深度遞歸查找子view，修改其屬性：
you are not prevented from modifying a view that is part of a uikit object, you just need to do it publicly. the <code>[uiview subviews]</code>method is public, and you can use this to dig through the view hierarchy looking for a private view to change, no private method calls required
1. [uiview subviews]
調用此方法擷取一個subview
2.[[subview class] description]
我們無法直接使用私有類的聲明，但是我們可以用[[subview class] description]來擷取class的資訊。
<code>[[[subview class] description] isequaltostring:@”uishadowview”]</code>
you don’t have a class declaration for the private classes, but that’s fine, instead you can evaluate that it is correct based on class string description, [[[subview class] description] isequaltostring:@”uishadowview”]
you can use a tool like class-dump or a private class reference to see every objective-c method each class in ios has – the truth is nothing in objective-c is truly ‘private’, you can see any method compiled into the binary.
我們可以用class-dump o 或者 private class reference這些工具看到ios中所有class的方法.但是私有頭api會随時下掉，是以建議用
<code>respondstoselector:</code> 和 <code>performselector:</code>來檢查一下該方法是否可以用
如何通路類中私有變量？
比如下面，[xxxx valueforkey:@”_internal”] 可以傳回 private變量 _internal 。
但是如果，我們 請求的變量不存在（根據我們輸入的key值沒有找到相應的value），程式會 crash。為了防止這種情況，我們可以在 nsobject的categorise中或者 寫一個子類繼承該類，并重寫valueforundefinedkey方法。
我們有時候改變隻讀屬性的執行個體變量的值，就可以這樣用。我之前試過
<a href="http://blog.csdn.net/yiyaaixuexi/article/details/9374411" target="_blank">method swizzling</a>
<a href="http://b2cloud.com.au/how-to-guides/method-swizzling-to-override-in-a-category/" target="_blank">method swizzling</a>
method swizzling lets you inject code in the middle of two existing classes, which can be a lot more beneficial compared to a subclass that will only add your code on top of one class that must be subclassed.
<a href="http://b2cloud.com.au/how-to-guides/method-swizzling-to-override-in-a-category/" target="_blank">example</a>
私有枚舉變量，本質上就是一些數字。比如下面的例子，傳回的按鈕uibuttontype的值是101, 私有不公開。我們可以直接設定：
image
one half of objective-c is pure c, and with that all the tricks to incorporate private c apis into your app, such as defining external functions。
例子：截屏并儲存圖檔
重寫私有方法和類，并不會讓app被app store拒絕，但是你的app會變的不穩定。每次版本更新，都需要去檢查，你的方法或者類是否正常工作。我們可以重寫public或者private 類的私有方法。如果是私有類，直接重寫會導緻編譯錯誤，但是你可以為它添加一個fake interface,categorise.
例子：重寫uistatusbar類
<a href="http://chenjohney.blog.51cto.com/4132124/1288551" target="_blank">private framework使用</a>
<a href="http://bbs.pediy.com/archive/index.php?t-166792.html" target="_blank">dylib注射</a>
<a href="http://blog.csdn.net/xunyn/article/details/8441512" target="_blank">擷取私有api</a>
<a href="http://www.zhihu.com/question/20317296" target="_blank">ios逆向工程</a>