How can I access specific iOS app's directory

Question

I'm trying to write an app for jailbroken iOS devices that can load files from another app. But appstore apps are stored in folders with seemingly random characters that vary per device. How can I figure out the directory for X app on the device? On iOS 8, achieving this seems harder due to the way the app filesystem is structured.

Answer 1

iOS 7 and below

AppStore apps are installed in /var/mobile/Applications inside directory with random name. App's directories (documents, library etc) and *.app directory are both inside it. To determine which app it is you need to parse Info.plist file inside *.app directory where app name and bundle identifier are stored.

iOS 8

Apple completely changed the way AppStore apps are stored in filesystem. Everything we need now is in /var/mobile/Containers directory - at this point every directory I mention further down the text is contained inside that directory. All bundles (anything that contains application code) are stored in Bundle directory. There you will find apps, plugins and may be some other stuff.

For example, OpenVPN application contains two bundles with application code - OpenVPN.app with application executable and OpenVPNPlugin.vpnplugin which implements OpenVPN protocol as iOS VPN plugin. OpenVPN.app is in Applications directory and OpenVPNPlugin.vpnplugin is in VPNPlugin. For some reason OpenVPNPlugin.vpnplugin is also stored in Applications but it looks like it's a temporary measure for compatibility reasons.

All application data now stored in Data directory. Applications, plugins store their data inside that directory.

Apps directories (documents, library etc) now stored in Data/Application inside directory with random name. To determine which app directories it is you need to parse Data/Application/xx-xx-xx/.com.apple.mobile_container_manager.metadata.plist. Inside it you will find MCMMetadataIdentifier key that contains app's bundle identifier.

There are also Data/PluginKitPlugin and Data/VPNPlugin directories on my device. Again, parse Data/PluginKitPlugin/xx-xx-xx/.com.apple.mobile_container_manager.metadata.plist and Data/VPNPlugin/xx-xx-xx/.com.apple.mobile_container_manager.metadata.plist respectively. Inside it you will find MCMMetadataIdentifier key that contains plugin's bundle identifier. In case of PluginKitPlugin, to determine to which app it belongs you need to go to *.app. It seems PluginKitPlugin bundles are stored in *.app/PlugIns. Parse it's Info.plist to determine plugin's bundle identifier. As an example you can look at how Evernote is stored.

And finally there is Shared directory. It seems it contains app's documents that can be shared between different apps. Again, inside Shared you will find directory with random name. To determine which app shared that documents parse the .com.apple.mobile_container_manager.metadata.plist. MCMMetadataIdentifier will contain group. string concatenated with app's bundle identifier.

iOS 8 Update

Since iOS 8.4 Apple once again changed things. Now there are no .com.apple.mobile_container_manager.metadata.plist files. Instead you need to parse /var/mobile/Library/MobileInstallation/LastLaunchServicesMap.plist. It holds information about all installed applications (even system ones) since iOS 8 so you actually don't need .com.apple.mobile_container_manager.metadata.plist at all.

The plist has a very simple structure. First is dictionary with two main keys

• System - dictionary of system applications (including Cydia ones)
• User - dictionary of user applications (AppStore, enterprise, developer apps etc)

Those dictionaries use bundle identifier as key and dictionary with application info as value. For example:

• Path - path to application bundle directory
• Container - path to application directories (documents, library etc)

iOS 9 Update

It looks like both .com.apple.mobile_container_manager.metadata.plist and /var/mobile/Library/MobileInstallation/LastLaunchServicesMap.plist are too unreliable. The former is once again present in iOS 9 - don't know what happened in 8.4, maybe a bug. The latter is not always up-to-date. In fact, most of the time it contains old information. Especially for application sandbox path. Looks like it does change periodically as many times I found that the plist gives me the wrong path.

There is a much more reliable solution that doesn't require fiddling with plists or anything - LSApplicationWorkspace from MobileCoreServices framework. It has method - (id)allInstalledApplications that returns an array of LSApplicationProxy objects that will give you all the information you might find in LastLaunchServicesMap.plist. And, if I remember correctly, it works even without jailbreak.