iOS安装应用

Mobile Installation 是 iOS 中负责安装 IPA 的 Framework,，通过 IDA 分析 /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS5.0.sdk/System/Library/PrivateFrameworks/MobileInstallation.framework/MobileInstallation 可知它导出了以下 API：

Name                                        Address  Ordinal
----                                        -------  -------
_MobileInstallationArchive                  00000F80       
_MobileInstallationBrowse                   00000FE0       
_MobileInstallationCheckCapabilitiesMatch   00000BE0       
_MobileInstallationCopySafeHarbors          00000CA4       
_MobileInstallationInstall                  00001144       
_MobileInstallationLookup                   00001034       
_MobileInstallationLookupArchives           00000E70       
_MobileInstallationProcessRestoredContainer 00000E10       
_MobileInstallationRegisterSafeHarbor       00000D58       
_MobileInstallationRemoveArchive            00000EC0       
_MobileInstallationRemoveSafeHarbor         00000CF4       
_MobileInstallationRestore                  00000F20       
_MobileInstallationSetDeviceCapabilities    00000C40       
_MobileInstallationUninstall                00001084       
_MobileInstallationUpgrade                  000010E4       
__MobileInstallationRebuildMap              00000B90       

其中有两个 API 是非常有用的：

_MobileInstallationInstall：安装 IPA
_MobileInstallationLookup：列出已安装的 IPA

 

typedef int (*MobileInstallationInstall)(NSString *path, NSDictionary *dict, void *na, NSString *path2_equal_path_maybe_no_use);
IPAResult IPAInstall(NSString *path)
{
  void *lib = dlopen("/System/Library/PrivateFrameworks/MobileInstallation.framework/MobileInstallation", RTLD_LAZY);
  if (lib)
  {
    MobileInstallationInstall pMobileInstallationInstall = (MobileInstallationInstall)dlsym(lib, "MobileInstallationInstall");
    if (pMobileInstallationInstall)
    {
      NSString *name = [@"Install_" stringByAppendingString:path.lastPathComponent];
      NSString* temp = [NSTemporaryDirectory() stringByAppendingPathComponent:name];
      if (![[NSFileManager defaultManager] copyItemAtPath:path toPath:temp error:nil]) return IPAResultFileNotFound;
     
      int ret = (IPAResult)pMobileInstallationInstall(temp, [NSDictionary dictionaryWithObject:@"User" forKey:@"ApplicationType"], 0,皇冠足球网址, path);
      [[NSFileManager defaultManager] removeItemAtPath:temp error:nil];
      return ret;
    }
  }
  return IPAResultNoFunction;
}