Non-intrusive Function Insertion Based on Runtime

Why Non-intrusive Insertion Matters

There are two main traditional ways to add features. One is through base class inheritance — for example, a BaseViewController that all pages inherit, with tracking code added uniformly. This approach is precise because only pages inheriting the base class get tracked — system controllers like UINavigationController and UIAlertController don’t get mixed in. But the limitation is obvious: you need to design the inheritance hierarchy upfront. For legacy projects or SDKs meant for other teams, it can be challenging.

The other approach uses Runtime for Method Swizzling, directly intercepting system methods. Its advantage is true zero-code intrusion — global coverage without modifying the existing project. The downside is the need for filtering because viewDidAppear: is called by every Controller — you must use blacklists or check the title property to filter out pages that shouldn’t be tracked.

The Underlying Principle of Method Swizzling

The core operation of method swizzling is method_exchangeImplementations, which swaps two methods’ IMPs (function pointers). In the Objective-C runtime, each class maintains a message dispatch table where each entry is a Method containing the mapping between SEL (method name) and IMP (implementation address). Method Swizzling modifies this table so a SEL points to a different IMP.

Here’s a standard method swizzling implementation:

void __gbh_tracer_swizzleMethod(Class class, SEL originalSelector, SEL swizzledSelector) {
    Method originalMethod = class_getInstanceMethod(class, originalSelector);
    Method swizzledMethod = class_getInstanceMethod(class, swizzledSelector);

    BOOL didAddMethod = class_addMethod(class,
                                        originalSelector,
                                        method_getImplementation(swizzledMethod),
                                        method_getTypeEncoding(swizzledMethod));
    if (didAddMethod) {
        class_replaceMethod(class,
                            swizzledSelector,
                            method_getImplementation(originalMethod),
                            method_getTypeEncoding(originalMethod));
    } else {
        method_exchangeImplementations(originalMethod, swizzledMethod);
    }
}

There are a few key points to this approach. Using class_addMethod first checks whether the original method exists. If not, it adds one — preventing the superclass’s implementation from being swapped. If it exists, it swaps directly. This is safer than direct method_exchangeImplementations, especially when the target class doesn’t implement the method, because it won’t affect the superclass or other subclasses.

Executing Swizzling in Category’s +load

Swizzling should be performed in the +load method, wrapped in dispatch_once. +load is called when the class is loaded into memory — early enough, without manual invocation. dispatch_once ensures the swap only executes once, preventing duplicate swaps from multiple threads triggering simultaneously.

Practical Example: Full Page-View Tracking

// UIViewController+Tracker.m
@implementation UIViewController (Tracker)

+ (void)load {
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        __gbh_tracer_swizzleMethod([self class],
                                   @selector(viewDidAppear:),
                                   @selector(__gbh_tracer_viewDidAppear:));
    });
}

- (void)__gbh_tracer_viewDidAppear:(BOOL)animated {
    // This actually calls the original viewDidAppear: (since the methods are swapped)
    [self __gbh_tracer_viewDidAppear:animated];

    // Blacklist filtering: don't track system controllers
    NSArray *filter = @[@"UINavigationController",
                        @"UITabBarController",
                        @"UIAlertController"];
    NSString *className = NSStringFromClass(self.class);
    if ([filter containsObject:className]) {
        return;
    }

    // Only track pages with a title
    if ([self.title isKindOfClass:[NSString class]] && self.title.length > 0) {
        [Tracker uploadPageView:className title:self.title];
    }
}

@end

With this approach, just adding a Category to the project — no changes to any business code — automatically triggers tracking when all UIViewController subclasses appear.

More Complex Scenario: Intercepting UIControl Events

Beyond page lifecycle, user behavior analysis also needs button click tracking. This can also be handled non-intrusively with Runtime — intercept UIControl‘s sendAction:to:forEvent: method and automatically log events when any control is tapped:

+ (void)load {
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        Method original = class_getInstanceMethod([UIControl class],
                                                  @selector(sendAction:to:forEvent:));
        Method swizzled = class_getInstanceMethod([UIControl class],
                                                  @selector(__tracker_sendAction:to:forEvent:));
        method_exchangeImplementations(original, swizzled);
    });
}

- (void)__tracker_sendAction:(SEL)action to:(id)target forEvent:(UIEvent *)event {
    // Call the original method first to ensure business logic executes
    [self __tracker_sendAction:action to:target forEvent:event];

    // Filter system events
    if ([target isKindOfClass:[UIViewController class]]) {
        NSString *eventName = [NSString stringWithFormat:@"click_%@_%@",
                               NSStringFromClass([target class]),
                               NSStringFromSelector(action)];
        [Tracker uploadEvent:eventName];
    }
}

Now all button click events are automatically captured — no manual tracking in each button’s click method.

More Applications of Non-intrusive AOP

Non-intrusive Runtime-based insertion is essentially AOP (Aspect-Oriented Programming) on the iOS platform. It leverages Objective-C’s Runtime and message forwarding mechanisms to insert custom logic before and after method calls without modifying business code.

Beyond tracking, this approach can also be used for logging, performance monitoring, and crash prevention. For example, injecting JavaScript into UIWebView delegate methods to capture frontend errors, or adding timing to network request methods. Some mature APM (Application Performance Monitoring) SDKs are also based on similar principles — non-intrusively integrating to automatically perform crash analysis, lag monitoring, and network analysis.

Important Considerations

Be careful when calling the swizzled method from within itself. Since methods are swapped, calling [self __tracker_sendAction:to:forEvent:] inside __tracker_sendAction:to:forEvent: actually executes the original method — no recursion.

Several principles must be followed: use dispatch_once to ensure it only executes once, execute it as early as possible in +load, and ensure method signatures match. Method swizzling modifies global state — even a small mistake can cause hard-to-debug issues. If both a Category and the main class implement the same method, the Category overrides the main class — consistent with the Runtime’s message forwarding logic.

Runtime-based AOP is a powerful capability in iOS development. Used well, it’s black magic. Used poorly, it’s a ticking time bomb. The key is knowing where non-intrusive insertion is needed, and writing it with careful consideration.