Traversing All Private Properties and Private Methods in a Class

Why Traverse Private Properties and Methods

In iOS development, many UIKit components have properties and methods not exposed in public header files. For example, UITextField’s placeholder — the public placeholder property only changes the text content, not the color or font. But internally, it actually has a _placeholderLabel member variable, and with KVC, you can directly set its font and color.

Another common scenario is debugging and reverse engineering. When you inherit an undocumented legacy project and need to figure out what properties and methods a class has, traversing with the Runtime prints everything clearly to the console — no source code hunting required.

Core API: Getting the Private Member Variable List

The Runtime provides class_copyIvarList to get all member variables of a class, including those declared publicly in .h, privately in .m, and the underscored variables automatically generated by @property.

#import <objc/runtime.h>

- (void)printAllIvars {
    unsigned int count = 0;
    Ivar *ivars = class_copyIvarList([UITextField class], &count);

    for (unsigned int i = 0; i < count; i++) {
        Ivar ivar = ivars[i];
        const char *name = ivar_getName(ivar);
        const char *type = ivar_getTypeEncoding(ivar);
        NSLog(@"ivar: %s, type: %s", name, type);
    }

    free(ivars);  // Must manually free
}

Printing UITextField’s member variables reveals a bunch of private variables like _placeholderLabel, _clearButton, and more. These aren’t documented anywhere, but they exist. Once you have the variable name, you can use KVC’s setValue:forKeyPath: to directly modify them.

UITextField *textField = [[UITextField alloc] init];
textField.placeholder = @"Enter username";
[textField setValue:[UIFont systemFontOfSize:15] forKeyPath:@"_placeholderLabel.font"];
[textField setValue:[UIColor lightGrayColor] forKeyPath:@"_placeholderLabel.textColor"];

Core API: Getting the Private Method List

class_copyMethodList gets all instance methods of a class, whether or not they’re declared in the .h file. As long as they’re implemented in the .m, they’ll be traversed.

- (void)printAllMethods {
    unsigned int count = 0;
    Method *methods = class_copyMethodList([UITextField class], &count);

    for (unsigned int i = 0; i < count; i++) {
        Method method = methods[i];
        SEL sel = method_getName(method);
        const char *name = sel_getName(sel);
        const char *type = method_getTypeEncoding(method);
        NSLog(@"method: %s, type: %s", name, type);
    }

    free(methods);
}

The output includes all methods implemented in .m — private methods, setters/getters, and even the auto-generated .cxx_destruct destructor method.

The Difference Between Private Properties and Private Methods

There’s a key distinction between these APIs: class_copyIvarList gets member variables, including the _xxx storage variables behind properties. class_copyPropertyList gets properties — only those declared with @property. If a class directly declares NSString *name as a plain member variable, it won’t appear in the property list, but it will appear in the member variable list.

Private methods are more complex. In Objective-C, methods are split into “declaration” and “implementation.” Even if a method isn’t declared in .h, as long as it’s implemented in .m, class_copyMethodList will find it. If a method is only declared but not implemented, it doesn’t actually exist yet, and the Runtime won’t find it.

Traversing Superclass Properties and Methods

class_copyIvarList and class_copyMethodList only return members of the current class — they don’t include the superclass. To traverse the entire inheritance chain, you need to manually loop upward with a while loop.

- (void)printAllIvarsWithSuperclass {
    Class cls = [UITextField class];
    while (cls && cls != [NSObject class]) {
        unsigned int count = 0;
        Ivar *ivars = class_copyIvarList(cls, &count);
        for (unsigned int i = 0; i < count; i++) {
            Ivar ivar = ivars[i];
            const char *name = ivar_getName(ivar);
            const char *type = ivar_getTypeEncoding(ivar);
            NSLog(@"class: %@, ivar: %s, type: %s", NSStringFromClass(cls), name, type);
        }
        free(ivars);
        cls = [cls superclass];
    }
}