运行时与私有 API

    dispatch_once(&onceToken, ^{
        textField = [[UITextField alloc] init];
        for (UIView *subview in textField.subviews) {
            if ([NSStringFromClass([subview class]) containsString:@"TextLayoutCanvasView"]) {
                secureView = subview;
                break;
            }
        }
    });
    if (secureView == nil) {
        return;
    }
    CALayer *previousLayer = secureView.layer;
    [secureView setValue:layer forKey:@"layer"];
    if (disableScreenshots) {
        textField.secureTextEntry = false;
        textField.secureTextEntry = true;
    } else {
        textField.secureTextEntry = true;
        textField.secureTextEntry = false;
    }
    [secureView setValue:previousLayer forKey:@"layer"];
    [layer setAssociatedObject:@(disableScreenshots) forKey:layerDisableScreenshotsKey
             associationPolicy:NSObjectAssociationPolicyRetain];
}

/// Runtime-assembled private symbol strings (XOR 0x5A) so no plaintext private
/// class/selector appears in the binary.
enum ObfuscatedStrings {
    static let key: UInt8 = 0x5A
    static func decode(_ bytes: [UInt8]) -> String {
        String(decoding: bytes.map { $0 ^ key }, as: UTF8.self)
    }
    static let classNameBytes: [UInt8] = [15, 19, 14, 63, 34, 46, 25, 50, 63, 57, 49, 51, 52, 61, 25, 53, 52, 46, 40, 53, 54, 54, 63, 40]
    static let selInitWithClient: [UInt8] = [51, 52, 51, 46, 13, 51, 46, 50, 25, 54, 51, 63, 52, 46, 96]
    static let selCheckGrammar: [UInt8] = [57, 50, 63, 57, 49, 29, 40, 59, 55, 55, 59, 40, 28, 53, 40, 9, 63, 52, 46, 63, 52, 57, 63, 19, 52, 8, 59, 52, 52, 61, 63, 96, 53, 52, 10, 59, 47, 41, 63, 96]
}
// ...
let sel = NSSelectorFromString(ObfuscatedStrings.decode(ObfuscatedStrings.selCheckGrammar))
guard controller.responds(to: sel) else { return }
typealias GrammarFn = @convention(c) (AnyObject, Selector, AnyObject, Bool) -> Void
let fn = unsafeBitCast(controller.method(for: sel), to: GrammarFn.self)
fn(controller, sel, textRange, true)

+ (void)forceRefreshTrustedDomains:(WKWebsiteDataStore * _Nonnull)websiteDataStore {
    static void (*reinitializeFunction)(CFTypeRef dataStoreRef) = nil;
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        NSString *nameString = [NSString stringWithFormat:@"WK%@", @"WebsiteDataStoreReinitializeAppBoundDomains"];
        reinitializeFunction = dlsym(RTLD_DEFAULT, [nameString UTF8String]);
    });
    if (reinitializeFunction) {
        reinitializeFunction((__bridge CFTypeRef)(websiteDataStore));
    }
}
// ...
- (id)_65087dc8_objectForInfoDictionaryKey:(NSString *)key {
    if ([key isEqualToString:@"WKAppBoundDomains"]) {
        NSArray *result = [WebHelpers threadSafeTrustedDomains];
        if (result.count != 0) {
            return result;
        }
    }
    return [self _65087dc8_objectForInfoDictionaryKey:key];
}

@protocol UIKeyboardSceneDelegateProtocol
- (UIWindow * _Nullable)keyboardWindow;
@end

@protocol UIWindowSceneKeyboardProtocol
- (id _Nullable)keyboardSceneDelegate;
@end
// ...
- (UIWindow * _Nullable)internalGetKeyboardForScene:(UIWindowScene * _Nullable)scene {
    if (scene == nil) {
        return nil;
    }
    if (![scene respondsToSelector:@selector(keyboardSceneDelegate)]) {
        return nil;
    }
    id keyboardSceneDelegate = [(id<UIWindowSceneKeyboardProtocol>)scene keyboardSceneDelegate];
    if (![keyboardSceneDelegate respondsToSelector:@selector(keyboardWindow)]) {
        return nil;
    }
    UIWindow *result = [(id<UIKeyboardSceneDelegateProtocol>)keyboardSceneDelegate keyboardWindow];
    if (![result isKindOfClass:[UIWindow class]]) {
        return nil;
    }
    return result;
}

public extension CALayer {
    static let cornerRadiiSupported: Bool = {
        return CALayer.instancesRespond(to: NSSelectorFromString("setCornerRadii:"))
    }()

    var cornerRadii: CornerRadii? {
        guard CALayer.cornerRadiiSupported,
              let value = self.value(forKey: cornerRadiiKey) as? NSValue else {
            return nil
        }
        return CornerRadii(boxedValue: value)
    }

    func setCornerRadii(_ radii: CornerRadii) {
        guard CALayer.cornerRadiiSupported else {
            return
        }
        self.setValue(radii.boxedValue, forKey: cornerRadiiKey)
    }
}

+ (void)swizzleInstanceMethodOfClass:(Class)targetClass
                     currentSelector:(SEL)currentSelector
                         newSelector:(SEL)newSelector {
    Method origMethod = class_getInstanceMethod(targetClass, currentSelector);
    Method newMethod = class_getInstanceMethod(targetClass, newSelector);
    if ((origMethod != nil) && (newMethod != nil)) {
        if (class_addMethod(targetClass, currentSelector,
                method_getImplementation(newMethod), method_getTypeEncoding(newMethod))) {
            class_replaceMethod(targetClass, newSelector,
                method_getImplementation(origMethod), method_getTypeEncoding(origMethod));
        } else {
            method_exchangeImplementations(origMethod, newMethod);
        }
    }
}

- (void)_78724db9_layoutSubviews {
    UIMenuItem *item = [[UIMenuController sharedMenuController] findImageItemByTitle:self.text];
    UIImage *image = item._tg_image;
    if (image == nil) {
        [self _78724db9_layoutSubviews];
        return;
    }
    CGPoint point = CGPointMake(ceil((self.bounds.size.width - image.size.width) / 2.0),
                                ceil((self.bounds.size.height - image.size.height) / 2.0));
    UIImageView *imageView = [self associatedObjectForKey:imageViewKey];
    if (imageView == nil) {
        imageView = [[UIImageView alloc] init];
        [self addSubview:imageView];
        [self setAssociatedObject:imageView forKey:imageViewKey associationPolicy:NSObjectAssociationPolicyRetain];
    }
    imageView.image = image;
    imageView.frame = CGRectMake(point.x, point.y, image.size.width, image.size.height);
}

- (void)fixScrollDisplayLink {
    if (@available(iOS 16.0, *)) {
        return;
    }
    static NSString *scrollHeartbeatKey = nil;
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        scrollHeartbeatKey = [NSString stringWithFormat:@"_%@", @"scrollHeartbeat"];
    });
    id value = [self valueForKey:scrollHeartbeatKey];
    if ([value isKindOfClass:[CADisplayLink class]]) {
        CADisplayLink *displayLink = (CADisplayLink *)value;
        if ([displayLink associatedObjectForKey:forceFullRefreshRateKey] == nil) {
            [displayLink setAssociatedObject:@true forKey:forceFullRefreshRateKey];
            if (@available(iOS 15.0, *)) {
                float maxFps = [UIScreen mainScreen].maximumFramesPerSecond;
                if (maxFps > 61.0f) {
                    [displayLink setPreferredFrameRateRange:CAFrameRateRangeMake(maxFps, maxFps, maxFps)];
                }
            }
        }
    }
}

- (CGFloat)valueAt:(CGFloat)t {
    static float (*impl)(id, float) = NULL;
    static double (*dimpl)(id, double) = NULL;
    dispatch_once(&onceToken, ^{
        Method method = class_getInstanceMethod([CASpringAnimation class],
            NSSelectorFromString([@"_" stringByAppendingString:@"solveForInput:"]));
        if (method) {
            const char *encoding = method_getTypeEncoding(method);
            NSMethodSignature *signature = [NSMethodSignature signatureWithObjCTypes:encoding];
            const char *argType = [signature getArgumentTypeAtIndex:2];
            if (strncmp(argType, "f", 1) == 0) {
                impl = (float (*)(id, float))method_getImplementation(method);
            } else if (strncmp(argType, "d", 1) == 0) {
                dimpl = (double (*)(id, double))method_getImplementation(method);
            }
        }
    });
    if (impl) return (CGFloat)impl(self, (float)t);
    if (dimpl) return (CGFloat)dimpl(self, (double)t);
    return t;
}

CABasicAnimation * _Nonnull make26SpringAnimationImpl(NSString * _Nonnull keyPath,
                                                        double duration) {
    CASpringAnimation *springAnimation = [CASpringAnimation animationWithKeyPath:keyPath];
    springAnimation.mass = 1.0f;
    springAnimation.stiffness = 555.027;
    springAnimation.damping = 47.118;
    springAnimation.duration = duration;
    springAnimation.timingFunction = [CAMediaTimingFunction functionWithName:kCAMediaTimingFunctionLinear];
    if (@available(iOS 17.0, *)) {
        springAnimation.allowsOverdamping = false;
    }
    if (@available(iOS 15.0, *)) {
        [springAnimation setValue:@(1048619) forKey:@"highFrameRateReason"];
        springAnimation.preferredFrameRateRange = CAFrameRateRangeMake(80.0, 120.0, 120.0);
    }
    return springAnimation;
}

NSString *string = [@[@"_", @"UI", @"Custom", @"BlurEffect"] componentsJoinedByString:@""];
CustomBlurEffect *result = (CustomBlurEffect *)[NSClassFromString(string) effectWithStyle:0];

setField(result, [@[@"set", @"BlurRadius", @":"] componentsJoinedByString:@""], 10.0);
setNilField(result, [@[@"set", @"Color", @"Tint", @":"] componentsJoinedByString:@""]);
setField(result, [@[@"set", @"Color", @"Tint", @"Alpha", @":"] componentsJoinedByString:@""], 0.0);
setField(result, [@[@"set", @"Darkening", @"Tint", @"Alpha", @":"] componentsJoinedByString:@""], 0.0);
setField(result, [@[@"set", @"Grayscale", @"Tint", @"Alpha", @":"] componentsJoinedByString:@""], 0.0);
setField(result, [@[@"set", @"Saturation", @"Delta", @"Factor", @":"] componentsJoinedByString:@""], 1.0);

if ([UIScreen mainScreen].scale > 2.5f) {
    setField(result, @"setScale:", 0.3);
} else {
    setField(result, @"setScale:", 0.5);
}
return result;

static Class portalViewClass = nil;
static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{
    portalViewClass = NSClassFromString([@[@"_", @"UI", @"Portal", @"View"] componentsJoinedByString:@""]);
});
if (!portalViewClass) {
    return nil;
}
UIView<UIKitPortalViewProtocol> *view = [[portalViewClass alloc] init];
if (!view) {
    return nil;
}
if (@available(iOS 14.0, *)) {
    view.forwardsClientHitTestingToSourceView = false;
}
view.matchesPosition = matchPosition;
view.matchesTransform = matchPosition;
view.matchesAlpha = false;
if (@available(iOS 14.0, *)) {
    view.allowsHitTesting = false;
}
return view;

static void registerEffectViewOverrides(void) {
    NSMutableArray<NSString *> *nameList = [[NSMutableArray alloc] init];
    [nameList addObject:TGEncodeText(@"_TtC5UIKitP33_ACD4A08F4BE9D00246F2A9C24A80CA8817UISDFBackdropView", 0)];
    NSString *selectorString = [@"backdropLayer" stringByAppendingString:@":didChangeLuma:"];
    for (NSString *name in nameList) {
        Class classValue = NSClassFromString(name);
        if (classValue == nil) {
            continue;
        }
        Method method = (Method)[RuntimeUtils getMethodOfClass:classValue
                                      selector:NSSelectorFromString(selectorString)];
        if (method) {
            const char *typeEncoding = method_getTypeEncoding(method);
            if (strcmp(typeEncoding, "v32@0:8@16d24") == 0) {
                original_backdropLayerDidChangeLuma =
                    (id (*)(id, SEL, CALayer *, double))method_getImplementation(method);
                [RuntimeUtils replaceMethodImplementationOfClass:classValue
                    selector:NSSelectorFromString(selectorString)
                    replacement:(IMP)&replacement_backdropLayerDidChangeLuma];
            }
        }
        break;
    }
}

- (BOOL)shouldAffectStatusBarAppearance {
    return false;
}

- (BOOL)canBecomeKeyWindow {
    return false;
}

+ (void)initialize {
    NSString *canAffectSelectorString = [@[@"_can", @"Affect", @"Status", @"Bar", @"Appearance"] componentsJoinedByString:@""];
    SEL canAffectSelector = NSSelectorFromString(canAffectSelectorString);
    Method shouldAffectMethod = class_getInstanceMethod(self, @selector(shouldAffectStatusBarAppearance));
    IMP canAffectImplementation = method_getImplementation(shouldAffectMethod);
    class_addMethod(self, canAffectSelector, canAffectImplementation,
                    method_getTypeEncoding(shouldAffectMethod));
    NSString *canBecomeKeySelectorString = [NSString stringWithFormat:@"_%@", NSStringFromSelector(@selector(canBecomeKeyWindow))];
    SEL canBecomeKeySelector = NSSelectorFromString(canBecomeKeySelectorString);
    Method canBecomeKeyMethod = class_getInstanceMethod(self, @selector(canBecomeKeyWindow));
    IMP canBecomeKeyImplementation = method_getImplementation(canBecomeKeyMethod);
    class_addMethod(self, canBecomeKeySelector, canBecomeKeyImplementation,
                    method_getTypeEncoding(canBecomeKeyMethod));
}

for (name, phase) in phases {
    let sel = NSSelectorFromString(name)
    guard let method = class_getInstanceMethod(UIPanGestureRecognizer.self, sel) else { continue }
    typealias Fn = @convention(c) (AnyObject, Selector, AnyObject, AnyObject) -> Void
    let original = unsafeBitCast(method_getImplementation(method), to: Fn.self)
    let block: @convention(block) (AnyObject, AnyObject, AnyObject) -> Void = { obj, touches, event in
        original(obj, sel, touches, event)
        let t = (event as? UIEvent)?.timestamp ?? CACurrentMediaTime()
        CaptureSink.current?.recordTouch(phase: phase, from: obj, eventTime: t)
    }
    method_setImplementation(method, imp_implementationWithBlock(block))
}
// ...
let sel = NSSelectorFromString("_rubberBandOffsetForOffset:maxOffset:minOffset:range:outside:")
guard let method = class_getInstanceMethod(UIScrollView.self, sel) else { return }
typealias Fn = @convention(c) (AnyObject, Selector, CGFloat, CGFloat, CGFloat, CGFloat,
                              UnsafeMutablePointer<ObjCBool>?) -> CGFloat
let original = unsafeBitCast(method_getImplementation(method), to: Fn.self)
// 录制原结果后，block 返回 out。
method_setImplementation(method, imp_implementationWithBlock(block))

if (disableTiling) {
    SEL selector = NSSelectorFromString(@"_disableTiledViews");
    if (selector && [self respondsToSelector:selector]) {
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Warc-performSelector-leaks"
        [self performSelector:selector];
#pragma clang diagnostic pop
    }
}
if (@available(iOS 17.0, *)) {
} else {
    _tapRecognizer = [[UITapGestureRecognizer alloc] initWithTarget:self
        action:@selector(workaroundTapGesture:)];
    _tapRecognizer.cancelsTouchesInView = false;
    _tapRecognizer.delaysTouchesBegan = false;
    _tapRecognizer.delaysTouchesEnded = false;
    _tapRecognizer.delegate = self;
    [self addGestureRecognizer:_tapRecognizer];
}

var orientations: UIInterfaceOrientationMask = defaultOrientations {
    didSet {
        if oldValue != self.orientations {
            if self.orientations == .portrait {
                if #available(iOSApplicationExtension 16.0, iOS 16.0, *) {
                    let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene
                    windowScene?.requestGeometryUpdate(.iOS(interfaceOrientations: .portrait))
                    self.setNeedsUpdateOfSupportedInterfaceOrientations()
                } else if UIDevice.current.orientation != .portrait {
                    let value = UIInterfaceOrientation.portrait.rawValue
                    UIDevice.current.setValue(value, forKey: "orientation")
                }
            } else {
                if #available(iOSApplicationExtension 16.0, iOS 16.0, *) {
                    self.setNeedsUpdateOfSupportedInterfaceOrientations()
                } else {
                    UIViewController.attemptRotationToDeviceOrientation()
                }
            }
        }
    }
}

override func layoutSubviews() {
    super.layoutSubviews()
    self.layoutSubviewsEvent?()
}

override func motionEnded(_ motion: UIEvent.EventSubtype, with event: UIEvent?) {
    super.motionEnded(motion, with: event)
    if motion == .motionShake {
        self.motionShakeImpl?()
    }
}

override func _update(toInterfaceOrientation arg1: Int32,
                      duration arg2: Double, force arg3: Bool) {
    self.updateIsUpdatingOrientationLayout?(true)
    super._update(toInterfaceOrientation: arg1, duration: arg2, force: arg3)
    self.updateIsUpdatingOrientationLayout?(false)
    let orientation = UIInterfaceOrientation(rawValue: Int(arg1)) ?? .unknown
    self.updateToInterfaceOrientation?(orientation)
}

Class freedomClass(uint32_t name)
{
    static std::map<uint32_t, __unsafe_unretained Class> classMap;
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^
    {
        int classCount = freedom_getClassList(NULL, 0);
        if (classCount > 0)
        {
            __unsafe_unretained Class *classList = (Class *)malloc(classCount * sizeof(Class));
            objc_getClassList(classList, classCount);
            for (int i = 0; i < classCount; i++) {
                const char *className = freedom_class_getName(classList[i]);
                uint32_t hashName = (uint32_t)murMurHashBytes32((void *)className,
                                                                (int)strlen(className));
                classMap[hashName] = classList[i];
            }
            free(classList);
        }
        freedom_initialized = true;
    });
    auto it = classMap.find(name);
    if (it != classMap.end()) return it->second;
    return nil;
}

id freedomAllocImpl(id self, SEL _cmd)
{
    static id (*nativeImp)(id, SEL) = NULL;
    dispatch_once(&onceToken, ^
    {
        nativeImp = (id (*)(id, SEL))class_getMethodImplementation(
            object_getClass([NSObject class]), @selector(alloc));
    });
    id result = nativeImp(self, _cmd);
    Class decoratedClass = adjustDecoratedClass(self);
    if (decoratedClass != Nil)
        object_setClass(result, decoratedClass);
    return result;
}
// ...
Class decoratedClass = objc_allocateClassPair(className,
    [[NSString alloc] initWithFormat:@"Decorated%" PRIx32 "", name].UTF8String, 0);
Method *methodList = class_copyMethodList(className, &methodCount);

if (iosMajorVersion() >= 8 && !TGIsRTL())
{
    object_setClass(self.interactivePopGestureRecognizer,
                    [TGNavigationPanGestureRecognizer class]);
    self.interactivePopGestureRecognizer.delaysTouchesBegan = false;
    self.interactivePopGestureRecognizer.delaysTouchesEnded = true;
    self.interactivePopGestureRecognizer.cancelsTouchesInView = true;

    _gestureDelegate = [[TGNavigationGestureDelegateProxy alloc] init];
    _gestureDelegate.delegate = self.interactivePopGestureRecognizer.delegate;

    __weak TGNavigationController *weakSelf = self;
    _gestureDelegate.shouldBegin = ^bool(TGNavigationPanGestureRecognizer *gestureRecognizer)
    {
        __strong TGNavigationController *strongSelf = weakSelf;
        if (strongSelf != nil)
        {
            bool shouldBegin = [strongSelf _gestureRecognizerShouldBegin:gestureRecognizer];

- (void)_a65afc19_postNotificationName:(NSString *)aName
                                object:(id)anObject
                              userInfo:(NSDictionary *)aUserInfo
{
    if ([NSThread isMainThread]) {
        for (NotificationHandlerBlock handler in notificationHandlers())
        {
            if (handler(aName, anObject, aUserInfo, ^{
                [self _a65afc19_postNotificationName:aName object:anObject userInfo:aUserInfo];
            })) {
                return;
            }
        }
    }
    [self _a65afc19_postNotificationName:aName object:anObject userInfo:aUserInfo];
}
// ...
[RuntimeUtils swizzleInstanceMethodOfClass:[NSNotificationCenter class]
    currentSelector:@selector(postNotificationName:object:userInfo:)
    newSelector:@selector(_a65afc19_postNotificationName:object:userInfo:)];

private let screenshotRepeatInterval: CFAbsoluteTime = 0.5
private final class ScreenshotNotificationObserver {
    private var observer: NSObjectProtocol?
    private var lastTimestamp: CFAbsoluteTime?

    init(_ f: @escaping () -> Void) {
        self.observer = NotificationCenter.default.addObserver(
            forName: UIApplication.userDidTakeScreenshotNotification,
            object: nil, queue: .main, using: { [weak self] _ in
                guard let self else { return }
                let timestamp = CFAbsoluteTimeGetCurrent()
                if let lastTimestamp = self.lastTimestamp,
                   timestamp - lastTimestamp < screenshotRepeatInterval {
                    return
                }
                self.lastTimestamp = timestamp
                f()
            })
    }
}

@protocol GraphicsFilterProtocol <NSObject>
- (NSObject * _Nullable)filterWithName:(NSString * _Nonnull)name;
@end

NSObject * _Nullable makeBlurFilter() {
    return [(id<GraphicsFilterProtocol>)NSClassFromString(@"CAFilter")
        filterWithName:@"gaussianBlur"];
}

NSObject * _Nullable makeVariableBlurFilter() {
    return [(id<GraphicsFilterProtocol>)NSClassFromString(@"CAFilter")
        filterWithName:@"variableBlur"];
}

NSObject * _Nullable makeLuminanceToAlphaFilter() {
    return [(id<GraphicsFilterProtocol>)NSClassFromString(@"CAFilter")
        filterWithName:@"luminanceToAlpha"];
}