[kranner]

Apps can register custom URL schemes to enable other apps to open them, pass them data and even deep-link to within them. There is an official API called canOpenUrl: which will let you check if a particular URL scheme is registered on a particular device. So that, along with a database of public URL schemes published by other apps, lets you detect which apps are installed.

I wasn't aware of this before but apparently you can also use sysctl() to check the names of running processes (which is less reliable as processes will get bumped off if the foreground app requires more memory).

More here: http://danielamitay.com/blog/2011/2/16/how-to-detect-install...

[leonatan]

There is also private API that is not very difficult to hide, which gives you all the installed app bundle identifiers.

[kranner]

How would you hide calls to private APIs?

[geofft]

Hardcode the address on all known platforms and skip it on unknown ones, or disassemble a public function that calls it and figure out the address from there, or read the Mach-O headers and write your own dlsym, etc. etc.

Apple once blocked a updates for everyone using a common SDK because it had named a symbol something that happened to be the name of an unrelated private API, and the review process couldn't tell the difference. That implies things about the rigor of the review process.

[ajays]

Apparently Apple has closed the "canOpenURL" loophole: https://www.ihasapp.com/