Method swizzling is actually something different: replacing a concrete method definition. There really isn't any good way of messing with the underlying messa

Method swizzling is actually something different: replacing a concrete method definition. There really isn't any good way of messing with the underlying message dispatch mechanism, objc_msgSend() unless you do DYLD interposing or some such hackery. However, objc_msgSend() has enough hooks to allow you to do custom dispatching, but only after the normal lookup has failed. Initially there was -forward:: which essentially gave you a pointer to a stack frame. Later, -forwardInvocation: gave you an NSInvocation, which was the message wrapped in an object. Nice, but slow. Since a lot of time the idea was just to forward the exact same message to another object, we later got a new intercession point that allowed you to return that other object. But again, all these only got activated once ordinary lookup failed, hence NSProxy and friends (objects with very few methods implemented). Oh, and there was the nil class hook: objc_msgSend() short-circuits when the receiver is nil, but for a while you could theoretically set a class to which the messages to nil would be dispatched. I tried it out a couple of times and it worked, but it was never really used, mostly undocumented and has since been removed, AFAICT.