I'd like to analyze iOS private framework that broke commonly used GitHub project called
AppLister. Here's some info about the API:
Framework : MobileCoreServices.framework. Class: LSApplicationWorkspace. Method: allApplication.
Starting from iOS11, this call returns empty list unless the following entitlement is added to the application :
It seems like this API was closed in iOS11 and you need the following entitlement in order to allow it.
Prior to reversing, I wish to understand the flow of entitlement verification in general and maybe get into some details..
From what I've found out so far, it looks like the App use XPC for remote daemon that perform the actual verification.
but I still have some black holes in this explanation.
1. Does the policy checker daemon also perform the method itself, or just return allow/block verdict. 2. Does the flow involve kernel verification or just user-space processes. 3. Is there a way to bypass this flow if I can only control the local process (not the checker or course) by skipping the policy check phase and call the API directly ?
I'd be happy to here some more about how this is working, and if I've missed something.