忘记需要带的framework了, XPCObjects和IMFoundation这2个framework
定义即个c函数

extern int xpc_connection_get_pid(id p1);
extern char* xpc_connection_get_name(id p1);
extern id xpc_dictionary_create(int p1, int p2, int p3);
extern id xpc_connection_send_message(id p1, id p2);

extern bool IMInsertIntsToXPCDictionary(id p1, const char* p2, int p3, int p4);
extern bool IMInsertArraysToXPCDictionary(id p1, const char* p2, id p3, int p4);
extern bool IMInsertStringsToXPCDictionary(id p1, const char* p2, const char* p3, int p4);

@interface CKClientComposeConversation : NSObject
{
    NSMutableArray *_composeRecipients;
    BOOL _supportsAttachments;
    BOOL _forceMMS;
}

+ (double)maxTrimDurationForVideo;
+ (double)maxTrimDurationForAudio;
+ (id)_xpcConnection;
+ (double)maxTrimDurationForMediaType:(int)arg1;
+ (id)_newMessageWithComposition:(id)arg1 guid:(id)arg2;
+ (id)_copyEntityForAddressString:(id)arg1;
@property(nonatomic) BOOL forceMMS; // @synthesize forceMMS=_forceMMS;
- (void)addRecipientAddress:(id)arg1;
- (id)copyEntityForAddressString:(id)arg1;
- (BOOL)restrictMediaObjects;
- (BOOL)canSendMessageComposition:(id)arg1 error:(id *)arg2;
- (BOOL)canSendMessageWithParts:(id)arg1 subject:(id)arg2 error:(id *)arg3;
- (BOOL)isValidAddress:(id)arg1;
- (double)maxTrimDurationForMediaType:(int)arg1;
- (void)newMessageContentChangedWithComposition:(id)arg1;
- (BOOL)shouldShowCharacterCount;
- (id)serviceDisplayName;
- (int)buttonColor;
- (id)displayNameForMediaObjects:(id)arg1 subject:(id)arg2;
- (id)groupID;
- (void *)abRecord;
- (id)recipient;
- (id)recipients;
- (BOOL)canSendToRecipients:(id)arg1 withAttachments:(id)arg2 alertIfUnable:(BOOL)arg3;
- (BOOL)canAcceptMediaObjectType:(int)arg1 givenMediaObjects:(id)arg2;
- (BOOL)canAcceptMediaObject:(id)arg1 givenMediaObjects:(id)arg2;
- (void)loadAllMessages;
- (void)addMessage:(id)arg1;
- (id)newMessageWithComposition:(id)arg1;
- (id)newMessageWithComposition:(id)arg1 addToConversation:(BOOL)arg2;
- (id)newMessageWithComposition:(id)arg1 guid:(id)arg2 addToConversation:(BOOL)arg3;
- (id)preferredServiceWithCanSend:(char *)arg1 error:(int *)arg2;
- (id)_preferredServiceCheckWithServer:(BOOL)arg1 canSend:(char *)arg2 error:(int *)arg3;
- (BOOL)reloadIfStale;
- (id)unsentComposition;
- (void)dealloc;
- (id)initWithChat:(id)arg1 updatesDisabled:(BOOL)arg2 supportsAttachments:(BOOL)arg3;
- (BOOL)canSendMessageWithMediaObjectTypes:(int *)arg1;
- (void)sendMessage:(id)arg1 newComposition:(BOOL)arg2;
- (int)_maxAttachmentCount;

@end

感谢分享。。。

楼主V5，感谢分享哦

其实我更想知道是如何分析的

我在想知道LZ是如何分析的同时 ，还想知道“CTMessageCenter来后台发送短信”这是什么时候的事儿？ IOS5上可以用哪款软件实现？

楼主V5, 当时研究了很久没研究出来。

按照楼主的代码发短信出现SpringBoard[131] <Warning>: Process trying to use client compose server lacks entitlement!
这个错误，如何破？ 楼主给程序签名有加什么权限没？
我运行是ssh登录到手机用root权限运行的，后边还试了做成deb包在安装后脚本中执行，还用ssh单独执行都没成功～

............
在springboard进程中调用则可成功.

感谢分享.论坛牛人好多.

会不会在短消息里留下记录？

赞一个，学习收藏