Saurik 果然大神，他的那套搞不定，有懂得麻烦分享下。
俺用原来的Theos 语法搞定。这是5s 9.3.3 上dump 出来的lockdown 可以启动的service.plist,很多服务名称都不在这个列表里面了，但是原来的可执行程序还在。另外多了ATC2 这个看来苹果又要搞一套正版同步的了？
分享出来给有用的同学
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.PurpleReverseProxy.Conn</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.PurpleReverseProxy.Conn</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.PurpleReverseProxy.Conn</string>
</dict>
<key>com.apple.PurpleReverseProxy.Ctrl</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.PurpleReverseProxy.Ctrl</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.PurpleReverseProxy.Ctrl</string>
</dict>
<key>com.apple.afc</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.afc</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.afcd</string>
</dict>
<key>com.apple.afc2</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.afc2</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afc2d</string>
<string>-S</string>
<string>-L</string>
<string>-d</string>
<string>/</string>
</array>
</dict>
<key>com.apple.ait.aitd</key>
<dict>
<key>Label</key>
<string>com.apple.ait.aitd</string>
<key>USBOnlyService</key>
<true/>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.ait.client</string>
</dict>
<key>com.apple.atc</key>
<dict>
<key>Label</key>
<string>com.apple.atc</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.atc</string>
</dict>
<key>com.apple.atc2</key>
<dict>
<key>Label</key>
<string>com.apple.atc2</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.atc2</string>
</dict>
<key>com.apple.companion_proxy</key>
<dict>
<key>Label</key>
<string>com.apple.companion_proxy</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.companion_proxy</string>
</dict>
<key>com.apple.crashreportcopymobile</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.crashreportcopymobile</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.crashreportcopymobile</string>
</dict>
<key>com.apple.crashreportmover</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.crashreportmover</string>
<key>XPCServiceName</key>
<string>com.apple.crash_mover</string>
</dict>
<key>com.apple.idamd</key>
<dict>
<key>Label</key>
<string>com.apple.idamd</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.idamd</string>
</dict>
<key>com.apple.iosdiagnostics.relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.iosdiagnostics.relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/ios_diagnostics_relay</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.misagent</key>
<dict>
<key>Label</key>
<string>com.apple.misagent</string>
<key>XPCServiceName</key>
<string>com.apple.misagent</string>
</dict>
<key>com.apple.mobile.MCInstall</key>
<dict>
<key>AllowUnactivatedService</key>
<false/>
<key>Label</key>
<string>com.apple.mobile.MCInstall</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mc_mobile_tunnel</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.assertion_agent</key>
<dict>
<key>Label</key>
<string>com.apple.mobile.assertion_agent</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.mobile.assertion_agent</string>
</dict>
<key>com.apple.mobile.diagnostics_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.diagnostics_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_diagnostics_relay</string>
</array>
</dict>
<key>com.apple.mobile.file_relay</key>
<dict>
<key>Label</key>
<string>com.apple.mobile.file_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_file_relay</string>
</array>
</dict>
<key>com.apple.mobile.heartbeat</key>
<dict>
<key>Label</key>
<string>HeartBeat Monitor</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.lockdown.host_watcher</string>
</dict>
<key>com.apple.mobile.house_arrest</key>
<dict>
<key>InstanceLimit</key>
<integer>5</integer>
<key>Label</key>
<string>com.apple.mobile.house_arrest</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_house_arrest</string>
</array>
</dict>
<key>com.apple.mobile.insecure_notification_proxy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.insecure_notification_proxy</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.mobile.insecure_notification_proxy</string>
</dict>
<key>com.apple.mobile.installation_proxy</key>
<dict>
<key>Label</key>
<string>com.apple.mobile.installation_proxy</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.mobile.installation_proxy</string>
</dict>
<key>com.apple.mobile.mobile_image_mounter</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.mobile_image_mounter</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_storage_proxy</string>
</array>
</dict>
<key>com.apple.mobile.notification_proxy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.notification_proxy</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.mobile.notification_proxy</string>
</dict>
<key>com.apple.mobileactivationd</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobileactivationd</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.mobileactivationd.lockdown</string>
</dict>
<key>com.apple.mobilebackup</key>
<dict>
<key>InstanceLimit</key>
<integer>5</integer>
<key>Label</key>
<string>com.apple.mobilebackup</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BackupAgent</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.mobilebackup2</key>
<dict>
<key>InstanceLimit</key>
<integer>5</integer>
<key>Label</key>
<string>com.apple.mobilebackup2</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BackupAgent2</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.mobilesync</key>
<dict>
<key>InstanceLimit</key>
<integer>5</integer>
<key>Label</key>
<string>com.apple.mobilesync</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/SyncAgent</string>
<string>--lockdown</string>
<string>--oneshot</string>
<string>-v</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.os_trace_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.syslog_relay</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.os_trace_relay</string>
</dict>
<key>com.apple.pcapd</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.pcapd</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/pcapd</string>
</array>
<key>USBOnlyService</key>
<true/>
</dict>
<key>com.apple.preboardservice</key>
<dict>
<key>Label</key>
<string>com.apple.preboardservice</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.preboardservice</string>
</dict>
<key>com.apple.springboardservices</key>
<dict>
<key>Label</key>
<string>com.apple.springboardservicesrelay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/springboardservicesrelay</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.streaming_zip_conduit</key>
<dict>
<key>Label</key>
<string>com.apple.streaming_zip_conduit</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.streaming_zip_conduit</string>
</dict>
<key>com.apple.syslog_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.syslog_relay</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.syslog_relay</string>
</dict>
<key>com.apple.webinspector</key>
<dict>
<key>Label</key>
<string>com.apple.webinspector</string>
<key>UserName</key>
<string>mobile</string>
<key>XPCServiceName</key>
<string>com.apple.webinspector</string>
</dict>
</dict>
</plist>