通过私有方法获取应用列表，方法如下：

LSApplicationWorkspace获取

在系统的MoblieCoreServices.framework 框架中有一个叫做LSApplicationWorkspace的类，利用该类可以获取到手机上应用的各种信息，包括已经安装的app列表以及正在安装的app列表等，具体API如下：

image.png

通过代码调用如下：

- (void)getAppList
{
    Class LSApplicationWorkspace_Class = NSClassFromString(@"LSApplicationWorkspace");
    NSObject *workspace = [LSApplicationWorkspace_Class performSelector:NSSelectorFromString(@"defaultWorkspace")];
    NSArray *appList = [workspace performSelector:NSSelectorFromString(@"allApplications")];
    for (id app in appList) {
        NSLog(@"-----App列表----%@", [app performSelector:NSSelectorFromString(@"applicationIdentifier")]);
    }
}
    
    
 -------分割线--------   

2018-09-10 12:24:02.292547+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.datadetectors.DDActionsService
2018-09-10 12:24:02.292744+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.WLAccessService
2018-09-10 12:24:02.292906+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.SafariViewService
2018-09-10 12:24:02.293119+0800 MOBGetAppList[6395:246717] -----App列表----cuilinhao.com.cn.TestJumpTwo
2018-09-10 12:24:02.293296+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.social.SLYahooAuth
2018-09-10 12:24:02.293481+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.news
2018-09-10 12:24:02.293678+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.ScreenshotServicesService
2018-09-10 12:24:02.293877+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.SharedWebCredentialViewService
2018-09-10 12:24:02.294030+0800 MOBGetAppList[6395:246717] -----App列表----cuilinhao.com.cn.MOBGetAppList
2018-09-10 12:24:02.294211+0800 MOBGetAppList[6395:246717] -----App列表----com.520it.DYZB
2018-09-10 12:24:02.294390+0800 MOBGetAppList[6395:246717] -----App列表----peipei.MySwift
2018-09-10 12:24:02.294582+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.family
2018-09-10 12:24:02.297162+0800 MOBGetAppList[6395:246717] -----App列表----com.mob.bbssdk.sample
2018-09-10 12:24:02.297379+0800 MOBGetAppList[6395:246717] -----App列表----com.mob.VIPDemo
2018-09-10 12:24:02.297579+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.siri.parsec.HashtagImagesApp
2018-09-10 12:24:02.297758+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.SharingViewService
2018-09-10 12:24:02.297958+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.Preferences
2018-09-10 12:24:02.298126+0800 MOBGetAppList[6395:246717] -----App列表----cuilinhao.com.cn.----
2018-09-10 12:24:02.298315+0800 MOBGetAppList[6395:246717] -----App列表----com.mob.princeLin
2018-09-10 12:24:02.298477+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.ServerDocuments
2018-09-10 12:24:02.298653+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.PrintKit.Print-Center
2018-09-10 12:24:02.298860+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.MailCompositionService
2018-09-10 12:24:02.299048+0800 MOBGetAppList[6395:246717] -----App列表----cuilinhao.com.cn.TestBBS
2018-09-10 12:24:02.299238+0800 MOBGetAppList[6395:246717] -----App列表----cuilinhao.com.cn.AlaformTest
2018-09-10 12:24:02.299402+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.WebSheet
2018-09-10 12:24:02.299609+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.TrustMe
2018-09-10 12:24:02.299816+0800 MOBGetAppList[6395:246717] -----App列表----com.apple.mobilesms.compose

MCMAppContainer 判断

在系统的MobileContainerManager.framework 中的一个类MCMAppContainer，通过该类可以判断某App是否存在，不过无法确定应用的状态为安装中或已安装，代码如下：

ps： 必须是真机调试

- (void)isHere
{
    NSBundle *container = [NSBundle bundleWithPath:@"/System/Library/PrivateFrameworks/MobileContainerManager.framework"];
    
    if ([container load]) {
        Class appContainer = NSClassFromString(@"MCMAppContainer");
        id test = [appContainer performSelector:@selector(containerWithIdentifier:error:) withObject:@"com.tencent.xin" withObject:nil];
        
        if (test)
        {
            NSLog(@"存在该应用");
        }
        else
        {
             NSLog(@"不存在该应用");
        }
    }
}

代码混淆

//base64编码
- (NSString *)encodeString:(NSString *)string
{
    NSData *data = [string dataUsingEncoding:NSUTF8StringEncoding];
    NSString *encodedStr = [data base64EncodedStringWithOptions:0];
    return encodedStr;
}

//base64解码
- (NSString *)decodeString:(NSString *)string
{
    NSData *data = [[NSData alloc] initWithBase64EncodedString:string options:0];
    NSString *decodedStr = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
    return decodedStr;
}

//调用私有api
- (void)testPrivateApi
{
    NSString *path = [self decodeString:@"L1N5c3RlbS9MaWJyYXJ5L1ByaXZhdGVGcmFtZXdvcmtzL01vYmlsZUNvbnRhaW5lck1hbmFnZXIuZnJhbWV3b3Jr"];
    NSBundle *container = [NSBundle bundleWithPath:path];
    if ([container load]) {
        Class appContainer = NSClassFromString([self decodeString:@"TUNNQXBwQ29udGFpbmVy"]);
        NSString *sel = [self decodeString:@"Y29udGFpbmVyV2l0aElkZW50aWZpZXI6ZXJyb3I6"];
        
        id test = [appContainer performSelector:NSSelectorFromString(sel) withObject:@"com.tencent.xin" withObject:nil];
        
        if (test)
        {
            NSLog(@"存在该应用");
        }
        else
        {
             NSLog(@"不存在该应用");
        }
    }
}