首先本文所研究的必须在越狱的前提下。
ios中要列出已安装的软件目前有3中方法:(据我所知)
1.我之前的文章有2种方法获取,详情请移步:
http://www.iloss.me/?p=844
2.用系统提供的函数,应该比上面2种方法要方便,安全,高效。(但据我测试系统的也是读取com.apple.mobile.installation.plist文件)
Mobile Installation 是 iOS 中负责安装,卸载,更新等 IPA 的 Framework,我们丢进 IDA分析
得到以下API
__MobileInstallationRebuildMap __text 000011EF 00000072 R . . . B . .
_MobileInstallationCheckCapabilitiesMatch __text 00001261 0000008C R . . . B . .
_MobileInstallationSetDeviceCapabilities __text 000012ED 00000089 R . . . B . .
_MobileInstallationCopySafeHarbors __text 00001376 0000007B R . . . B . .
_MobileInstallationRemoveSafeHarbor __text 000013F1 00000089 R . . . B . .
_MobileInstallationRegisterSafeHarbor __text 0000147A 000000E4 R . . . B . .
_MobileInstallationProcessRestoredContainer __text 0000155E 00000087 R . . . B . .
_MobileInstallationLookupArchives __text 000015E5 0000007B R . . . B . .
_MobileInstallationRemoveArchive __text 00001660 00000087 R . . . B . .
_MobileInstallationRestore __text 000016E7 00000087 R . . . B . .
_MobileInstallationArchive __text 0000176E 00000087 R . . . B . .
_MobileInstallationBrowse __text 000017F5 00000076 R . . . B . .
_MobileInstallationLookup __text 0000186B 0000007B R . . . B . .
_MobileInstallationUninstall __text 000018E6 00000087 R . . . B . .
_MobileInstallationUpgrade __text 0000196D 00000087 R . . . B . .
我这里只分析今天用到的_MobileInstallationBrowse
最后直接贴上最终的分析结果:
int (*MobileInstallationBrowse)(NSDictionary *options, int (*callback)(NSDictionary *dict, id value), id value);
获取应用:
static int callback(NSDictionary *dict, id result)
{
NSArray *currentlist = [dict objectForKey:@"CurrentList"];
if (currentlist)
{
for (NSDictionary *appinfo in currentlist)
{
[(NSMutableArray*)result addObject:[[appinfo copy] autorelease]];
}
}
return 0;
}
+(id)browse
{
NSMutableArray *result = [NSMutableArray new];
MobileInstallationBrowse( [NSDictionary dictionaryWithObject:@"Any" forKey:@"ApplicationType"],&callback, result); //Any 代表所有程序,这里可以用 “System” “User”来区分系统和普通软件
}
调用库函数,应先加载库并加载对应的函数,如下:
引入头文件#import "dlfcn.h"
void *lib = dlopen("/System/Library/PrivateFrameworks/MobileInstallation.framework/MobileInstallation", RTLD_LAZY);
if (lib)
{
MobileInstallationBrowse pBrowse = (MobileInstallationBrowse)dlsym(lib, "MobileInstallationBrowse");
dlclose(lib);
}