How iOS Retrieves Night‑Mode Launch Images from applicationState.db

The Baidu App technical team previously published an article about iOS launch‑image anomalies, leaving the question of how iOS fetches night‑mode launch images unanswered.

This guide solves that problem by examining internal system files.

Approach 1: Analyze Launch‑Image Filenames

Four cached launch‑image files follow the pattern xxxxxxxx-xxxx-4xxx-xxxx-xxxxxxxxxxxx , which matches an NSUUID (RFC 4122 version 4). The filenames therefore contain only the version number (4) and no additional information.

Approach 2: Inspect System Files

When filename analysis fails, the author discovers the applicationState.db SQLite database, located in the iOS simulator’s data directory, which stores various app states including the path to night‑mode launch images.

~/Library/Developer/CoreSimulator/Devices/1F9B22C5-E446-4881-AFE4-3373E3513C59/data/Library/FrontBoard/applicationState.db

The database schema reveals three relevant tables:

application_identifier_tab – maps bundle identifiers to internal IDs.

key_tab – stores constant strings such as XBApplicationSnapshotManifest .

kvs – links the two tables and holds a BLOB value .

The XBApplicationSnapshotManifest entry contains the snapshot data for the app’s launch images.

Extracting the Manifest

Using SQLite tools, the author queries the manifest for the test bundle test.SplashTest and obtains a BLOB that corresponds to the private SplashBoard class XBApplicationSnapshotManifestImpl .

+(void)load {
    void *lib = dlopen("/Applications/Xcode.app/…/SplashBoard.framework/SplashBoard", RTLD_NOW);
    printf("%p", lib);
    [self dump:@"/Users/test/…/XBApplicationSnapshotManifest.plist"];
}

+(void)dump:(NSString *)path {
    NSData *data0 = [NSData dataWithContentsOfFile:path];
    NSPropertyListFormat f = -1;
    NSError *error = nil;
    NSData *data1 = [NSPropertyListSerialization propertyListWithData:data0 options:NSPropertyListReadStreamError format:&f error:&error];
    if (f == kCFPropertyListXMLFormat_v1_0) {
        NSLog(@"kCFPropertyListXMLFormat_v1_0");
    }
    id obj = [NSKeyedUnarchiver unarchiveTopLevelObjectWithData:data1 error:&error];
    NSLog(@"%@", obj);
}

The dump reveals several XBApplicationSnapshot objects, each describing a snapshot with properties such as userInterfaceStyle (Dark/Light), interfaceOrientation , and a relative file path.

Reconstructing the Image Path

By selecting the snapshot whose userInterfaceStyle is Dark and interfaceOrientation matches the current launch orientation, the author concatenates the _relativePath to form the actual file location:

~/Library/Developer/CoreSimulator/Devices/1F9B22C5-E446-4881-AFE4-3373E3513C59/data/Containers/Data/Application/FA902232-17D2-495F-B23E-410349A9921C/Library/SplashBoard/Snapshots/test.SplashTest - {DEFAULT GROUP}/[email protected]

Conclusion

By analyzing the applicationState.db SQLite database and the XBApplicationSnapshotManifest entries, one can reliably locate the night‑mode launch images used by iOS during app startup.