Thursday, May 28, 2009

An application that SpringBoard is not tracking just launched with identifier ... and will be killed.

If you directly run a UIKit app from command line, nothing will be shown, and the syslog will print:

An application that SpringBoard is not tracking just launched with identifier com.yourcompany.Untitled and will be killed.


Why? If you disassemble SpringBoard with thumb-ddis, you can quickly found this string is referred in the function 0x123ba. This function is called only from -[SpringBoard applicationStarted:], decompiled as:

@implementation SpringBoard
-(void)applicationStarted:(GSEventRef)event { _123ba(event); }
@end


So it is pretty easy to get the signature and purpose of this function. 0x123ba decompiled is roughly like:
void LaunchApplication (GSEventRef event) {
GSEventRecord* pRecord = _GSEventGetGSEventRecord(event);

struct GSEventAppLaunch {
pid_t pid; // 48
void* m_52; // 52
const char displayIdentifier[]; // 56
}* pAppRecord = pRecord + 1;

if (getpid() != pAppRecord->pid) {
// call 11fc8
NSString* displayIdentifier = NSStringCreateWithUTF8String(pAppRecord->displayIdentifier, pRecord->size - 8);
if (displayIdentifier != nil) {
// call 107d8
SBApplication* app = SBApplicationGetWithDisplayIdentifier(displayIdentifier);
// 123e8
if (app != nil) {
[app sendActivationEvent:event];
[displayIdentifier release];
return;
}
}
// 123fa
NSLog(@"An application that SpringBoard is not tracking just launched with identifier %@ and will be killed.", displayIdentifier);
kill(pAppRecord->pid, 9);
[displayIdentifier release];
}
}


Since we are getting prompt of the display ID there is no reason the condition displayIdentifier != nil will fail, so it must be due to app == nil. We can set a break point at 0x123e8, and indeed, it returns nil. But having the same argument, why one returns a valid object and one returns nil? There must be some global variables it relies on. Let's take a look at 0x107d8 to be sure.

The function 0x107d8 roughly translates to:

SBApplication* SBApplicationGetWithDisplayIdentifier(NSString* identifier) { return _106a0(DisplayStack_e7004, identifier) ?: _106a0(DisplayStack_e7014, identifier) ?: _106a0(DisplayStack_e7008, identifier); }

The DisplayStack_xxx are instances of SBDisplayStack. In this context, SBDisplayStack is like an array of SBApplication, and the function 0x106a0 merely search for an SBApplication having the specified identifier from the stack. So what we are checking is already an aftereffect.

(more about Display stack: http://code.google.com/p/iphone-tweaks/wiki/DevelopmentNotes)

No comments:

Post a Comment