Selecting a correct order of API call sequences is important

In short, ffmpeg changes its API in recent versions. One of them is marking AVStream.codec as deprecated. On other side, a AVCodecParameters * AVStream.codecpar was added for codec information described in the stream. To decode data read from stream correctly, we must create a AVCodecContext through avcodec_alloc_context3(), copy codec information from AVStream.codecpar to this allocated AVCodecContext, and call avcodec_open2() to assign this AVCodecContext to AVCodec found by avcodec_finder_decoder() call.

Here is the point. We must call avcodec_parameters_to_context() to copy codec information to AVCodecContext before we call avcodec_open2() to assign AVCodecContext to AVCodec. If we incorrectly reversed this order, say, called avcodec_open2() before avcodec_parameters_to_context(), we can still decode many videos correctly, but we will encounter strange behavior when we try to play back .mkv or .mp4 files – Each call to decoding function will fail.

A simple shell script integrated to Xcode to generate and copy architecture adaptive dylib in

if [ "$CONFIGURATION" == "Debug" ]; then





for a in $ARCHS; do



lipo "$LIBFFMPEG_DIR/lib/libffmpeg.dylib" $EXTRACT_ARCHS -output "$BUILT_PRODUCTS_DIR/$CONTENTS_FOLDER_PATH/libffmpeg.dylib"

if [ "$CODE_SIGNING_REQUIRED" == "YES" ]; then



install_name_tool -change "libffmpeg.dylib" "@executable_path/libffmpeg.dylib" "$BUILT_PRODUCTS_DIR/$EXECUTABLE_PATH"

Problem again. Assembly generated by clang or written manually, using integrated assembler or not

Simply, clang has an option '--no-integrated-as' so that the compiler invokes apple’s standalone 'as' assembler instead of using clang’s built-in. But, either has its own lost pieces.

  • Without '--no-integrated-as', clang would use its internal assembler. Unfortunately it doesn’t recognize the mnemonic 'ldmltfd'
  • With '--no-integrated-as', apple’s 'as’ assembler reports an error in pesudo instruction '.ios_version_min', which was apparently generated by clang itself.

Therefore I have no choice except for changing 'ldmltfd' to two simple instructions…


Some tricks in passing file descriptors through unix domain socket

Passing file descriptors through unix domain socket is well-known. But there still have some tricks in implementation. I spent one day to deal with it in Mac OS X by digging into xnu source.

  1. How to pass multiple file descriptors in one sendmsg() call?
    Simple. Put all file descriptors one by one after struct cmsghdr.
  2. Can I put multiple struct cmsghdrs with data? I noticed there are CMSG_FIRSTHDR() and CMSG_NXTHDR() defined in <sys/socket.h> 

    No. In xnu sources it checks msghdr.controllen with cmsghdr.cmsg_len. If they are not equal, a -EINVAL returned in sendmsg() call. That means only one cmsghdr can be put into msghdr.

The limitation is in OS X only. I haven’t check Linux and would do it soon or later.

Some license checkpoints in Reveal app.

  1. [IBAAppDelegate applicationDidFinishLaunching:] would call [IBAAppDelegate verifyCodeSignature] to verify code signature of the app to prevent itself from modifications.
  2. [IBATrialModeReminderPresenter shouldShowTrailModeSheet] controls whether trial mode sheet, including quit after trial period expired, would be shown.
  3. [IBAMainWindowController configureTitleBarAccesoryView] will create IBATrialModeReminderTitleBarAccessoryView to shown trial information on window’s title bar.

That’s all.

Make IB designed view work with iCarousel

Oddly, View designed in IB would have FlexibleWidth+FlexibleHeight set in it autoresizingMask, even if you cleared everything in auto resizing box, regardless using AutoLayout or not. The behavior causes that subviews inside item view have wrong positions after transform3D with rotations. In short, item view’s width/height in subviews position/constraints calculation would be calculated as rotated value instead of  preset value, 

The solution is put self.autoresizingMask = 0 to awakeFromNib, easiest? But it took me 1.5 days to find the reason.

Just found 2 issues in apple’s assembler for arm64

1) The classic ‘@‘ comment indicator is not recognized in -arch arm64 mode. Both ‘;‘ and ‘//‘ are permitted. I remembered ‘@‘ was acceptable in armv7 age. So the world changes so fast…

2) As ARM’s instruction reference manual, the instruction ‘movi‘ has a format as

MOVI Vn.<T>, #uimm8{, LSL #shift}

But as reported error if we omitted last part. So to make assembler work, I have to append a ‘LSL #0’ to the end. Feel somewhat stupid, for both the assembler and myself 🙂

objc x86_64 ABI (Call convention)

As I am doing a bit reversing job on OSX, I looked it up and wrote it down here as a backup.

self:  rdi
selector: rsi
arg0: rdx
arg1: rcx
arg2: r8
arg3: r9



Android SurfaceView: can be used for media or direct access, but not for both.

That is, if you have an instance of SurfaceView, you can use it for video/camera, or use it for direct access as a buffer, but you cannot reuse it for media after you already accessed it through either ANativeWindow API or any other internal ways.

The reason is in ASOP code Surface.cpp. Surface connected to CPU if it once got locked, which is a necessary step to access its internal buffer. But it only got disconnected in  destructor. On other side, if you bind the Surface to media, it checks the connection status and return an error when it found it has already been connected to CPU.

So, if you need a SurfaceView for both purpose, you have to destroy the old, assuming it is for direct access, and create a new one for media.

So many traps there…

Simply, a .so compiled by android ndk r9 gcc 4.6 crashed on loading in function __check_for_sync8_kernelhelper.

After looking up the issue in Google, I found this issue has been reported to Google: Unfortunately no solution at present.

Basically it is an libgcc issue depending on linux kernel version. Lower kernel version lacks the symbol that libgcc in 4.6 or higher needs. For example, the Galaxy Nexus I am just testing app on.



1) Avoid using 64bit atomic operation built in gcc, if you can control everything in your codes.

2) Using gcc 4.4.3. For ndk r9 there is a legacy toolchain package in a separated download link.