transparencyd

executablemacOS7.7 MBx86_64, arm64

Apple identity and messaging service — authenticates users and synchronizes encrypted communications

Handles Apple ID authentication, iMessage service activation, and synchronization of encrypted messaging data across devices. Accesses the Secure Enclave for cryptographic operations and manages device encryption keys through the keychain. Makes outgoing network connections to Apple endpoints for account verification and message delivery. Registers multiple XPC services for inter-process communication with system components and applications. Evaluates feature flags to control behavior based on server configuration.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 7.7 MB
UUID: B8468B87-8541-34EC-B0D6-F6E60CDA0709
Analyzed: 2026-04-09T10:09:36Z
CDHash: 597a7d420c582b905692e3d15536d9ace13c9d7129153fb56e4f7501f8ea1ab8

Capabilities

KeychainAccess Secure Enclave sealed keys (SIK)

com.apple.keystore.sik.access [object Object]

KeychainKeychain access group membership

keychain-access-groups

com.apple.ProtectedCloudStorage.KTAccountKey

KeychainDevice key bag (encryption keys)

/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag

NetworkMake outgoing network connections

com.apple.security.network.client [object Object]

NetworkCore networking (HTTP, FTP, DNS)

/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork

NetworkiCloud data sync

/System/Library/Frameworks/CloudKit.framework/Versions/A/CloudKit

NetworkModern networking framework (NWConnection)

/System/Library/Frameworks/Network.framework/Versions/A/Network

StoragePrivate storage area access

com.apple.private.security.storage.SFAnalytics [object Object]

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-only

/private/var/mobile/Library/OSAnalytics/Preferences/

StorageAddress book access

/System/Library/Frameworks/Contacts.framework/Versions/A/Contacts

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

IpcRestricted application group access

com.apple.private.security.restricted-application-groups

group.com.apple.transparency

IpcShared application group container access

com.apple.security.application-groups

group.com.apple.transparency

IpcException: access additional Mach services

com.apple.security.exception.mach-lookup.global-name

com.apple.AppleVirtualPlatform.IdentityService

IpcApple identity/messaging services (iMessage)

/System/Library/PrivateFrameworks/IDS.framework/Versions/A/IDS

IpcApple identity/messaging services (iMessage)

/System/Library/PrivateFrameworks/IDSFoundation.framework/Versions/A/IDSFoundation

SecurityHardened runtime process

com.apple.developer.hardened-process [object Object]

SecurityApple ID authentication

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKit

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SecurityCryptographic operations

/System/Library/Frameworks/CryptoKit.framework/Versions/A/CryptoKit

SystemFeature flag evaluation

/System/Library/PrivateFrameworks/FeatureFlags.framework/Versions/A/FeatureFlags

Entitlements50

application-identifier com.apple.transparencyd

aps-connection-initiatetrue

com.apple.TapToRadarKit.service-accesstrue

com.apple.accounts.appleaccount.fullaccesstrue

com.apple.accounts.idms.fullaccesstrue

com.apple.application-identifier com.apple.transparencyd

com.apple.authkit.client.internaltrue

com.apple.authkit.client.privatetrue

com.apple.cdp.utilitytrue

com.apple.developer.hardened-processtrue

com.apple.developer.icloud-container-environment Production

com.apple.developer.icloud-services

com.apple.developer.ubiquity-kvstore-identifier com.apple.Transparency.KT

com.apple.keystore.sik.accesstrue

com.apple.mobileactivationd.bridgetrue

com.apple.mobileactivationd.device-identifierstrue

com.apple.mobileactivationd.spitrue

com.apple.private.accounts.allaccountstrue

com.apple.private.applecredentialmanager.allowtrue

com.apple.private.aps-connection-initiatetrue

com.apple.private.ckkstrue

com.apple.private.ckks.currentitempointers_readtrue

com.apple.private.cloudkit.buddyAccesstrue

com.apple.private.cloudkit.serviceNameForContainerMap <dict>

com.apple.private.cloudkit.setEnvironmenttrue

com.apple.private.cloudkit.spitrue

com.apple.private.cloudkit.systemServicetrue

com.apple.private.followuptrue

com.apple.private.ids.event-reportingtrue

com.apple.private.ids.key-transparency.cache-clear-requesttrue

com.apple.private.ids.key-transparency.optin-checktrue

com.apple.private.ids.registration

com.apple.madrid

com.apple.private.ids.remotecredentialstrue

com.apple.private.ids.remoteurlconnectiontrue

com.apple.private.imcore.imremoteurlconnectiontrue

com.apple.private.octagontrue

com.apple.private.osanalytics.defaults.allowtrue

com.apple.private.protectedcloudstorage.keysyncingtrue

com.apple.private.sandbox.profile:embedded transparencyd

com.apple.private.security.restricted-application-groups

group.com.apple.transparency

com.apple.private.security.storage.SFAnalyticstrue

com.apple.private.tcc.allow

kTCCServiceLiverpool kTCCServiceAddressBook kTCCServiceContacts

com.apple.security.application-groups

group.com.apple.transparency

com.apple.security.attestation.accesstrue

com.apple.security.exception.files.absolute-path.read-only

/private/var/mobile/Library/OSAnalytics/Preferences/

com.apple.security.exception.mach-lookup.global-name

com.apple.AppleVirtualPlatform.IdentityService

com.apple.security.network.clienttrue

com.apple.transparency.storage com.apple.transparency.storage

com.apple.transparency.transparencydtrue

keychain-access-groups

com.apple.ProtectedCloudStorage.KTAccountKey

Interesting Strings

Bundle IDs(183)

com.apple.application-identifier com.apple.authkit.client.private !com.apple.authkit.client.internal !com.apple.security.network.client "com.apple.accounts.idms.fullaccess

File Paths(111)

/AppleInternal/Library/BuildRoots/4~B_wbugBi66BcEzf_mnM3kMLYB3YpjuDzEFcQb8c/Library/Caches/com.apple.xbs/Sources/AppleKeyStore_libs/aeskeywrap.c /AppleInternal/Library/BuildRoots/4~B_wbugBi66BcEzf_mnM3kMLYB3YpjuDzEFcQb8c/Library/Caches/com.apple.xbs/Sources/AppleKeyStore_libs/backup_serialize.c /AppleInternal/Library/BuildRoots/4~B_wbugBi66BcEzf_mnM3kMLYB3YpjuDzEFcQb8c/Library/Caches/com.apple.xbs/Sources/AppleKeyStore_libs/platform/platform.c /AppleInternal/Library/BuildRoots/4~B_wbugBi66BcEzf_mnM3kMLYB3YpjuDzEFcQb8c/Library/Caches/com.apple.xbs/Sources/AppleKeyStore_libs/platform/platform_lib.c /AppleInternal/Library/BuildRoots/4~B_wbugBi66BcEzf_mnM3kMLYB3YpjuDzEFcQb8c/Library/Caches/com.apple.xbs/Sources/AppleKeyStore_libs/shared_crypto.c

telemetry(124)

,com.apple.private.osanalytics.defaults.allow .com.apple.private.security.storage.SFAnalytics 4/private/var/mobile/Library/OSAnalytics/Preferences/0h <key>com.apple.private.osanalytics.defaults.allow</key><key>com.apple.private.security.storage.SFAnalytics</key>

URLs & Endpoints(9)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://init-kt.apple.com/init/getBag

Network Surfaceentitled

Networking Frameworks

CFNetwork CoreFoundation Foundation IDSFoundation Network libswiftCoreFoundation.dylib

Endpoints(13)

Hostnametype.googleapis.com

Urlhttps://init-kt.apple.com/init/getBag

Hostnameinit-kt.apple.com

Hostnameinit-kt-qa1.ess.apple.com

Hostnameinit-kt-qa2.ess.apple.com

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

Methods

-[TransparencyNetworkRequest initWithURL:data:timeout:httpMethod:uuid:]

DNA Capability Vector

Location

0

Keychain

3

Network

4

Storage

3

Hardware

1

IPC

5

Analytics

0

Security

4

System

1

Behavioral Profile

URL Endpoints

9

Telemetry Strings

124

File Paths

111

Bundle IDs

183

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codee272a4c81867e8d1dc2b1acba0c63ddf6f87d152b407659e75c32a7f3fd7ac7c

Imports9c578547a94782173af1f6f90ddea343e56cc13c79f3c9488273d548d9ac3c46

Frameworks5104703cd5a3f8e6b61fef6631db6be9a1ef0f710f8420f4f19eb8a76c578d30

Classesa80cd38ffe26b35f2923f28a9ca79154d99e7c5b0ed348631a4b3d30f176120e

Entitlements051d8eb03a02e5c846d441ce29960760fe98243bc14e2cbe621906351119a73d

Symbolse651d455fe8bc4be77358d287302279cdd79e1807439bcab32db3ff36e7e36ef

Static Libraries0 / 16061 functions identified

Functions(16061)

0x100002208+[KTCoreDataSTStaticKey fetchRequest]

0x10000221c-[KTContext validatePendingSMTs:singleQuery:error:]

0x10000273csub_10000273c

0x100002954sub_100002954

0x10000299csub_10000299c

0x1000029fcsub_1000029fc

0x100002a54-[KTContext validatePendingSMTsForSingleQuery:]

0x100002ce8sub_100002ce8

0x100002e1csub_100002e1c

0x100002e64sub_100002e64

0x100002ea0sub_100002ea0

0x100002edcsub_100002edc

0x100002f24sub_100002f24

0x100002f6c-[KTContext validatePendingSMTsForBatchQuery:]

0x100002ffcsub_100002ffc

0x100003044-[KTContext validatePendingSMTsForRpcId:]

0x1000031b4sub_1000031b4

0x1000032d4sub_1000032d4

0x10000331csub_10000331c

0x100003324sub_100003324

Imports1366 symbols from 37 dylibs

libswiftCore.dylib285 Foundation205 libSystem.B.dylib189 Transparency161 InternalSwiftProtobuf78

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

transparencyStaticKey

swtransparencyd

securityuploadd

searchpartyuseragent