1.获取参数的类型
调用对象的class方法，如：[arg3 class]

2.替换返回值中的数据

NSString *new_arg3 = @"new_string";
id ret = %orig(arg1,arg2,new_arg3);

3.hook系统函数tweak模块

#include "substrate.h"
#import <CommonCrypto/CommonCryptor.h>


// Hook CCCrypt()
static CCCryptorStatus (*original_CCCrypt)(
    CCOperation op,
    CCAlgorithm alg,
    CCOptions options,
    const void *key,
    size_t keyLength,
    const void *iv,
    const void *dataIn,
    size_t dataInLength,
    void *dataOut,
    size_t dataOutAvailable,
    size_t *dataOutMoved);

static CCCryptorStatus replaced_CCCrypt(
    CCOperation op,
    CCAlgorithm alg,
    CCOptions options,
    const void *key,
    size_t keyLength,
    const void *iv,
    const void *dataIn,
    size_t dataInLength,
    void *dataOut,
    size_t dataOutAvailable,
    size_t *dataOutMoved)
{
    NSLog(@"GELEN op=%u",op);
    NSLog(@"GELEN alg=%u",alg);
    //NSLog(@"voptions=%u",options);
    //NSLog(@"GELEN key=%@",key);
    //NSLog(@"GELEN keyLength=%lu",keyLength);
    //NSLog(@"GELEN iv=%@",iv);
    //NSLog(@"GELEN dataIn=%@",dataIn);
    //NSLog(@"GELEN dataInLength=%lu",dataInLength);
    //NSLog(@"GELEN dataOut=%@",dataOut);
    //NSLog(@"GELEN dataOutAvailable=%lu",dataOutAvailable);
    //NSLog(@"GELEN dataOutMoved=%p",dataOutMoved);
    
    CCCryptorStatus origResult = original_CCCrypt(op, alg, options, key, keyLength, iv, dataIn,
        dataInLength, dataOut, dataOutAvailable, dataOutMoved);

    return origResult;
}


%ctor{
    MSHookFunction((void *) CCCrypt, (void *)  replaced_CCCrypt, (void **) &original_CCCrypt);
}

4.IOS反编译后部分代码分析

retain(翻译：记住、保留)，如下代码我的理解是，把新value保留并赋值给obj
setter方法对参数进行release旧值，再retain新值，如下代码
（void) setObj:(ClassX*) value  
{  
         if (obj != value)  
         {  
                   [obj release];  
                   obj = [value retain];  
         }  
} 

5 一些大佬写的

介绍常用的用法
https://www.jianshu.com/p/7ab7234f5187

绕过越狱检测和插件简单分析
https://www.jianshu.com/p/bea788647f69

tweak hook的一些代码样例
http://imxz.cn/post/IOS-Tweak-Hook-%E6%95%99%E7%A8%8B