前言

iPhone 上启动app都是由dyld调度的，现在我们简单来窥探dyld的究竟。
dyld源码

__dyld_start 开始

app启动前会先加载dyld，然后通过dyld去执行__dyld_start,下面我列下arm的实现

#if __arm__
    .text
    .align 2
__dyld_start:
    mov r8, sp      // save stack pointer
    sub sp, #16     // make room for outgoing parameters
    bic     sp, sp, #15 // force 16-byte alignment

    // call dyldbootstrap::start(app_mh, argc, argv, dyld_mh, &startGlue)
    ldr r0, [r8]    // r0 = mach_header
    ldr r1, [r8, #4]    // r1 = argc
    add r2, r8, #8  // r2 = argv
    adr r3, __dyld_start
    sub r3 ,r3, #0x1000 // r3 = dyld_mh
    add r4, sp, #12
    str r4, [sp, #0]    // [sp] = &startGlue

    bl  __ZN13dyldbootstrap5startEPKN5dyld311MachOLoadedEiPPKcS3_Pm
    ldr r5, [sp, #12]
    cmp r5, #0
    bne Lnew

    // traditional case, clean up stack and jump to result
    add sp, r8, #4  // remove the mach_header argument.
    bx  r0      // jump to the program's entry point

    // LC_MAIN case, set up stack for call to main()
Lnew:   mov lr, r5          // simulate return address into _start in libdyld
    mov r5, r0          // save address of main() for later use
    ldr r0, [r8, #4]        // main param1 = argc
    add r1, r8, #8      // main param2 = argv
    add r2, r1, r0, lsl #2
    add r2, r2, #4      // main param3 = &env[0]
    mov r3, r2
Lapple: ldr r4, [r3]
    add r3, #4
    cmp r4, #0
    bne Lapple          // main param4 = apple
    bx  r5

#endif /* __arm__ */

知道大部分人看汇编不是很懂，不过Apple的开发人员也是写了注释的啊,在这一段我们知道接下来我们会调用到dyldbootstrap::start的方法

//在dyldinitialization.cpp中
uintptr_t start(const dyld3::MachOLoaded* appsMachHeader, int argc, const char* argv[],
                const dyld3::MachOLoaded* dyldsMachHeader, uintptr_t* startGlue)
{

    // Emit kdebug tracepoint to indicate dyld bootstrap has started <rdar://46878536>
    dyld3::kdebug_trace_dyld_marker(DBG_DYLD_TIMING_BOOTSTRAP_START, 0, 0, 0, 0);

    // if kernel had to slide dyld, we need to fix up load sensitive locations
    // we have to do this before using any global variables
    rebaseDyld(dyldsMachHeader);

    // kernel sets up env pointer to be just past end of agv array
    const char** envp = &argv[argc+1];
    
    // kernel sets up apple pointer to be just past end of envp array
    const char** apple = envp;
    while(*apple != NULL) { ++apple; }
    ++apple;

    // set up random value for stack canary
    __guard_setup(apple);

#if DYLD_INITIALIZER_SUPPORT
    // run all C++ initializers inside dyld
    runDyldInitializers(argc, argv, envp, apple);
#endif

    // now that we are done bootstrapping dyld, call dyld's main
    uintptr_t appsSlide = appsMachHeader->getSlide();
    return dyld::_main((macho_header*)appsMachHeader, appsSlide, argc, argv, envp, apple, startGlue);
}

前面都是些准备工作，我们先略过，这的核心其实就是dyld::_main的调用

dyld::_main 分析

第一步：设置app运行的上下文

image.png

static void setContext(const macho_header* mainExecutableMH, int argc, const char* argv[], const char* envp[], const char* apple[])
{
    gLinkContext.loadLibrary            = &libraryLocator;
    gLinkContext.terminationRecorder    = &terminationRecorder;
    gLinkContext.flatExportFinder       = &flatFindExportedSymbol;
    gLinkContext.coalescedExportFinder  = &findCoalescedExportedSymbol;
    gLinkContext.getCoalescedImages     = &getCoalescedImages;
    gLinkContext.undefinedHandler       = &undefinedHandler;
    gLinkContext.getAllMappedRegions    = &getMappedRegions;
    gLinkContext.bindingHandler         = NULL;
    gLinkContext.notifySingle           = &notifySingle;
    gLinkContext.notifyBatch            = &notifyBatch;
    gLinkContext.removeImage            = &removeImage;
    gLinkContext.registerDOFs           = dyld3::Loader::dtraceUserProbesEnabled() ? &registerDOFs : NULL;
    gLinkContext.clearAllDepths         = &clearAllDepths;
    gLinkContext.printAllDepths         = &printAllDepths;
    gLinkContext.imageCount             = &imageCount;
    gLinkContext.setNewProgramVars      = &setNewProgramVars;
    gLinkContext.inSharedCache          = &inSharedCache;
    gLinkContext.setErrorStrings        = &setErrorStrings;
#if SUPPORT_OLD_CRT_INITIALIZATION
    gLinkContext.setRunInitialzersOldWay= &setRunInitialzersOldWay;
#endif
    gLinkContext.findImageContainingAddress = &findImageContainingAddress;
    gLinkContext.addDynamicReference    = &addDynamicReference;
#if SUPPORT_ACCELERATE_TABLES
    gLinkContext.notifySingleFromCache  = &notifySingleFromCache;
    gLinkContext.getPreInitNotifyHandler= &getPreInitNotifyHandler;
    gLinkContext.getBoundBatchHandler   = &getBoundBatchHandler;
#endif
    gLinkContext.bindingOptions         = ImageLoader::kBindingNone;
    gLinkContext.argc                   = argc;
    gLinkContext.argv                   = argv;
    gLinkContext.envp                   = envp;
    gLinkContext.apple                  = apple;
    gLinkContext.progname               = (argv[0] != NULL) ? basename(argv[0]) : "";
    gLinkContext.programVars.mh         = mainExecutableMH;
    gLinkContext.programVars.NXArgcPtr  = &gLinkContext.argc;
    gLinkContext.programVars.NXArgvPtr  = &gLinkContext.argv;
    gLinkContext.programVars.environPtr = &gLinkContext.envp;
    gLinkContext.programVars.__prognamePtr=&gLinkContext.progname;
    gLinkContext.mainExecutable         = NULL;
    gLinkContext.imageSuffix            = NULL;
    gLinkContext.dynamicInterposeArray  = NULL;
    gLinkContext.dynamicInterposeCount  = 0;
    gLinkContext.prebindUsage           = ImageLoader::kUseAllPrebinding;
    gLinkContext.sharedRegionMode       = ImageLoader::kUseSharedRegion;
}

第二步：映射共享缓存

image.png

static void mapSharedCache()
{
    dyld3::SharedCacheOptions opts;
    opts.cacheDirOverride   = sSharedCacheOverrideDir;
    opts.forcePrivate       = (gLinkContext.sharedRegionMode == ImageLoader::kUsePrivateSharedRegion);


#if __x86_64__ && !TARGET_OS_SIMULATOR
    opts.useHaswell         = sHaswell;
#else
    opts.useHaswell         = false;
#endif
    opts.verbose            = gLinkContext.verboseMapping;
    loadDyldCache(opts, &sSharedCacheLoadInfo);

    // update global state
    if ( sSharedCacheLoadInfo.loadAddress != nullptr ) {
        gLinkContext.dyldCache                              = sSharedCacheLoadInfo.loadAddress;
        dyld::gProcessInfo->processDetachedFromSharedRegion = opts.forcePrivate;
        dyld::gProcessInfo->sharedCacheSlide                = sSharedCacheLoadInfo.slide;
        dyld::gProcessInfo->sharedCacheBaseAddress          = (unsigned long)sSharedCacheLoadInfo.loadAddress;
        sSharedCacheLoadInfo.loadAddress->getUUID(dyld::gProcessInfo->sharedCacheUUID);
        dyld3::kdebug_trace_dyld_image(DBG_DYLD_UUID_SHARED_CACHE_A, sSharedCacheLoadInfo.path, (const uuid_t *)&dyld::gProcessInfo->sharedCacheUUID[0], {0,0}, {{ 0, 0 }}, (const mach_header *)sSharedCacheLoadInfo.loadAddress);
    }

//#if __IPHONE_OS_VERSION_MIN_REQUIRED && !TARGET_OS_SIMULATOR
// RAM disk booting does not have shared cache yet
// Don't make lack of a shared cache fatal in that case
//  if ( sSharedCacheLoadInfo.loadAddress == nullptr ) {
//      if ( sSharedCacheLoadInfo.errorMessage != nullptr )
//          halt(sSharedCacheLoadInfo.errorMessage);
//      else
//          halt("error loading dyld shared cache");
//  }
//#endif
}

iOS为了控制ipa包的大小，启用了共享缓存技术;对于一些公共的库(如UIKit,CoreFundation)，每一个手机所有的app其实用的都是一样的，所以没必要多次加载。当app进程启动开始时，dyld首先检查Mach-O和所需的动态库是否存在共享缓存中，如果存在，则直接将共享缓存中的库直接映射到内存中。

第三步：实例化主程序

image.png

// The kernel maps in main executable before dyld gets control.  We need to 
// make an ImageLoader* for the already mapped in main executable.
static ImageLoaderMachO* instantiateFromLoadedImage(const macho_header* mh, uintptr_t slide, const char* path)
{
    // try mach-o loader
    if ( isCompatibleMachO((const uint8_t*)mh, path) ) {
        ImageLoader* image = ImageLoaderMachO::instantiateMainExecutable(mh, slide, path, gLinkContext);
        addImage(image);
        return (ImageLoaderMachO*)image;
    }
    
    throw "main executable not a known format";
}
//....
// create image for main executable
ImageLoader* ImageLoaderMachO::instantiateMainExecutable(const macho_header* mh, uintptr_t slide, const char* path, const LinkContext& context)
{
    //dyld::log("ImageLoader=%ld, ImageLoaderMachO=%ld, ImageLoaderMachOClassic=%ld, ImageLoaderMachOCompressed=%ld\n",
    //  sizeof(ImageLoader), sizeof(ImageLoaderMachO), sizeof(ImageLoaderMachOClassic), sizeof(ImageLoaderMachOCompressed));
    bool compressed;
    unsigned int segCount;
    unsigned int libCount;
    const linkedit_data_command* codeSigCmd;
    const encryption_info_command* encryptCmd;
    sniffLoadCommands(mh, path, false, &compressed, &segCount, &libCount, context, &codeSigCmd, &encryptCmd);
    // instantiate concrete class based on content of load commands
    if ( compressed ) 
        return ImageLoaderMachOCompressed::instantiateMainExecutable(mh, slide, path, segCount, libCount, context);
    else
#if SUPPORT_CLASSIC_MACHO
        return ImageLoaderMachOClassic::instantiateMainExecutable(mh, slide, path, segCount, libCount, context);
#else
        throw "missing LC_DYLD_INFO load command";
#endif
}

这里会根据代码是否压缩过做响应的处理，如果压缩过
ImageLoaderMachOCompressed::instantiateMainExecutable,否则
ImageLoaderMachOClassic::instantiateMainExecutable

第四步：加载插入动态库

image.png

static void loadInsertedDylib(const char* path)
{
    unsigned cacheIndex;
    try {
        LoadContext context;
        context.useSearchPaths      = false;
        context.useFallbackPaths    = false;
        context.useLdLibraryPath    = false;
        context.implicitRPath       = false;
        context.matchByInstallName  = false;
        context.dontLoad            = false;
        context.mustBeBundle        = false;
        context.mustBeDylib         = true;
        context.canBePIE            = false;
        context.origin              = NULL; // can't use @loader_path with DYLD_INSERT_LIBRARIES
        context.rpath               = NULL;
        load(path, context, cacheIndex);
    }
    catch (const char* msg) {
        if ( gLinkContext.allowInsertFailures )
            dyld::log("dyld: warning: could not load inserted library '%s' into hardened process because %s\n", path, msg);
        else
            halt(dyld::mkstringf("could not load inserted library '%s' because %s\n", path, msg));
    }
    catch (...) {
        halt(dyld::mkstringf("could not load inserted library '%s'\n", path));
    }
}

第五步：链接主程序

image.png

这里修正符号绑定

第六步：链接插入动态库

image.png

第七步：弱绑定引用主程序

image.png

第八步：初始化主程序

image.png

//第一部分 
void initializeMainExecutable()
{
    // record that we've reached this step
    gLinkContext.startedInitializingMainExecutable = true;

    // run initialzers for any inserted dylibs
    ImageLoader::InitializerTimingList initializerTimes[allImagesCount()];
    initializerTimes[0].count = 0;
    const size_t rootCount = sImageRoots.size();
    if ( rootCount > 1 ) {
        for(size_t i=1; i < rootCount; ++i) {
            sImageRoots[i]->runInitializers(gLinkContext, initializerTimes[0]);
        }
    }
    
    // run initializers for main executable and everything it brings up 
    sMainExecutable->runInitializers(gLinkContext, initializerTimes[0]);
    
    // register cxa_atexit() handler to run static terminators in all loaded images when this process exits
    if ( gLibSystemHelpers != NULL ) 
        (*gLibSystemHelpers->cxa_atexit)(&runAllStaticTerminators, NULL, NULL);

    // dump info if requested
    if ( sEnv.DYLD_PRINT_STATISTICS )
        ImageLoader::printStatistics((unsigned int)allImagesCount(), initializerTimes[0]);
    if ( sEnv.DYLD_PRINT_STATISTICS_DETAILS )
        ImageLoaderMachO::printStatisticsDetails((unsigned int)allImagesCount(), initializerTimes[0]);
}
//...第二部分
void ImageLoader::runInitializers(const LinkContext& context, InitializerTimingList& timingInfo)
{
    uint64_t t1 = mach_absolute_time();
    mach_port_t thisThread = mach_thread_self();
    ImageLoader::UninitedUpwards up;
    up.count = 1;
    up.imagesAndPaths[0] = { this, this->getPath() };
    processInitializers(context, thisThread, timingInfo, up);
    context.notifyBatch(dyld_image_state_initialized, false);
    mach_port_deallocate(mach_task_self(), thisThread);
    uint64_t t2 = mach_absolute_time();
    fgTotalInitTime += (t2 - t1);
}
//...第三部分
void ImageLoader::processInitializers(const LinkContext& context, mach_port_t thisThread,
                                     InitializerTimingList& timingInfo, ImageLoader::UninitedUpwards& images)
{
    uint32_t maxImageCount = context.imageCount()+2;
    ImageLoader::UninitedUpwards upsBuffer[maxImageCount];
    ImageLoader::UninitedUpwards& ups = upsBuffer[0];
    ups.count = 0;
    // Calling recursive init on all images in images list, building a new list of
    // uninitialized upward dependencies.
    for (uintptr_t i=0; i < images.count; ++i) {
        images.imagesAndPaths[i].first->recursiveInitialization(context, thisThread, images.imagesAndPaths[i].second, timingInfo, ups);
    }
    // If any upward dependencies remain, init them.
    if ( ups.count > 0 )
        processInitializers(context, thisThread, timingInfo, ups);
}
//....第四部分
void ImageLoader::recursiveInitialization(const LinkContext& context, mach_port_t this_thread, const char* pathToInitialize,
                                          InitializerTimingList& timingInfo, UninitedUpwards& uninitUps)
{
    recursive_lock lock_info(this_thread);
    recursiveSpinLock(lock_info);

    if ( fState < dyld_image_state_dependents_initialized-1 ) {
        uint8_t oldState = fState;
        // break cycles
        fState = dyld_image_state_dependents_initialized-1;
        try {
            // initialize lower level libraries first
            for(unsigned int i=0; i < libraryCount(); ++i) {
                ImageLoader* dependentImage = libImage(i);
                if ( dependentImage != NULL ) {
                    // don't try to initialize stuff "above" me yet
                    if ( libIsUpward(i) ) {
                        uninitUps.imagesAndPaths[uninitUps.count] = { dependentImage, libPath(i) };
                        uninitUps.count++;
                    }
                    else if ( dependentImage->fDepth >= fDepth ) {
                        dependentImage->recursiveInitialization(context, this_thread, libPath(i), timingInfo, uninitUps);
                    }
                }
            }
            
            // record termination order
            if ( this->needsTermination() )
                context.terminationRecorder(this);

            // let objc know we are about to initialize this image
            uint64_t t1 = mach_absolute_time();
            fState = dyld_image_state_dependents_initialized;
            oldState = fState;
            context.notifySingle(dyld_image_state_dependents_initialized, this, &timingInfo);
            
            // initialize this image
            bool hasInitializers = this->doInitialization(context);

            // let anyone know we finished initializing this image
            fState = dyld_image_state_initialized;
            oldState = fState;
            context.notifySingle(dyld_image_state_initialized, this, NULL);
            
            if ( hasInitializers ) {
                uint64_t t2 = mach_absolute_time();
                timingInfo.addTime(this->getShortName(), t2-t1);
            }
        }
        catch (const char* msg) {
            // this image is not initialized
            fState = oldState;
            recursiveSpinUnLock();
            throw;
        }
    }
    
    recursiveSpinUnLock();
}
//
bool ImageLoaderMachO:doInitialization(const LinkContext& context)
{
    CRSetCrashLogMessage2(this->getPath());

    // mach-o has -init and static initializers
    doImageInit(context);
    doModInitFunctions(context);
    
    CRSetCrashLogMessage2(NULL);
    
    return (fHasDashInit || fHasInitializers);
}

这里我已经将代码调用的重点函数列出来出来

initializeMainExecutable:初始化主程序,内部会调用其他跟镜像rootImage的初始化
runInitializers: 进一步调用processInitializers
processInitializers:递归调用镜像的初始化
recursiveInitialization: 这里会检测一些依赖，并将它初始化，接着开始doInitialization
doInitialization:开始初始化动作,这会进行各个模块的初始化操作_objc_init也是在此进行的

void _objc_init(void)
{
    static bool initialized = false;
    if (initialized) return;
    initialized = true;
    
    // fixme defer initialization until an objc-using image is found?
    environ_init();
    tls_init();
    static_init();
    runtime_init();
    exception_init();
    cache_init();
    _imp_implementationWithBlock_init();

    _dyld_objc_notify_register(&map_images, load_images, unmap_image);

#if __OBJC2__
    didCallDyldNotifyRegister = true;
#endif
}

第九步：通知monitoringDyld，将要进入主 main入口

notifyMonitoringDyldMain();
....
// find entry point for main executable
            result = (uintptr_t)sMainExecutable->getEntryFromLC_MAIN();

第十步：进入main函数

image.png

总结

起点:__dyld_start:
中间_main经过

1、设置app运行的上下文
2、映射共享缓存mapShareCache
3、实例化主程序instantiateFromLoadedImage
4、加载插入动态库loadInsertedDylib
5、链接主程序
6、链接插入动态库
7、弱绑定引用主程序
8、初始化主程序initializeMainExecutable
9、通知monitoringDyld，将要进入主 main入口
10、进入app运行的main函数

iOS app启动 - dyld加载App流程

iOS app启动 - dyld加载App流程

前言

__dyld_start 开始

dyld::_main 分析

第一步：设置app运行的上下文

第二步：映射共享缓存

第三步：实例化主程序

第四步：加载插入动态库

第五步：链接主程序

第六步：链接插入动态库

第七步：弱绑定引用主程序

第八步：初始化主程序

第九步：通知monitoringDyld，将要进入主 main入口

第十步：进入main函数

总结

iOS app启动 - dyld加载App流程

前言

__dyld_start 开始

dyld::_main 分析

第一步 ： 设置app运行的上下文

第二步：映射共享缓存

第三步：实例化主程序

第四步：加载插入动态库

第五步：链接主程序

第六步：链接插入动态库

第七步：弱绑定引用主程序

第八步：初始化主程序

第九步：通知monitoringDyld，将要进入主 main入口

第十步：进入main函数

总结

第一步：设置app运行的上下文