iOS Simulator里应用是跑在32bits模式下的(在Activity Monitor可以看到)，依据<<Mac OS Debug Magic>>里关于Intel 32bits参数传递的定义:

What	GDB Syntax
return address	*(int*)$esp
first parameter	*(int*)($esp+4)
second parameter	*(int*)($esp+8)
... and so on

如果已经进入到函数体，也就是过函数参数处理部分(开场位置, prologue), 参数就要到调用帧寄存器(frame register)ebp中去获取了。

Table 3 : Accessing parameters after the prologue

What	GDB Syntax
previous frame	*(int*)$ebp
return address	*(int*)($ebp+4)
first parameter	*(int*)($ebp+8)
second parameter	*(int*)($ebp+12)
... and so on

返回值存放在EAX寄存器中。

当在汇编语言下调试Cocoa代码，请记住以下运行时特性：

• The Objective-C compiler adds two implicit parameters to each method, the first of which is a pointer to the object being called (self).

• The second implicit parameter is the method selector (_cmd). In Objective-C this is of type SEL; in GDB you can print this as a C string.

• The Objective-C runtime dispatches methods via a family of C function. The most commonly seen is objc_msgSend, but some architectures use objc_msgSend_stret for methods which returns structures, and some architectures useobjc_msgSend_fpret for methods that return floating point values. There are also equivalent functions for calling super (objc_msgSendSuper and so on).

• The first word of any Objective-C object (the isa field) is a pointer to the object's class.

再调用一个检查一下句柄:

这样就可以调用其它方法进行操作了。

再次验证一下第二个参数:

0x04e7aae0: NULL

用一个检查UIView层次的实例来展示它的强大:

   |    | <UIView: 0x718d150; frame = (0 0; 0 0); layer = <CALayer: 0x719f650>>

*如果是C++, 则第一个参数就是this，所以也很方便查。而函数返回值放在EAX中，在ret位置设个断点，也可以很方便查看。

*这个调试过程最好使用LLDB, 它对Objective-C的支持要好很多。

Reference:

  iOS Debug Magic

  Mac OS Debug Magic