Apps can register custom URL schemes to enable other apps to open them, pass them data and even deep-link to within them. There is an official API called canOpenUrl: which will let you check if a particular URL scheme is registered on a particular device. So that, along with a database of public URL schemes published by other apps, lets you detect which apps are installed.
I wasn't aware of this before but apparently you can also use sysctl() to check the names of running processes (which is less reliable as processes will get bumped off if the foreground app requires more memory).
Hardcode the address on all known platforms and skip it on unknown ones, or disassemble a public function that calls it and figure out the address from there, or read the Mach-O headers and write your own dlsym, etc. etc.
Apple once blocked a updates for everyone using a common SDK because it had named a symbol something that happened to be the name of an unrelated private API, and the review process couldn't tell the difference. That implies things about the rigor of the review process.
1.) Scan for custom URL schemes the applications register so you can open them from other apps or web URLs.
2.) Retrieve a list of currently running processes in the background
I wasn't aware of this before but apparently you can also use sysctl() to check the names of running processes (which is less reliable as processes will get bumped off if the foreground app requires more memory).
More here: http://danielamitay.com/blog/2011/2/16/how-to-detect-install...