How does a Block capture the variables outside of its enclosing scope?

I know that an Objective-C Block can capture and set the value of variables outside of its enclosing scope. How does it do that?

It's actually fairly straightforward and described in Clang's Block Implementation Spec, in the "Imported Variables" section.

When the compiler encounters a Block like:

^{ if( numBalloons > numClowns) abort(); }

it creates a literal structure that includes -- among other things -- two elements that are important here. There's a function pointer to the executable code in the Block, and a const field for each variable that's referred to inside the Block. Something like this:

struct __block_literal_1 {
    /* other fields */
    void (*invoke)(struct __block_literal_1 *);
    /* ... */
    const int numBalloons;
    const int numClowns;
};

Notice that the invoke function will take a pointer to a struct of the kind that's being defined right here; that is, the Block passes itself in when executing its code. Thus, the code gets access to the members of the structure.

Right after the declaration, the compiler creates a definition of the Block, which simply uses the referenced variables to initialize the correct fields in the struct:

struct __block_literal_1 __block_literal_1 = {
    /* Other fields */
    __block_invoke_2,  /* This function was also created by the compiler. */
    /* ... */
    numBalloons,  /* These two are the exact same variables as */ 
    numClowns     /* those referred to in the Block literal that you wrote. *
 };

Then, inside the invoke function, references to the captured variables are made like any other member of a struct, the_block->numBalloons.

The situation for object-type variables is a little more complicated, but the same principle applies.

Within the block object’s body of code, variables may be treated in five different ways.

You can reference three standard types of variable, just as you would from a function:

• Global variables, including static locals
• Global functions (which aren’t technically variables)
• Local variables and parameters from an enclosing scope

Blocks also support two other types of variable:

1. At function level are __block variables. These are mutable within the block (and the enclosing scope) and are preserved if any referencing block is copied to the heap.

2. const imports.

Finally, within a method implementation, blocks may reference Objective-C instance variables—see Object and Block Variables.

The following rules apply to variables used within a block:

1. Global variables are accessible, including static variables that exist within the enclosing lexical scope.

2. Parameters passed to the block are accessible (just like parameters to a function).

3. Stack (non-static) variables local to the enclosing lexical scope are captured as const variables.

   Their values are taken at the point of the block expression within the program. In nested blocks, the value is captured from the nearest enclosing scope.

4. Variables local to the enclosing lexical scope declared with the __block storage modifier are provided by reference and so are mutable.

   Any changes are reflected in the enclosing lexical scope, including any other blocks defined within the same enclosing lexical scope. These are discussed in more detail in The __block Storage Type.

5. Local variables declared within the lexical scope of the block, which behave exactly like local variables in a function.

Each invocation of the block provides a new copy of that variable. These variables can in turn be used as const or by-reference variables in blocks enclosed within the block.

From here:
http://developer.apple.com/library/ios/#documentation/cocoa/conceptual/Blocks/Articles/bxVariables.html