ios-Private API and runtime

Reprint: Http://www.jianshu.com/p/6167b9ce7af8 sequence

Have friends in doing similar itool function, chat with me, these days idle, wrote a demo, not seriously do this, but also very sketchy, specific dry goods, and so the friend himself.

DEMO

Https://github.com/liulishuo/testAppList

Ideas

IOS9 Whitelist limit is 50, if you want to bypass this limit, scan the system of all the app's status, only use the private API, there are two classes to use: Lsapplicationworkspace, Lsapplicationproxy, Knowing the name of the class we can rely on runtime to get this class, and all the methods of this class, OC method words too literally, then you can slowly try.

Realize

• Get Lsapplicationworkspace, Lsapplicationproxy

Class LSApplicationWorkspace_class = objc_getClass("LSApplicationWorkspace");Class LSApplicationProxy_class = object_getClass(@"LSApplicationProxy");

• Get all the methods and member variables of the class (Programming little Weng)

  Get no member variableint count =0; Ivar *members = Class_copyivarlist ([lsapplicationproxy_classClass], &count);for (int i =0; I < count; i++) {Ivar var = members[i];const char *membername = Ivar_getname (Var); const char *membertype = Ivar_gettypeencoding (Var); NSLog (@ "%s:%s", membertype,membername);} NSLog (@ "Count:%d", count); //get a useful method count = 0; Method *membermethods = class_copymethodlist (Lsapplicationproxy_class, &count); for (int i = 0; i < count; i++) {SEL Name = Method_getname (Membermethods[i]); NSString *methodname = [nsstring stringwithcstring:sel_getname (name) encoding:nsutf8stringencoding]; NSLog (@ "member method:%@", MethodName);} NSLog (@ "Count:%d", count);          

  Because the function class_copyivarlist, class_copymethodlist sometimes cannot return the useful result, therefore we use the Class-dump (has the friend to reflect Xcode7 's library not to come out, everybody uses the source code own build one bar), Export the header file of the class.
  Export all header files for mobilecoreservices.framework:

  class-dump -H /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator.sdk/System/Library/Frameworks/MobileCoreServices.framework  -o /Users/credit/Desktop/header004

  The output path after-O is changed to what you need.

All header files for mobilecoreservices.framework
Lsapplicationproxy
Lsapplicationworkspace

• Get the App list

Although there is no comment, but we can guess that this method should be able to get the app list

- (id)allApplications;

But he's an example, and we're going to get a lsapplicationworkspace instance first.

+ (id)defaultWorkspace;

The code is as follows

NSObject* workspace = [LSApplicationWorkspace_class performSelector:@selector(defaultWorkspace)];NSArray *appList = [workspace performSelector:@selector(allApplications)];

• Traverse the App List
  Each element in the applist is lsapplicationproxy than the header file, and the corresponding properties are printed out to study,
  Properties slightly more, do not want to write their own friends, please see my demo
  
  Iterating through an array

Yy
Late

Note that the contents of the Groupcontainers array, we can get the group ID, could we get the data of the public storage area?

 NSUserDefaults *share = [[NSUserDefaults alloc] initWithSuiteName:@"group.com.tencent.xin"]; NSLog(@"%@",share.dictionaryRepresentation);

However, there is no directory where the data is shared?

NSURL *containerURL = [[NSFileManager defaultManager] containerURLForSecurityApplicationGroupIdentifier:@"group.com.tencent.xin"];

The return value is nil

App is not in Group.com.tencent.xin this group, our fake strong write is invalid, because this identifier has been occupied by the genuine.

APP Groups

What else is there to be fun about? Give it a try.

[workspace performSelector:@selector(uninstallApplication:withOptions:) withObject:@"XXX" withObject:nil];

Workspace is lsapplicationworkspace instance, @ "XXX" here to fill in the applicationidentifier you get

Simulator can uninstall the app normally, the real machine does not.
More APIs, you can try it yourself.

Wen/cocoa (author of Jane's book)
Original link: Http://www.jianshu.com/p/6167b9ce7af8
Copyright belongs to the author, please contact the author to obtain authorization, and Mark "book author".

ios-Private API and runtime