<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>KeepAlive</key>
  <false/>
  <key>Label</key>
  <string>net.angelxwind.asu_inject</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/bin/asu_inject</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
  <key>StandardErrorPath</key>
  <string>/dev/null</string>
  <key>StandardOutPath</key>
  <string>/dev/null</string>
</dict>
</plist>

#include <stdio.h>
#include <limits.h>
#include <dispatch/queue.h>
#include <spawn.h>
#include <libproc.h>
#include <stdlib.h>
#include <unistd.h>

static int g_pidInstalld = 0;
extern char **environ;

int main (int argc, const char * argv[])
{
    // insert code here...
    puts("asu_inject for AppSync Unified 5");
    puts("Karen Tsai (angelXwind) / Linus Yang (laokongzi)");
    puts("AppSync Unified is not for piracy.");
    puts("Creating queue...");
    
    dispatch_queue_t queue = dispatch_queue_create(NULL, NULL);
    puts("Finding installd PID...");
    dispatch_async(queue, ^{
        
        char path[PATH_MAX] = {0};
        int pid_list[0x1000] = {0};
        bool isFind = false;
        
        do {
            
            int cnt = proc_listallpids(pid_list, sizeof(pid_list));
            if (cnt) {
                for (int i = 0; i < cnt; ++i) {
                    int pid = pid_list[i];
                    int name_len = 0;
                    if ((name_len = proc_pidpath(pid, path, sizeof(path))) <= 0) {
                        continue;
                    }
                    
                    if (strstr(path, "installd")) {
                        g_pidInstalld = pid;
                        isFind = true;
                        break;
                    }
                }
            }
            sleep(1);
        } while (isFind == false);
    });
    
    puts("Waiting for queue to come back...");
    dispatch_sync(queue, ^{});
    
    printf(" Pid %d\r\n", g_pidInstalld);
    puts("Injecting AppSyncUnified.dylib into installd...");
    
    pid_t pid;
    char *args[4];
    
    char pidInstalld[32] = {0};

    snprintf(pidInstalld, sizeof(pidInstalld), "%d", g_pidInstalld);
    args[0] = "/usr/bin/cynject";
    args[1] = pidInstalld;
    args[2] = "/Library/MobileSubstrate/DynamicLibraries/AppSyncUnified.dylib";
    args[3] = NULL;
    posix_spawn(&pid, "/usr/bin/cynject", NULL, NULL, args, environ);
    
  return 0;
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！