kernelmanager_helper
executablemacOS3.5 MBx86_64, arm64
Security credential manager — stores, retrieves, and authenticates with cryptographic keys and certificates
Manages storage and access to cryptographic credentials including certificates, keys, and authentication factors in the Secure Enclave and Keychain. Handles biometric authentication (Touch ID, Face ID) and password-based access to protected credentials. Communicates with hardware security components and exposes three XPC services for system components to request credential operations. Submits analytics to Apple about authentication events and system security state. Reads and modifies system NVRAM variables related to security configuration.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 3.5 MB
- UUID
- EAD56844-B713-326C-8CCE-BFD7037DFF52
- Analyzed
- 2026-04-09T09:52:48Z
- CDHash
- 628aa9b539f4341c36314dd49a4f5ce31c9ec28743f639194df4f96f70cb7a18
Capabilities
KeychainHardware key storage (Secure Enclave)
/System/Library/PrivateFrameworks/AppleKeyStore.framework/Versions/A/AppleKeyStoreStorageRead and write system NVRAM variables
com.apple.private.iokit.system-nvram-allow[object Object]StoragePrivate storage area access
com.apple.private.security.storage.SystemExtensionManagement[object Object]HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySecurityTouch ID / Face ID / password auth
/System/Library/Frameworks/LocalAuthentication.framework/Versions/A/LocalAuthenticationFrameworks39
DiskImages2libxcselect.dylib(weak)AppServerSupportAppleKeyStorelibcompression.dyliblibamsupport.dylibCoreServicesDiskManagementlibbootpolicy.dylib(weak)libKernelCollectionBuilder.dylibSystemPolicy(weak)Securitylibauthinstall.dyliblibimage4.dylib(weak)KernelManagementapfs_boot_mount(weak)libSystem.B.dylibIOKitFoundationlibobjc.A.dylibCoreFoundationDiskArbitrationLocalAuthenticationAPFSCollectionsInternalCoreAnalyticsLoggingSupportlibswiftCompression.dylib(weak)libswiftCore.dyliblibswiftCoreFoundation.dyliblibswiftDarwin.dyliblibswiftDispatch.dyliblibswiftIOKit.dyliblibswiftObjectiveC.dyliblibswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_DarwinFoundation1.dyliblibswift_DarwinFoundation2.dyliblibswiftos.dylib
Entitlements23
Interesting Strings
Bundle IDs(102)
File Paths(47)
/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/ACMLib/ACMLib.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibCall.c/AppleInternal/Library/BuildRoots/4~B_wtugAtpEAVzPW8qOi3wBsSB2lFPgbNBILLkvg/Library/Caches/com.apple.xbs/Sources/KernelManagement_executables/core/Errors.swift/AppleInternal/Library/BuildRoots/4~B_wtugAtpEAVzPW8qOi3wBsSB2lFPgbNBILLkvg/Library/Caches/com.apple.xbs/Sources/KernelManagement_executables/kernelmanager_helper/KernelManagerHelperDaemon.swift/Library/Apple/System/Library/Extensions/AppleKextExcludeList.kext
telemetry(12)
Network Surface
Networking Frameworks
Endpoints(23)
Ipv4100.6.2.6
Ipv4100.6.1.13
Ipv4100.6.1.18
Hostnamefield.1.2.840.113635.100.6.2.6
Hostnamefield.1.2.840.113635.100.6.1.13
Hostnamefield.1.2.840.113635.100.6.1.18
Ipv4100.6.1.9
Ipv4100.6.1.12
Ipv4100.6.2.1
Ipv4100.6.1.25
Hostnamefield.1.2.840.113635.100.6.1.9
Hostnamefield.1.2.840.113635.100.6.1.9.1
Hostnamefield.1.2.840.113635.100.6.1.12
Hostnamefield.1.2.840.113635.100.6.2.1
Ipv60:8:16
Hostnamewww.apple.com
Hostnamecrl.apple.com
DNA Capability Vector
Location
0
Keychain
1
Network
0
Storage
2
Hardware
1
IPC
0
Analytics
1
Security
2
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
12
File Paths
47
Bundle IDs
102
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 8067 functions identified
Functions(8067)
0x100001c00sub_100001c00
0x100001c58sub_100001c58
0x100001dc0sub_100001dc0
0x100001dd0sub_100001dd0
0x100001de0sub_100001de0
0x100002074sub_100002074
0x100002254sub_100002254
0x100002264sub_100002264
0x100002274sub_100002274
0x100002358sub_100002358
0x100002468sub_100002468
0x1000024b4sub_1000024b4
0x1000024f4sub_1000024f4
0x10000260csub_10000260c
0x100002630sub_100002630
0x100002668sub_100002668
0x100002698sub_100002698
0x1000026b4sub_1000026b4
0x1000026d0sub_1000026d0
0x100002710sub_100002710
Imports1145 symbols from 32 dylibs
Exports1
_mh_execute_header0x0