MOVW R1, #(:lower16:(selRef_performActionForItem_offer_clientContext_completionBlock_ - 0x347314CA))
ADD R3, SP, #0x50+var_40
MOVT.W R1, #(:upper16:(selRef_performActionForItem_offer_clientContext_completionBlock_ - 0x347314CA))
STR R0, [SP,#0x50+var_1C]
ADD R1, PC ; selRef_performActionForItem_offer_clientContext_completionBlock_
STR.W R10, [SP,#0x50+var_50]
STR R3, [SP,#0x50+var_4C]
MOV R0, R6
LDR R4, [SP,#0x50+var_44]
MOV R3, R11
LDR R1, [R1] ; "performActionForItem:offer:clientContex"...
MOV R2, R4
BLX _objc_msgSend
比如最后一步，我查看了r0, r1, r2和r3都没有问题。
(lldb) po $r0
<SKUIItemStateCenter: 0x14d05580>
(lldb) po $r2
<SKUISearchItem: 0x160955a0>
(lldb) po $r3
<SKUIItemOffer: 0x16095030>
(lldb) p (char*) $r1
(char *) $60 = 0x3484fd8d "performActionForItem:offer:clientContext:completionBlock:"
(lldb) x/10 $sp
0x27d74028: 0x14d44df0 0x27d74038 0x14fa2130 0x160955a0
0x27d74038: 0x3a03305c 0xc2000000 0x00000000 0x34838525
0x27d74048: 0x39a22cf0 0x37d2d305
(lldb) po 0x27d74038
<__NSStackBlock__: 0x27d74038>
我使用了这个方法，但死活都不行http://iosre.com/t/dispatch-async-queue-block-block/1234。
(lldb) x/10 0x27d74038
0x27d74038: 0x3a03305c 0xc2000000 0x00000000 0x34838525
0x27d74048: 0x39a22cf0 0x37d2d305 0x3a5c2ec5 0x00000000
0x27d74058: 0x14f73dc0 0x14fa2130
(lldb) p (char*) 0x34838525
(char *) $65 = 0x34838525 "?\x03?\x89?\x06F\bF\x02??FK?8??"P??#xD\x01h F\x02?r??F\x02??F??E??"??R@?s
(lldb) p (char*) 0x34731525 《=====减去随机偏移后的地址
(char *) $66 = 0x34731525 "D\x01h F\t???F\t??F\t?? F\t??
(lldb)