越狱进程怎么获取app的数据存放目录

app的用户数据一般存放在/var/mobile/Containers/Data/Application这个目录下面的AB79DE90-18B3-476C-165C-53B58D569482这种目录下面。。我一个守护进程有什么方法去遍历所有app的这个路径呢。。。如果在app进程内部倒是可以用NSHomeDirectory来获取 。外部root进程怎么获取这个呢 。当一个app启动时候。他自己会初始化AB79DE90-18B3-476C-165C-53B58D569482这个目录 这个目录路径应该是放在系统的某个地方 。。不然app凭什么自己知道这个目录 。求大神告知这个目录的路径存放在系统哪个位置

+ (NSString *)sandBoxForBundleIdentify:(NSString *)bundleID {
    Class cls = NSClassFromString(@"LSApplicationWorkspace");
    id s = [(id)cls performSelector:@selector(defaultWorkspace)];
    NSArray *array = [s performSelector:@selector(allApplications)];
    Class LSApplicationProxy_class = NSClassFromString(@"LSApplicationProxy");
    for (LSApplicationProxy_class in array){
        NSString *strBundleID = [LSApplicationProxy_class performSelector:
            @selector(bundleIdentifier)];
        // NSString *strVersion =  [LSApplicationProxy_class performSelector:@selector(bundleVersion)];
        // NSString *strShortVersion =  [LSApplicationProxy_class performSelector:
        //     @selector(shortVersionString)];
        NSURL *strContainerURL = [LSApplicationProxy_class performSelector:@selector(containerURL)];
        NSString *strContainerDataPath = [strContainerURL path];
        // NSURL *strResourcesDirectoryURL = [LSApplicationProxy_class performSelector:
        //     @selector(resourcesDirectoryURL)];
        // NSString *strContainerBundlePath = [strResourcesDirectoryURL path];
        // NSString *strLocalizedName = [LSApplicationProxy_class performSelector:
        //     @selector(localizedName)];
        // NSString *strBundleExecutable = [LSApplicationProxy_class performSelector:
        //     @selector(bundleExecutable)];
        if ([strBundleID isEqualToString:bundleID]) {
            return strContainerDataPath;
        }
    }
    return nil;
}

获取到了 非常感谢