This post also has a Chinese version:
Article Link: Cast a Closure to a Function Pointer -- How libffi closure works