sysdiagnosed
executablemacOS1.6 MBx86_64, arm64
Bluetooth management daemon — controls pairing, connection, and device discovery
Manages Bluetooth hardware initialization, device scanning, pairing procedures, and connection state across classic and low-energy transports. Exposes four XPC services for system components and applications to query paired devices, initiate connections, and manage device properties. Maintains persistent device records in private storage and accesses Keychain for storing link keys and security credentials. Collects diagnostic telemetry about Bluetooth events and device interactions via Apple's unified analytics framework. Monitors network reachability and shares an application group container with related wireless components.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1.6 MB
- UUID
- C5186BD0-CD0B-3597-85F3-7853A8D360EB
- Analyzed
- 2026-04-09T10:07:35Z
- CDHash
- 8dfec545ee57ab6657b397e6ce6f0ccbf12b79756c1d9e095fcea77e22acae93
Capabilities
NetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationStoragePrivate storage area access
com.apple.private.security.storage.sysdiagnose.sysdiagnose[object Object]HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitHardwareWiFi interface control
/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLANHardwareBluetooth device access
/System/Library/Frameworks/IOBluetooth.framework/Versions/A/IOBluetoothHardwareBluetooth LE device access
/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetoothIpcRestricted application group access
com.apple.private.security.restricted-application-groupsIpcShared application group container access
com.apple.security.application-groupsAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks28
libsysdiagnose.dylibFoundationCoreFoundationCrashReporterSupportlibSystem.B.dyliblibarchive.2.dylibLoggingSupportIOKitlibParallelCompression.dylib(weak)CoreAnalyticslibMobileGestalt.dylibRemoteXPCRemoteServiceDiscoverylibTLE.dylibAppleMobileFileIntegritylibtailspin.dylib(weak)CacheDelete(weak)CoreGraphics(weak)CoreServicesCoreWLANSecuritySystemConfigurationIOBluetooth(weak)MobileBluetooth(weak)Seeding(weak)TapToRadarKit(weak)CoreBluetooth(weak)libobjc.A.dylib
Entitlements18
Interesting Strings
Bundle IDs(134)
File Paths(209)
/AppleInternal/Library/Bundles/SentryInternalResources.bundle/Contents/Resources/STYWhitelistedBundleIds-macOS.plist/AppleInternal/Library/Bundles/SentryInternalResources.bundle/Contents/Resources/STYWhitelistedCategories-Responsiveness-macOS.plist/AppleInternal/Library/Bundles/SentryInternalResources.bundle/Contents/Resources/STYWhitelistedNames-Responsiveness-macOS.plist/AppleInternal/Library/Bundles/SentryInternalResources.bundle/Contents/Resources/STYWhitelistedSubsystems-Responsiveness-macOS.plist/AppleInternal/Library/Frameworks/TapToRadarDaemon.framework/Support/taptoradard
telemetry(74)
Network Surface
Networking Frameworks
Endpoints(15)
Hostnamesysdiagnose-1527.40.7
Hostnameeos-restore-options.json.txt
Hostnamesystem.log.0.gz
Hostnamesystem.log.1.gz
Hostnameips.ca
Hostnamelaunchd.log.1
Hostnamelaunchd.log.2
Hostnamewlan.dk
Ipv60:8:16
Hostnamewww.apple.com
Hostnamecrl.apple.com
DNA Capability Vector
Location
0
Keychain
0
Network
1
Storage
2
Hardware
4
IPC
2
Analytics
1
Security
1
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
74
File Paths
209
Bundle IDs
134
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1611 functions identified
Functions(1611)
0x100001750-[SystemDiagnostic getAutogenTimeSensitiveContainers]
0x1000024c0sub_1000024c0
0x100002928sub_100002928
0x100002a50sub_100002a50
0x100002a58sub_100002a58
0x100002a60-[SystemDiagnostic getAutogenLogGenerationContainers]
0x100005158-[SystemDiagnostic getAutogenLogCopyingContainers]
0x100006d3c+[SystemDiagnosticBT sharedInstance]
0x100006d80sub_100006d80
0x100006dc0-[SystemDiagnosticBT init]
0x100006e6c-[SystemDiagnosticBT attachToBTSession]
0x100006fe8sub_100006fe8
0x100006ff0-[SystemDiagnosticBT startBTSession:]
0x100007114sub_100007114
0x100007150sub_100007150
0x100007198sub_100007198
0x1000071d8-[SystemDiagnosticBT startBTSessionAndTriggerAirPodLogs:]
0x1000074d4sub_1000074d4
0x10000753c-[SystemDiagnosticBT isLimitedLoggingEnabled]
0x100007880sub_100007880
Imports436 symbols from 24 dylibs
Exports1
_mh_execute_header0x0