero_extend_64(@"bc"), zero_extend_64(@"gb")));
*(int128_t *)(&var_D0 + 0x60) = intrinsic_movdqa(*(int128_t *)(&var_D0 + 0x60), intrinsic_punpcklqdq(zero_extend_64(@"backgroundColor"), zero_extend_64(@"gestureBack")));
*(int128_t *)(&var_170 + 0x70) = intrinsic_movdqa(*(int128_t *)(&var_170 + 0x70), intrinsic_punpcklqdq(zero_extend_64(@"pd"), zero_extend_64(@"so")));
*(int128_t *)(&var_D0 + 0x70) = intrinsic_movdqa(*(int128_t *)(&var_D0 + 0x70), intrinsic_punpcklqdq(zero_extend_64(@"canPullDown"), zero_extend_64(@"showOptionMenu")));
*(int128_t *)(&var_170 + 0x80) = intrinsic_movdqa(*(int128_t *)(&var_170 + 0x80), intrinsic_punpcklqdq(zero_extend_64(@"tl"), zero_extend_64(@"sd")));
xmm0 = zero_extend_64(@"showDomain");
*(int128_t *)(&var_D0 + 0x80) = intrinsic_movdqa(*(int128_t *)(&var_D0 + 0x80), intrinsic_punpcklqdq(zero_extend_64(@"showTitleLoading"), xmm0));
*(&var_170 + 0x90) = @"ss";
*(&var_D0 + 0x90) = @"showStatusBar";
rax = [NSDictionary dictionaryWithObjects:&var_D0 forKeys:&var_170 count:0x13];
rax = [rax retain];
rdi = *_nbNormalize:.shortMap;
*_nbNormalize:.shortMap = rax;
[rdi release];
}
rax = [r13 mutableCopy];
xmm0 = intrinsic_pxor(xmm0, xmm0);
*(int128_t *)(&var_270 + 0x30) = intrinsic_movdqa(*(int128_t *)(&var_270 + 0x30), xmm0);
*(int128_t *)(&var_270 + 0x20) = intrinsic_movdqa(*(int128_t *)(&var_270 + 0x20), xmm0);
*(int128_t *)(&var_270 + 0x10) = intrinsic_movdqa(*(int128_t *)(&var_270 + 0x10), xmm0);
var_200 = rax;
var_270 = intrinsic_movdqa(var_270, xmm0);
rax = [r13 allKeys];
rax = [rax retain];
var_1F8 = rax;
rax = [rax countByEnumeratingWithState:&var_270 objects:&var_1F0 count:0x10];
var_210 = rax;
if (rax != 0x0) {
var_220 = **(&var_270 + 0x10);
var_228 = r13;
do {
rbx = @selector(objectForKeyedSubscript:);
r14 = 0x0;
var_230 = rbx;
do {
if (*var_260 != var_220) {
objc_enumerationMutation(var_1F8);
}
r15 = *(var_268 + r14 * 0x8);
var_218 = [_objc_msgSend(r13, rbx, r15) retain];
r13 = [_objc_msgSend(*_nbNormalize:.shortMap, rbx, r15) retain];
if (r13 != 0x0) {
rbx = [_objc_msgSend(*_nbNormalize:.shortMap, rbx, r15) retain];
rsi = @selector(setObject:forKeyedSubscript:);
r15 = var_218;
rdx = r15;
rcx = rbx;
_objc_msgSend(var_200, rsi, rdx, rcx);
[rbx release];
}
else {
rsi = @selector(setObject:forKeyedSubscript:);
rdx = var_218;
rcx = r15;
r15 = rdx;
_objc_msgSend(var_200, rsi, rdx, rcx);
}
[r13 release];
[r15 release];
r14 = r14 + 0x1;
r13 = var_228;
rbx = var_230;
} while (r14 < var_210);
rax = [var_1F8 countByEnumeratingWithState:&var_270 objects:&var_1F0 count:0x10];
var_210 = rax;
} while (rax != 0x0);
}
[var_1F8 release];
[r13 release];
if (*___stack_chk_guard == *___stack_chk_guard) {
rax = [var_200 autorelease];
}
else {
rax = __stack_chk_fail();
}
return rax;
}
现在看df在h5option里面怎么赋值的，需要到nboption 的-[NBOptions initWithOptions:overrides:]方法
方法就是nbNormalize 字典的一些操作
接着看哪个方法调用的-[H5Options initWithOptions:overrides:]和overrides参数
就是-[JsApiHandler4PushWindow handler:context:callback:]的第一个参数
然后看-[PSDJsApi handler:context:callback:]的第一个参数r13
然后-[PSDJsBridge _doFlushMessageQueue:url:]调用-[PSDJsApi handler:context:callback:的时候怎么传参
- (void)_doFlushMessageQueue:(NSString *)arg1 urlS:(id)arg2;{
//关闭log
if([arg1 containsString:@"reportClickTime" ]
/*||[arg1 containsString:@"\"handlerName\":\"reportData\"" ]同时还有其他的*/){
return;
}
//打印h5与原生交互传过来的原始参数
NSLog(@"\n\nh5与原生交互传过来的原始参数%@ \n\n%@ \n\n",arg1,arg2);
[self _doFlushMessageQueue:arg1 urlS:arg2];
}h5与原生交互传过来的原始参数[{"handlerName":"pushWindow","data":{"url":"file:///Users/yyy/Library/Developer/CoreSimulator/Devices/E4F2BC0A-1C6B-4A7B-9739-99DFD0A0010E/data/Containers/Bundle/Application/2F9DA388-1CD2-45DC-AC02-96F2C8C566A2/MPH5Demo_pod.app/H52Native.html","param":{"username":"xxxxx","password":"aaaaaa","defaultTitle":"这是默认标题","readTitle":false},"passData":{"username":"xxxxx","password":"aaaaaa"}},"callbackId":"pushWindow_15853160637460.4508789631987421"}]
后面的简单看看
思路是执行js返回的。
