iOS 7 and below
AppStore applications are installed in /var/mobile/Applications inside a directory with a random name. Application directories (documents, library, etc.) And the * .app directory are inside it. To determine which application you need to parse the Info.plist file inside the * .app directory, where the application name and package ID are stored.
iOS 8
Apple has completely changed the way AppStore applications are stored on the file system. All that we need now is in the /var/mobile/Containers directory - at this moment every directory that I will mention later in the text is contained inside this directory. All packages (everything that contains the application code) are stored in the Bundle directory. There you will find applications, plugins, and possibly some other things.
For example, an OpenVPN application contains two packages with application code - OpenVPN.app with an executable application and OpenVPNPlugin.vpnplugin , which implements the OpenVPN protocol as an iOS VPN plugin. OpenVPN.app is in the Applications directory, and OpenVPNPlugin.vpnplugin is in VPNPlugin . For some reason, OpenVPNPlugin.vpnplugin also saved in Applications , but it looks like a temporary measure for compatibility reasons.
All application data is now stored in the Data directory. Applications, plugins store their data inside this directory.
Application directories (documents, library, etc.) are now stored in Data/Application inside a directory with a random name. To determine which application directories you need to parse Data/Application/xx-xx-xx/.com.apple.mobile_container_manager.metadata.plist . In it, you will find the key MCMMetadataIdentifier containing the identifier of the application package.
My device also has the Data/PluginKitPlugin and Data/VPNPlugin . Again, disassemble Data/PluginKitPlugin/xx-xx-xx/.com.apple.mobile_container_manager.metadata.plist and Data/VPNPlugin/xx-xx-xx/.com.apple.mobile_container_manager.metadata.plist respectively. In it you will find the key MCMMetadataIdentifier , which contains the identifier of the bundle of plugins. In the case of PluginKitPlugin, to determine which application it belongs to, you need to go to *.app . It seems that PluginKitPlugin packages are stored in *.app/PlugIns . Parse it Info.plist to determine the identifier of the bundle of plugins. As an example, you can see how Evernote is stored.
And finally, there is a Shared directory. It seems to contain application documents that can be used for different applications. Again, inside Shared you will find a directory with a random name. To determine which application has shared these documents, analyze .com.apple.mobile_container_manager.metadata.plist . MCMMetadataIdentifier will contain the string group. combined with the application package identifier.
IOS 8 update
Since iOS 8.4, Apple changed the situation again. Now there are no .com.apple.mobile_container_manager.metadata.plist files. Instead, you need to parse /var/mobile/Library/MobileInstallation/LastLaunchServicesMap.plist . It contains information about all installed applications (even system ones) with iOS 8, so you do not need .com.apple.mobile_container_manager.metadata.plist at all.
Plis has a very simple structure. The first dictionary with two main keys
- System - a dictionary of system applications (including Cydia)
- User - a dictionary of user applications (AppStore, enterprises, applications for developers, etc.)
These dictionaries use the package identifier as a key and a dictionary with application information as a value. For instance:
- Path - path to the application package directory
- Container - path to application directories (documents, library, etc.)
IOS 9 update
It seems that both .com.apple.mobile_container_manager.metadata.plist and /var/mobile/Library/MobileInstallation/LastLaunchServicesMap.plist too unreliable. The first is again present in iOS 9 - I don’t know what happened in 8.4, maybe an error. The latter is not always true. In fact, most of the time it contains old information. Especially for sandbox application. It looks like it periodically changes as many times as I found that the plist gives me the wrong way.
There is a much more reliable solution that does not require messing with LSApplicationWorkspace or anything - LSApplicationWorkspace from MobileCoreServices . It has a method - (id)allInstalledApplications , which returns an array of LSApplicationProxy objects that will provide you with all the information you can find in LastLaunchServicesMap.plist . And, if I remember correctly, it works even without jailbreaking.