从UI入手：
广告为tableviewcell，所以拿到UITableView的dataSource就能找到包含该数据源代理的viewcontroller，如上图为NewsListVCSHAndSZ
观察该类的方法：
@interface NewsListVCSHAndSZ : NewsListViewController
{
}
- (id)getNewsListUrlString;
- (id)getStockCodeForRequest;
@end
只有两条，没有看到明显的方法或属性，可能在它父类里面，观察父类的属性或方法：
@interface NewsListViewController : HXStockInfoPageBaseVC <UITableViewDelegate, UITableViewDataSource, NewsInfoDefaultNewCellDelegate>
{
_Bool _isLoadingMore;
_Bool _noMoreData;
_Bool _isNeedSendLoadBehavoir;
_Bool _isNewsListSHHJClass;
NSString *_newsUrlString;
long long _currentPage;
HXFooterLoadingView *_showNextBtn;
NSString *_curStockCode;
UITableView *_tableView;
UIView *_footView;
NSMutableArray *_dataArray;
UILabel *_loadingLabel;
NSDate *_lastRequestDate;
NSString *_labelUrl;
NSString *_nextPageUrl;
}
@property(copy, nonatomic) NSString *nextPageUrl;
@property(retain, nonatomic) NSString *labelUrl;
@property(nonatomic) _Bool isNewsListSHHJClass;
@property(retain, nonatomic) NSDate *lastRequestDate;
@property(retain, nonatomic) UILabel *loadingLabel;
@property(nonatomic) _Bool isNeedSendLoadBehavoir;
@property(nonatomic) _Bool noMoreData;
@property(nonatomic) _Bool isLoadingMore;
@property(retain, nonatomic) NSMutableArray *dataArray;
@property(retain, nonatomic) UIView *footView;
@property(retain, nonatomic) UITableView *tableView;
@property(retain, nonatomic) NSString *curStockCode;
@property(retain, nonatomic) HXFooterLoadingView *showNextBtn;
@property(nonatomic) long long currentPage;
@property(retain, nonatomic) NSString *newsUrlString;
。。。。。。。。。。
可以看到有个明显的属性NSMutableArray *dataArray，很有可能就是包含cell数据的可变数组，这里只看头文件已经看不出名堂了。
动态调试：
用xia0lldb脚本打印出类的各个方法的地址
(lldb) methods NewsListViewController
<NewsListViewController: 0x10491b908>:
in NewsListViewController:
Properties:
@property (retain, nonatomic) HXFooterLoadingView* showNextBtn; (@synthesize showNextBtn = _showNextBtn;)
@property (retain, nonatomic) NSString* curStockCode; (@synthesize curStockCode = _curStockCode;)
@property (retain, nonatomic) UITableView* tableView; (@synthesize tableView = _tableView;)
@property (retain, nonatomic) UIView* footView; (@synthesize footView = _footView;)
@property (retain, nonatomic) NSMutableArray* dataArray; (@synthesize dataArray = _dataArray;)
。。。。。。
- (void) setIsNeedSendLoadBehavoir:(BOOL)arg1; (0x101476cfc)
- (void) themeChanged; (0x101476aa0)
- (void) setDataArray:(id)arg1; (0x101476c98)
我需要知道dataArray里面有哪些数据，所以可以对它下个断点
(lldb) b 0x101476c98
Breakpoint 1: where = IHexin`___lldb_unnamed_symbol78742$$IHexin, address = 0x0000000101476c98
(lldb) c
Process 5544 resuming
Process 5544 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
frame #0: 0x0000000101476c98 IHexin`___lldb_unnamed_symbol78742$$IHexin
IHexin`___lldb_unnamed_symbol78742$$IHexin:
-> 0x101476c98 <+0>: mov x1, x2
0x101476c9c <+4>: adrp x8, 13394
0x101476ca0 <+8>: ldrsw x8, [x8, #0x404]
0x101476ca4 <+12>: add x0, x0, x8
0x101476ca8 <+16>: b 0x10338e0ec ; symbol stub for: objc_storeStrong
IHexin`___lldb_unnamed_symbol78743$$IHexin:
0x101476cac <+0>: adrp x8, 13394
0x101476cb0 <+4>: ldrsw x8, [x8, #0x408]
0x101476cb4 <+8>: ldrb w0, [x0, x8]
Target 0: (IHexin) stopped.
(lldb) x/s $x1
0x108336aa1: "setDataArray:"
(lldb) po $x2
<__NSArrayM 0x171a51ee0>(
<NewsListCellFrameModel: 0x1745eb700>,
<NewsListCellFrameModel: 0x1743f7100>,
<NewsListCellFrameModel: 0x1707e2700>,
<NewsListCellFrameModel: 0x1707e2100>,
<NewsListCellFrameModel: 0x1707e2f00>,
<NewsListCellFrameModel: 0x1707e1f00>,
<NewsListCellFrameModel: 0x1745f4c00>,
<NewsListCellFrameModel: 0x1745f4900>,
<NewsListCellFrameModel: 0x1745f6400>,
<NewsListCellFrameModel: 0x1745f6500>,
<NewsListCellFrameModel: 0x1745ef400>,
<NewsListCellFrameModel: 0x1707e2200>,
<NewsListCellFrameModel: 0x1745f8500>,
<NewsListCellFrameModel: 0x1705fd300>,
<NewsListCellFrameModel: 0x1745eeb00>,
<NewsListCellFrameModel: 0x1705fd000>,
<NewsListCellFrameModel: 0x1705fd200>,
<NewsListCellFrameModel: 0x1705eda00>,
<NewsListCellFrameModel: 0x1707e7d00>,
<NewsListCellFrameModel: 0x1707e7f00>
)
可以看到数组里面放的都是叫做NewsListCellFrameModel的对象，而且长得都一样。c一下，看手机上的广告在第五个位置，所以可以打印它的实例变量看看
(lldb) ivars 0x1707e2f00
<NewsListCellFrameModel: 0x1707e2f00>:
in NewsListCellFrameModel:
_newsInfo (NewsInfoNewModel*): <NewsInfoNewModel: 0x1746f5900>
_cellHeight (double): 74
_titleFrame (struct CGRect): {{15, 15}, {290, 18}}
_propertyFrame (struct CGRect): {{15, 37}, {28.504000000000001, 20}}
_circleFrame (struct CGRect): {{0, 0}, {0, 0}}
_soureFrame (struct CGRect): {{48.504000000000005, 37}, {110.26799999999999, 20}}
_dateFrame (struct CGRect): {{167.77199999999999, 37}, {31.921875, 20}}
_article1Frame (struct CGRect): {{0, 0}, {0, 0}}
_article2Frame (struct CGRect): {{0, 0}, {0, 0}}
in NSObject:
isa (Class): NewsListCellFrameModel (isa, 0x21a10495e0cd)
还是没有直接看到广告的内容，但是看到有个叫做_newsInfo (NewsInfoNewModel*)的变量，这个应该包含了广告的内容，也只能是这个了。继续打印它的变量：
(lldb) ivars 0x1746f5900
<NewsInfoNewModel: 0x1746f5900>:
in NewsInfoNewModel:
_isReaded (BOOL): NO
_seq (NSString*): @"623556263"
。。。。。。。。
_label_type (NSString*): @"推广"
_label_property (NSString*): @""
_label_article (NSString*): @""
_titleLayout (YYTextLayout*): <YYTextLayout: 0x17039e780>
_label_article_ids (NSMutableArray*): <__NSArrayM: 0x1750497b0>
_label_article_titles (NSMutableArray*): <__NSArrayM: 0x175048fd0>
_ctimeString (NSString*): @"09:10"
in NSObject:
isa (Class): NewsInfoNewModel (isa, 0x1a10495e02d)
这回很清楚的看到这个广告的内容，再回去看下另一个非广告内容的ivars
(lldb) ivars 0x1746eec00
<NewsInfoNewModel: 0x1746eec00>:
in NewsInfoNewModel:
_isReaded (BOOL): NO
_seq (NSString*): @"27016301"
。。。。。。。。
_label_type (NSString*): @"公告"
_label_property (NSString*): @""
_label_article (NSString*): @""
_titleLayout (YYTextLayout*): <YYTextLayout: 0x174185140>
_label_article_ids (NSMutableArray*): <__NSArrayM: 0x1750490f0>
_label_article_titles (NSMutableArray*): <__NSArrayM: 0x175049f30>
_ctimeString (NSString*): @"09-14"
in NSObject:
isa (Class): NewsInfoNewModel (isa, 0x1a10495e02d)
编写插件
在广告的内容中，它的label_type一定显示为“推广”，那么思路就有了，对最开始找到的dataArray搞事情，对它里面的NewsListCellFrameModel对象的属性newsInfo的属性label_type作判断，当它为“推广”时，删掉该NewsListCellFrameModel对象。：
@interface NewsInfoNewModel
{
NSString *_label_type;
}
@property(copy, nonatomic) NSString *label_type;
@end
@interface NewsListViewController
@property(retain, nonatomic) NSMutableArray *dataArray;
@end
@interface NewsListCellFrameModel
@property(retain, nonatomic) NewsInfoNewModel *newsInfo;
@end
%hook NewsListViewController
- (NSMutableArray *)dataArray
{
NSMutableArray *origArr = %orig;
NSMutableArray *adArr = [NSMutableArray new];
if(origArr.count > 0)
for(NewsListCellFrameModel *model in origArr)
{
if([MSHookIvar<NSString *>(model.newsInfo, "_label_type") isEqualToString:@"推广"])
[adArr addObject:model];
}
if(adArr.count > 0)
[origArr removeObjectsInArray:adArr];
return origArr;
}
%end