UIImagePickController打開(kāi)閃光模式拍照瞬間鎖屏crash

  • 復(fù)現(xiàn)步驟：
    在UIImagePickController拍照頁(yè)面開(kāi)啟閃光模式，在拍照的瞬間點(diǎn)擊鎖屏按鈕，App重回前臺(tái)后拍出來(lái)的照片一片漆黑，這時(shí)點(diǎn)擊”使用照片”會(huì)crash。
美團(tuán).gif
微信.gif

  • 系統(tǒng) < iOS 10

  • 原因：NSMutableDictionary setObject是參數(shù)傳nil導(dǎo)致的。

    注意：當(dāng)UIImagePickController的allowEditing屬性為YES的時(shí)候不會(huì)crash。

  • 解決方案：hook底層拍照處理API，當(dāng)發(fā)現(xiàn)拍出來(lái)的照片為空時(shí)手動(dòng)生成一張空白圖片。

通過(guò)Hopper查看產(chǎn)生這個(gè)問(wèn)題有兩處可能返回nil的調(diào)用，

    1. -[PLPhotoTileViewController _newOriginalImageForPickerFromCachedData]; OC方法
void * -[PLPhotoTileViewController _newOriginalImageForPickerFromCachedData](void * self, void * _cmd) {
       rbx = self;
       rax = [self unscaledImage];
       if (rax == 0x0) {
               rax = [rbx image];
       }
       rax = _NewUIImageFromCachedImage(rax);
       return rax;
}
    1. int _CreateImageDataFromJPEGDataAndOrientation(int arg0, int arg1); C函數(shù)
   int _CreateImageDataFromJPEGDataAndOrientation(int arg0, int arg1) {
       rbx = PLExifOrientationFromImageOrientation(arg1, arg1);
       r15 = [NSDictionary alloc];
       rdx = [NSNumber numberWithInt:rbx];
       rbx = [r15 initWithObjectsAndKeys:rdx];
       r14 = CGImageCreateEXIFJPEGData(0x0, arg0, 0x0, rbx);
       [rbx release];
       rax = r14;
       return rax;
}

我們利用fishhook來(lái)對(duì)C函數(shù)進(jìn)行hook。

  • Code:
#import <fishhook/fishhook.h>
#import <objc/runtime.h>

#if __has_feature(objc_arc)
#error This file must be compiled with MRC. Use -fno-objc-arc flag (or convert project to MRC).
#endif

typedef id (*ImageDataIMP)(id, SEL, ...);

static CGImageRef (*orig_createImageData)(NSData *data, UIImageOrientation orientation);
UIImage *createBlankImage();

CGImageRef new_createImageData(NSData *arg0, UIImageOrientation arg1)
{
    CGImageRef imageRef = orig_createImageData(arg0, arg1);
    if (imageRef == NULL) {
        UIImage *image = createBlankImage();
        imageRef = CGImageRetain(image.CGImage);
        [image release];
    }
    return imageRef;
}


NSString *originCreateImageDataFromJPEGDataAndOrientationFuncKey()
{
    //CreateImageDataFromJPEGDataAndOrientation
    static NSString *key;
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        key = [[NSString alloc] initWithData:[NSData dataWithBytes:(unsigned char [])
                                              {0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x44, 0x61, 0x74, 0x61, 0x46, 0x72, 0x6f, 0x6d, 0x4a, 0x50, 0x45, 0x47, 0x44, 0x61, 0x74, 0x61, 0x41, 0x6e, 0x64, 0x4f, 0x72, 0x69, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e} length:41]
                                    encoding:NSASCIIStringEncoding];
    });
    return key;
}

NSString *originalImageForPickerFromCachedDataSELKey()
{
    //_newOriginalImageForPickerFromCachedData
    static NSString *key;
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        key = [[NSString alloc] initWithData:[NSData dataWithBytes:(unsigned char [])
                                              {0x5f, 0x6e, 0x65, 0x77, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x49, 0x6d, 0x61,
                                                  0x67, 0x65, 0x46, 0x6f, 0x72, 0x50, 0x69, 0x63, 0x6b, 0x65, 0x72, 0x46, 0x72, 0x6f,
                                                  0x6d, 0x43, 0x61, 0x63, 0x68, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61} length:40]
                                    encoding:NSASCIIStringEncoding];
    });
    return key;
}

@implementation UIImagePickerController (DEFImagePickerControllerCrashFix)

+ (void)load
{
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        
        //先手動(dòng)加載私有framework，否則取不到私有類(lèi)
        NSBundle *photoLibraryBundle = [NSBundle bundleWithPath:@"/System/Library/PrivateFrameworks/PhotoLibrary.framework"];
        if (![photoLibraryBundle load]) {
            return;
        }
        
        //PLPhotoTileViewController
        NSString *photoTileControllerKey = [[NSString alloc] initWithData:[NSData dataWithBytes:(unsigned char [])
                                                                           {0x50, 0x4c, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x54, 0x69,
                                                                               0x6c, 0x65, 0x56, 0x69, 0x65, 0x77, 0x43, 0x6f, 0x6e, 0x74,
                                                                               0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72} length:25] encoding:NSASCIIStringEncoding];
        
        Class originCls = NSClassFromString(photoTileControllerKey);
        [photoTileControllerKey release];
        Class overridedCls = self;
        
        SEL originalSelector = NSSelectorFromString(originalImageForPickerFromCachedDataSELKey());
        SEL overrideSelector = @selector(p_newOriginalImageForPickerFromCachedData);
        
        Method originalMethod = class_getInstanceMethod(originCls, originalSelector);
        Method overrideMethod = class_getInstanceMethod(overridedCls, overrideSelector);
        
        BOOL success = class_addMethod(originCls, originalSelector, method_getImplementation(overrideMethod), method_getTypeEncoding(overrideMethod));
        if (success) {
            class_replaceMethod(overridedCls, overrideSelector, method_getImplementation(originalMethod), method_getTypeEncoding(originalMethod));
        } else {
            method_exchangeImplementations(originalMethod, overrideMethod);
        }
        
        rebind_symbols((struct rebinding[1]){originCreateImageDataFromJPEGDataAndOrientationFuncKey().UTF8String, new_createImageData, (void *)&orig_createImageData}, 1);
    });
}

- (id)p_newOriginalImageForPickerFromCachedData
{
    SEL originalSelector = @selector(p_newOriginalImageForPickerFromCachedData);
    Method method = class_getInstanceMethod([UIImagePickerController class], originalSelector);
    ImageDataIMP imp = (ImageDataIMP)method_getImplementation(method);
    UIImage *image = imp(self, _cmd);
    if (!image) {
        //如果沒(méi)有生成照片，返回一張空白圖片，防止crash
        image = createBlankImage();
    }
    return image;
}

@end

//生成一張黑色圖片
UIImage *createBlankImage()
{
    UIBezierPath *bezierPath = [UIBezierPath bezierPathWithRect:[[UIScreen mainScreen] bounds]];
    UIImage *blackImage = [UIImage p_imageWithColor:[UIColor blackColor] path:bezierPath];
    CGImageRef imageRef = blackImage.CGImage;
    UIImage *drawImage = [[UIImage alloc] initWithCGImage:imageRef
                                                    scale:[UIScreen mainScreen].scale
                                              orientation:UIImageOrientationUp];
    return drawImage;
}

@interface UIImage (PickerBlankImage)
+ (UIImage *)p_imageWithColor:(UIColor *)color path:(UIBezierPath *)path;
@end

@implementation UIImage (PickerBlankImage)

+ (UIImage *)p_imageWithColor:(UIColor *)color path:(UIBezierPath *)path
{
    CGRect rect = CGRectMake(0, 0, 3, 3);
    if (path) {
        rect = path.bounds;
    }
    UIGraphicsBeginImageContextWithOptions(rect.size, NO, 0);
    CGContextRef context = UIGraphicsGetCurrentContext();
    CGContextSetFillColorWithColor(context, [color CGColor]);
    if (path) {
        [path fill];
    } else {
        CGContextFillRect(context, rect);
    }
    UIImage *image = UIGraphicsGetImageFromCurrentImageContext();
    UIGraphicsEndImageContext();
    return image;
}

@end
最后編輯于 ：
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成，瀏覽時(shí)請(qǐng)結(jié)合常識(shí)與多方信息審慎甄別。
平臺(tái)聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀(guān)點(diǎn)，簡(jiǎn)書(shū)系信息發(fā)布平臺(tái)，僅提供信息存儲(chǔ)服務(wù)。

相關(guān)閱讀更多精彩內(nèi)容

友情鏈接更多精彩內(nèi)容