注意此方法是私有API
适用于iOS8 ~ iOS11之前, iOS11之后不实用

简单方法

#import <objc/runtime.h>

- (void)installedApplications
{
    Class lsawsc = objc_getClass("LSApplicationWorkspace");
    NSObject* workspace = [lsawsc performSelector:NSSelectorFromString(@"defaultWorkspace")];
    NSArray *apps = [workspace performSelector:NSSelectorFromString(@"allInstalledApplications")];


    Class LSApplicationProxy_class = objc_getClass("LSApplicationProxy");
    for (int i = 0; i < apps.count; i++) {
        NSObject *temp = apps[i];
        if ([temp isKindOfClass:LSApplicationProxy_class]) {
            //应用的bundleId
            NSString *appBundleId = [temp performSelector:NSSelectorFromString(@"applicationIdentifier")];
            //应用的名称
            NSString *appName = [temp performSelector:NSSelectorFromString(@"localizedName")];
            //应用的类型是系统的应用还是第三方的应用
            NSString * type = [temp performSelector:NSSelectorFromString(@"applicationType")];
            //应用的版本
            NSString * shortVersionString = [temp performSelector:NSSelectorFromString(@"shortVersionString")];
        
            NSString * resourcesDirectoryURL = [temp performSelector:NSSelectorFromString(@"containerURL")];
        
            NSLog(@"类型=%@应用的BundleId=%@ ++++应用的名称=%@版本号=%@\n%@",type,appBundleId,appName,shortVersionString,resourcesDirectoryURL);
        
        }
    }  
}

//调用App  
- (void)openApp {
    PrivateApi_LSApplicationWorkspace* workspace = [NSClassFromString(@"LSApplicationWorkspace") new];      
    [workspace openApplicationWithBundleID:@"com.xxx.xxx"];  
}

详细内容

#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Warc-performSelector-leaks"
    Class LSApplicationWorkspace_class = objc_getClass("LSApplicationWorkspace");
    SEL selector    =   NSSelectorFromString(@"defaultWorkspace");
    NSObject* workspace = [LSApplicationWorkspace_class performSelector:selector];
    SEL selectorALL = NSSelectorFromString(@"allInstalledApplications");
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wundeclared-selector"
    NSArray *allInstallApps = [workspace performSelector:selectorALL];
    
    for (NSObject *obj in allInstallApps) {
        NSString *appBundleId   = [obj performSelector:@selector(applicationIdentifier)];
        NSLog(@"installed %@", appBundleId);
    }
#pragma clang diagnostic pop    // -Wundeclared-selector
#pragma clang diagnostic pop    // -Warc-performSelector-leaks

在iOS 11 以前我们可以使用LSApplicationWorkspace来获取手机上已安装的应用列表
iOS 11 上获取所有已安装应用接口被禁，但可以根据BundleId检查App是否存在

- (BOOL)isInstalled:(NSString *)bundleId {
    NSBundle *container = [NSBundle bundleWithPath:@"/System/Library/PrivateFrameworks/MobileContainerManager.framework"];
    if ([container load]) {
        Class appContainer = NSClassFromString(@"MCMAppContainer");
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wundeclared-selector"
        id container = [appContainer performSelector:@selector(containerWithIdentifier:error:) withObject:bundleId withObject:nil];
#pragma clang diagnostic pop
        NSLog(@"%@", [container performSelector:@selector(identifier)]);
        if (container) {
            return YES;
        } else {
            return NO;
        }
    }
    return NO;
}