关于sbutils中的sblaunch插件的疑惑

一、sbutils介绍

　　sbutils是一个开源的越狱手机基础功能的插件包，其中包含sblaunch这个启动插件，该插件可以实现命令行下面打开app并传递一个url。

　　sbutils下载地址：http://cydia.ppios.com/2013/06/sbutils-v1-0-2-1.html

　　sbutils的开源代码：https://github.com/innoying/iOS-sbutils

二、sblaunch的开源代码

 1 #include <CoreFoundation/CoreFoundation.h>
 2 #include <stdbool.h>
 3 #define SBSApplicationLaunchUnlockDevice 4
 4 #define SBSApplicationDebugOnNextLaunch_plus_SBSApplicationLaunchWaitForDebugger 0x402
 5 
 6 bool SBSProcessIDForDisplayIdentifier(CFStringRef id, pid_t *pid);
 7 int SBSLaunchApplicationWithIdentifier(CFStringRef id, char flags);
 8 int SBSLaunchApplicationForDebugging(CFStringRef bundleID, CFURLRef openURL, CFArrayRef arguments, CFDictionaryRef environment, CFStringRef stdout, CFStringRef stderr, char flags);
 9 
10 int main(int argc, char **argv) {
11     bool p = false;
12     const char *url = NULL;
13     const char *bundle;
14     int flags = SBSApplicationLaunchUnlockDevice;
15 
16     int c;
17     while((c = getopt(argc, argv, "pdbu:")) != -1)
18     switch(c) {
19         case 'p': p = true; break;
20         case 'd': flags |= SBSApplicationDebugOnNextLaunch_plus_SBSApplicationLaunchWaitForDebugger; break;
21         case 'b': flags |= 1; break;
22         case 'u': url = optarg; break;
23         default: goto usage;
24     }
25     if(optind == argc) goto usage;
26     bundle = argv[optind];
27 
28     CFMutableArrayRef arguments = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
29     while(++optind != argc) CFArrayAppendValue(arguments, CFStringCreateWithCString(NULL, argv[optind], kCFStringEncodingUTF8));
30 
31 
32     CFStringRef cs = CFStringCreateWithCString(NULL, bundle, kCFStringEncodingUTF8);
33     CFURLRef cu = url ? CFURLCreateWithBytes(NULL, (UInt8*)url, strlen(url), kCFStringEncodingUTF8, NULL) : NULL;
34     if(url && !cu) {
35         fprintf(stderr, "invalid URL
");
36         return 1;
37     }
38     int err;
39     if((err = SBSLaunchApplicationForDebugging(cs, cu, arguments, NULL, NULL, NULL, flags))) {
40         fprintf(stderr, "SBSLaunchApplicationWithIdentifier failed: %d
", err);
41         return 1;
42     }
43     if(p) {
44         pid_t pid;
45         while(!SBSProcessIDForDisplayIdentifier(cs, &pid)) {
46             usleep(50000);
47         }
48         printf("%d
", (int) pid);
49     }
50     return 0;
51 
52     usage:
53     fprintf(stderr, "Usage: sblaunch [-p] [-d] [-b] [-u url] <bundle> [arguments...]
"
54                     "  -p: print pid
"
55                     "  -d: launch for debugging
"
56                     "  -b: launch in background
"
57                     );
58     return 1;
59 }

其中着色的函数是关键函数，找了好多资料没有发现这个函数的出处，没有资料显示这里的标准参数是什么。

仿照这个函数的用法，自己写了一段代码，发现同样调用中是可以打开一个app的，但是传递的url无论怎么传递都没有效果。

添加签名：

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.springboard.launchapplications</key> <true/> </dict> </plist>

遂怀疑是参数的问题，用IDA反编译sblaunch，得到以下的C代码

  1 int __cdecl main(int argc, const char **argv, const char **envp)
  2 {
  3   const char **v3; // r5@1
  4   signed int v4; // r4@1
  5   int v5; // r6@1
  6   int v6; // r0@11
  7   int v7; // r8@14
  8   int i; // r2@14
  9   int v9; // r0@15
 10   int v10; // r5@16
 11   size_t v11; // r2@18
 12   FILE **v12; // r4@18
 13   const void *v13; // r0@18
 14   int v14; // r4@19
 15   int v15; // r0@19
 16   FILE *v16; // r3@26
 17   const char *v18; // [sp+Ch] [bp-2Ch]@14
 18   int v19; // [sp+10h] [bp-28h]@14
 19   char v20; // [sp+14h] [bp-24h]@1
 20   const char *v21; // [sp+18h] [bp-20h]@1
 21   int v22; // [sp+1Ch] [bp-1Ch]@22
 22 
 23   v3 = argv;
 24   v4 = 4;
 25   v20 = 0;
 26   v21 = 0;
 27   v5 = argc;
 28   while ( 1 )
 29   {
 30     v6 = getopt(v5, (char *const *)v3, "pdbu:");
 31     if ( v6 <= 97 )
 32       break;
 33     if ( v6 > 111 )
 34     {
 35       if ( v6 == 112 )
 36       {
 37         v20 = 1;
 38       }
 39       else
 40       {
 41         if ( v6 != 117 )
 42           goto LABEL_25;
 43         v21 = optarg;
 44       }
 45     }
 46     else if ( v6 == 98 )
 47     {
 48       v4 |= 1u;
 49     }
 50     else
 51     {
 52       if ( v6 != 100 )
 53         goto LABEL_25;
 54       v4 |= 0x402u;
 55     }
 56   }
 57   if ( v6 != -1 || optind == v5 )
 58   {
 59 LABEL_25:
 60     v11 = 134;
 61     v12 = (FILE **)&__stderrp;
 62     v13 = "Usage: sblaunch [-p] [-d] [-b] [-u url] <bundle> [arguments...]
  -p: print pid
  -d: launch for debugging
  -b: launch in background
";
 63     goto LABEL_26;
 64   }
 65   v18 = v3[optind];
 66   v19 = 0;
 67   v7 = CFArrayCreateMutable(0);
 68   ++optind;
 69   for ( i = optind; i != v5; optind = i )
 70   {
 71     v9 = CFStringCreateWithCString(0, v3[i], 134217984);
 72     CFArrayAppendValue(v7, v9);
 73     i = optind + 1;
 74   }
 75   v10 = CFStringCreateWithCString(0, v18, 134217984);
 76   if ( v21 )
 77   {
 78     strlen(v21);
 79     v19 = CFURLCreateWithBytes(0);
 80     if ( !v19 )
 81     {
 82       v11 = 12;
 83       v12 = (FILE **)&__stderrp;
 84       v13 = "invalid URL
";
 85 LABEL_26:
 86       v16 = *v12;
 87       v14 = 1;
 88       fwrite(v13, 1u, v11, v16);
 89       return v14;
 90     }
 91   }
 92   v14 = 0;
 93   v15 = SBSLaunchApplicationForDebugging(v10, v19, v7, 0);
 94   if ( v15 )
 95   {
 96     fprintf(__stderrp, "SBSLaunchApplicationWithIdentifier failed: %d
", v15);
 97     v14 = 1;
 98   }
 99   else if ( v20 )
100   {
101     while ( !SBSProcessIDForDisplayIdentifier(v10, &v22) )
102       usleep(0xC350u);
103     v14 = 0;
104     printf("%d
", v22);
105   }
106   return v14;
107 }

显示是4个参数，这个函数是位于以下目录中文件中

、

可是在越狱的手机中找了很久也找不到这个文件，不知道这个库的文件在哪里？