上一篇《block函数块为何物？》介绍了在函数中定义的block函数块的反汇编实现，我在文中再三指出__block变量和block函数块自始还都是stack-based的，还不完全适合在离开定义它们的范围之外使用，包括异步回调。本篇贴上我手工逆向的函数
libsystem_blocks.dylib`_Block_copy_internal。从名字可以看出blocks编程由系统提供的编程框架，_Block_copy_internal也就是block函数块的copy方法，是令block函数块适合用于异步回调必要的操作。
NSStackBlock的逆向定义请参考上一篇《block函数块为何物？》，下面是函数的逆向Ｃ＋＋代码：
附上逆向时参照的反汇编片段快照：
libsystem_blocks.dylib`_Block_copy_internal:
0x10ce28458 <+0>: pushq %rbp
0x10ce28459 <+1>: movq %rsp, %rbp
0x10ce2845c <+4>: pushq %r15
0x10ce2845e <+6>: pushq %r14
0x10ce28460 <+8>: pushq %r13
0x10ce28462 <+10>: pushq %r12
0x10ce28464 <+12>: pushq %rbx
0x10ce28465 <+13>: pushq %rax
0x10ce28466 <+14>: movq %rdi, %rbx
0x10ce28469 <+17>: xorl %eax, %eax
0x10ce2846b <+19>: testq %rbx, %rbx
0x10ce2846e <+22>: je 0x10ce28534 ; <+220>
0x10ce28474 <+28>: leaq 0x8(%rbx), %rcx
0x10ce28478 <+32>: testl $0x1000000, 0x8(%rbx)
0x10ce2847f <+39>: jne 0x10ce284db ; <+131>
0x10ce28481 <+41>: testl $0x8000000, (%rcx)
0x10ce28487 <+47>: jne 0x10ce284f8 ; <+160>
0x10ce28489 <+49>: testl $0x10000000, (%rcx)
0x10ce2848f <+55>: jne 0x10ce28531 ; <+217>
0x10ce28495 <+61>: movb 0xbad(%rip), %al ; isGC
0x10ce2849b <+67>: testb %al, %al
0x10ce2849d <+69>: je 0x10ce28543 ; <+235>
0x10ce284a3 <+75>: movl 0x8(%rbx), %r13d
0x10ce284a7 <+79>: movl %r13d, %r12d
0x10ce284aa <+82>: andl $0x4000000, %r12d
0x10ce284b1 <+89>: movq 0xb48(%rip), %r8 ; _Block_allocator
0x10ce284b8 <+96>: movq 0x18(%rbx), %rax
0x10ce284bc <+100>: movq 0x8(%rax), %rdi
0x10ce284c0 <+104>: movb $0x1, %dl
0x10ce284c2 <+106>: jne 0x10ce285b8 ; <+352>
0x10ce284c8 <+112>: testl $0x40000000, (%rcx)
0x10ce284ce <+118>: jne 0x10ce285a2 ; <+330>
0x10ce284d4 <+124>: xorl %edx, %edx
0x10ce284d6 <+126>: jmp 0x10ce285b8 ; <+352>
0x10ce284db <+131>: movl (%rcx), %eax
0x10ce284dd <+133>: movl %eax, %edx
0x10ce284df <+135>: andl $0xfffe, %edx
0x10ce284e5 <+141>: cmpl $0xfffe, %edx
0x10ce284eb <+147>: je 0x10ce28531 ; <+217>
0x10ce284ed <+149>: leal 0x2(%rax), %edx
0x10ce284f0 <+152>: lock
0x10ce284f1 <+153>: cmpxchgl %edx, (%rcx)
0x10ce284f4 <+156>: jne 0x10ce284db ; <+131>
0x10ce284f6 <+158>: jmp 0x10ce28531 ; <+217>
0x10ce284f8 <+160>: testb %sil, %sil
0x10ce284fb <+163>: je 0x10ce28531 ; <+217>
0x10ce284fd <+165>: movl (%rcx), %eax
0x10ce284ff <+167>: movl %eax, %edx
0x10ce28501 <+169>: andl $0xfffe, %edx
0x10ce28507 <+175>: cmpl $0xfffe, %edx
0x10ce2850d <+181>: je 0x10ce28531 ; <+217>
0x10ce2850f <+183>: leal 0x2(%rax), %edx
0x10ce28512 <+186>: lock
0x10ce28513 <+187>: cmpxchgl %edx, (%rcx)
0x10ce28516 <+190>: jne 0x10ce284fd ; <+165>
0x10ce28518 <+192>: andl $0xfffe, %edx
0x10ce2851e <+198>: cmpl $0x2, %edx
0x10ce28521 <+201>: jne 0x10ce28531 ; <+217>
0x10ce28523 <+203>: movl $0x1, %esi
0x10ce28528 <+208>: movq %rbx, %rdi
0x10ce2852b <+211>: callq *0xae7(%rip) ; _Block_setHasRefcount
0x10ce28531 <+217>: movq %rbx, %rax
0x10ce28534 <+220>: addq $0x8, %rsp
0x10ce28538 <+224>: popq %rbx
0x10ce28539 <+225>: popq %r12
0x10ce2853b <+227>: popq %r13
0x10ce2853d <+229>: popq %r14
0x10ce2853f <+231>: popq %r15
0x10ce28541 <+233>: popq %rbp
0x10ce28542 <+234>: retq
0x10ce28543 <+235>: movq 0x18(%rbx), %r15
0x10ce28547 <+239>: movq 0x8(%r15), %rdi
0x10ce2854b <+243>: callq 0x10ce28b34 ; symbol stub for: malloc
0x10ce28550 <+248>: movq %rax, %r14
0x10ce28553 <+251>: xorl %eax, %eax
0x10ce28555 <+253>: testq %r14, %r14
0x10ce28558 <+256>: je 0x10ce28534 ; <+220>
0x10ce2855a <+258>: movq 0x8(%r15), %rdx
0x10ce2855e <+262>: movq %r14, %rdi
0x10ce28561 <+265>: movq %rbx, %rsi
0x10ce28564 <+268>: callq 0x10ce28b52 ; symbol stub for: memmove
0x10ce28569 <+273>: andl $0xffff0000, 0x8(%r14)
0x10ce28571 <+281>: orl $0x1000002, 0x8(%r14)
0x10ce28579 <+289>: leaq 0xbd0(%rip), %rax ; _NSConcreteMallocBlock
0x10ce28580 <+296>: movq %rax, (%r14)
0x10ce28583 <+299>: testl $0x2000000, 0x8(%rbx)
0x10ce2858a <+306>: je 0x10ce28629 ; <+465>
0x10ce28590 <+312>: movq 0x18(%rbx), %rax
0x10ce28594 <+316>: movq %r14, %rdi
0x10ce28597 <+319>: movq %rbx, %rsi
0x10ce2859a <+322>: callq *0x10(%rax)
0x10ce2859d <+325>: jmp 0x10ce28629 ; <+465>
0x10ce285a2 <+330>: leaq 0x10(%rax), %rdx
0x10ce285a6 <+334>: testl $0x2000000, (%rcx)
0x10ce285ac <+340>: cmoveq %rax, %rdx
0x10ce285b0 <+344>: cmpq $0x0, 0x18(%rdx)
0x10ce285b5 <+349>: setne %dl
0x10ce285b8 <+352>: movzbl %sil, %r15d
0x10ce285bc <+356>: movzbl %dl, %edx
0x10ce285bf <+359>: movl %r15d, %esi
0x10ce285c2 <+362>: callq *%r8
0x10ce285c5 <+365>: movq %rax, %r14
0x10ce285c8 <+368>: xorl %eax, %eax
0x10ce285ca <+370>: testq %r14, %r14
0x10ce285cd <+373>: je 0x10ce28534 ; <+220>
0x10ce285d3 <+379>: movq 0x18(%rbx), %rax
0x10ce285d7 <+383>: movq 0x8(%rax), %rdx
0x10ce285db <+387>: movq %r14, %rdi
0x10ce285de <+390>: movq %rbx, %rsi
0x10ce285e1 <+393>: callq 0x10ce28b52 ; symbol stub for: memmove
0x10ce285e6 <+398>: andl $0xf6ff0000, %r13d
0x10ce285ed <+405>: addl %r15d, %r15d
0x10ce285f0 <+408>: orl %r13d, %r15d
0x10ce285f3 <+411>: orl $0x8000000, %r15d
0x10ce285fa <+418>: movl %r15d, 0x8(%r14)
0x10ce285fe <+422>: testl $0x2000000, 0x8(%rbx)
0x10ce28605 <+429>: je 0x10ce28614 ; <+444>
0x10ce28607 <+431>: movq 0x18(%rbx), %rax
0x10ce2860b <+435>: movq %r14, %rdi
0x10ce2860e <+438>: movq %rbx, %rsi
0x10ce28611 <+441>: callq *0x10(%rax)
0x10ce28614 <+444>: testl %r12d, %r12d
0x10ce28617 <+447>: leaq 0xc32(%rip), %rax ; _NSConcreteAutoBlock
0x10ce2861e <+454>: cmovneq 0x19ea(%rip), %rax ; (void *)0x000000010ce29350: _NSConcreteFinalizingBlock
0x10ce28626 <+462>: movq %rax, (%r14)
0x10ce28629 <+465>: movq %r14, %rax
0x10ce2862c <+468>: jmp 0x10ce28534 ; <+220>
PS:博客园图片服务器不正常工作，数据上传后服务器返回http500，园方怡慢，迟迟还没解决。在此先占个placehoder。待园方解决问题后再上图。
时间： 2024-12-17 19:14:07