深度递归查找子view，修改其属性：
you are not prevented from modifying a view that is part of a uikit object, you just need to do it publicly. the <code>[uiview subviews]</code>method is public, and you can use this to dig through the view hierarchy looking for a private view to change, no private method calls required
1. [uiview subviews]
调用此方法获取一个subview
2.[[subview class] description]
我们无法直接使用私有类的声明，但是我们可以用[[subview class] description]来获取class的信息。
<code>[[[subview class] description] isequaltostring:@”uishadowview”]</code>
you don’t have a class declaration for the private classes, but that’s fine, instead you can evaluate that it is correct based on class string description, [[[subview class] description] isequaltostring:@”uishadowview”]
you can use a tool like class-dump or a private class reference to see every objective-c method each class in ios has – the truth is nothing in objective-c is truly ‘private’, you can see any method compiled into the binary.
我们可以用class-dump o 或者 private class reference这些工具看到ios中所有class的方法.但是私有头api会随时下掉，所以建议用
<code>respondstoselector:</code> 和 <code>performselector:</code>来检查一下该方法是否可以用
如何访问类中私有变量？
比如下面，[xxxx valueforkey:@”_internal”] 可以返回 private变量 _internal 。
但是如果，我们 请求的变量不存在（根据我们输入的key值没有找到相应的value），程序会 crash。为了防止这种情况，我们可以在 nsobject的categorise中或者 写一个子类继承该类，并重写valueforundefinedkey方法。
我们有时候改变只读属性的实例变量的值，就可以这样用。我之前试过
<a href="http://blog.csdn.net/yiyaaixuexi/article/details/9374411" target="_blank">method swizzling</a>
<a href="http://b2cloud.com.au/how-to-guides/method-swizzling-to-override-in-a-category/" target="_blank">method swizzling</a>
method swizzling lets you inject code in the middle of two existing classes, which can be a lot more beneficial compared to a subclass that will only add your code on top of one class that must be subclassed.
<a href="http://b2cloud.com.au/how-to-guides/method-swizzling-to-override-in-a-category/" target="_blank">example</a>
私有枚举变量，本质上就是一些数字。比如下面的例子，返回的按钮uibuttontype的值是101, 私有不公开。我们可以直接设置：
image
one half of objective-c is pure c, and with that all the tricks to incorporate private c apis into your app, such as defining external functions。
例子：截屏并保存图片
重写私有方法和类，并不会让app被app store拒绝，但是你的app会变的不稳定。每次版本更新，都需要去检查，你的方法或者类是否正常工作。我们可以重写public或者private 类的私有方法。如果是私有类，直接重写会导致编译错误，但是你可以为它添加一个fake interface,categorise.
例子：重写uistatusbar类
<a href="http://chenjohney.blog.51cto.com/4132124/1288551" target="_blank">private framework使用</a>
<a href="http://bbs.pediy.com/archive/index.php?t-166792.html" target="_blank">dylib注射</a>
<a href="http://blog.csdn.net/xunyn/article/details/8441512" target="_blank">获取私有api</a>
<a href="http://www.zhihu.com/question/20317296" target="_blank">ios逆向工程</a>