Windows Phone 7 applications can be launched via well-defined tasks, available in the SDK. However, that's only the cover of the entire navigation mechanism.
One key hint on how applications are actually launched is revealed if I look at the MarketplaceHubTask with Reflector, that will disassemble the internals. What interests me is the Show method that will actually invoke the task. Here is what's under the hood:
There is this static class - MarketplaceLauncher that also has a show method. Taking it one step further, I am using Reflector once again to disassemble it, and here is what I get at the very bottom of it:
ChooserHelper.Navigate seems to be the connection point that lets the system navigate across different applications. MeuxHelper.MakeUri is the URI normalizer, from what I understand, and in this case if I disassemble the method, I will see an actual app reference:
Internally, default apps are referred to via a GUID. Something that is not possible to do directly since the web browser is restricted as to what protocols are supported - app is not one of them. Also, there is no default launcher available that can accept app URIs.
This specific example shows that the GUID belongs to Zune, since that's how the Marketplace is accessed. The guys at XDA were working with the system registry and discovered a list of blacklisted applications (in the emulator image) with their associated GUIDs:
5B04B775-356B-4AA0-AAF8-6491FFEA5602 Say It
5B04B775-356B-4AA0-AAF8-6491FFEA5606 ~Date Time
5B04B775-356B-4AA0-AAF8-6491FFEA5607 ~Phone Lock Settings
5B04B775-356B-4AA0-AAF8-6491FFEA5609 Speed Type
5B04B775-356B-4AA0-AAF8-6491FFEA5611 Call History
5B04B775-356B-4AA0-AAF8-6491FFEA5617 Word Mobile
5B04B775-356B-4AA0-AAF8-6491FFEA5618 Excel Mobile
5B04B775-356B-4AA0-AAF8-6491FFEA5619 PowerPoint Mobile
5B04B775-356B-4AA0-AAF8-6491FFEA561A SharePoint Mobile
5B04B775-356B-4AA0-AAF8-6491FFEA561B OneNote Mobile
5B04B775-356B-4AA0-AAF8-6491FFEA561C ~Call Settings
5B04B775-356B-4AA0-AAF8-6491FFEA561D ~Contacts Settings
5B04B775-356B-4AA0-AAF8-6491FFEA561F ~Cell Settings
5B04B775-356B-4AA0-AAF8-6491FFEA5620 ~Bluetooth Settings
5B04B775-356B-4AA0-AAF8-6491FFEA5622 ~Office Mobile Settings
5B04B775-356B-4AA0-AAF8-6491FFEA5623 ~Wifi Settings
5B04B775-356B-4AA0-AAF8-6491FFEA5625 ~Find My Phone
5B04B775-356B-4AA0-AAF8-6491FFEA5626 ~Backup Settings
5B04B775-356B-4AA0-AAF8-6491FFEA5635 Picture Camera CPL
5B04B775-356B-4AA0-AAF8-6491FFEA5640 ~Device Update Settings
5B04B775-356B-4AA0-AAF8-6491FFEA5641 ~Location Settings
5B04B775-356B-4AA0-AAF8-6491FFEA5642 ~Location Settings
534c16be-a6d3-4560-a537-f5c9ccdb6ddc Microsoft Office
If you look through the list, you will notice that indeed the GUID I was talking about is associated with Zune. Currently, I am still trying to look for a way to force the application to invoke other apps from itself. There are restrictions since the default SDK code is maked as SecurityCritical, therefore I cannot access it in the sandbox via reflection.
But the fact that there are GUIDs and a protocol already means that there could be a possible way to trigger an application launch without a verified static class.