1

I'd like to try and fix some open source GitHub project that uses the allApplications from LSApplicationWorkspace call from private API which list all installed application on the device.

The method works fine in the simulator, but on a device running iOS 11, it returns zero results.

So First, I've downloaded the IPSW file, and opened it I got the following list of files : 

-rw-r--r--@  1 adam.k  staff    15139280 Oct  7 08:16 kernelcache.release.iphone9
-rw-r--r--@  1 adam.k  staff  2462102996 Oct  7 11:25 058-59998-354.dmg
drwxrwxr-x@ 14 adam.k  staff         476 Oct  7 11:34 Firmware
-rw-r--r--@  1 adam.k  staff    59088923 Oct  7 11:44 058-59982-359.dmg
-rw-r--r--@  1 adam.k  staff    59801627 Oct  7 11:44 058-59988-357.dmg
-rw-r--r--@  1 adam.k  staff        3282 Oct  7 11:49 Restore.plist
-rw-r--r--@  1 adam.k  staff      257603 Oct  7 11:53 BuildManifest.plist

According to some resources from from the web, I understood that the relevant image here is the largest dmg file. after open it, I got the following mount /Volumes/Tigris15A432.D10D101OS

when looking for the right framework in this image, I got : System/Library/Frameworks/MobileCoreServices.framework

but it seems that it doesn't contain any dylib/macho files and I couldn't find the symbol...

However, In the Info.plist of that framework it says : CFBundleExecutable MobileCoreServices

but I couldn't find this MobileCoreServices file anywhere in the image ... any idea where should I find it ?

| improve this question | |
2

Most of the commonly used iOS frameworks do not exist as separate files anymore but are bundled together in the dyld shared cache. MobileCoreServices is also one of such frameworks.

| improve this answer | |
  • thanks man, just extracted the framework from dyld_shared_cache.. however, I'm trying to find the class LSApplicationWorkspace using IDA and I see that it's somehow looks like a stub waiting to be resolved during runtime... in fact I'm looking for the symbol allApplications and it's implementation inside this class and it doesn't look like in macOS .. any idea how do I get to it ? – Zohar81 Oct 23 '17 at 8:30
  • extracted frameworks are not complete; you should disassemble the framework inside the cache to see unknown references – Igor Skochinsky♦ Oct 23 '17 at 9:39
  • perhaps you could provide some hints about where to start .. it's not a valid macho file .. Should I look the symbol first ? – Zohar81 Oct 23 '17 at 10:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.