MobileGestaltHelper

JSON
executablemacOS136.6 KBx86_64, arm64

Secure enclave key manager — accesses and manages hardware-sealed cryptographic keys

Manages cryptographic keys stored in the Secure Enclave through direct hardware communication. Provides XPC services that allow other system processes to access sealed keys (SIK) for cryptographic operations. Communicates with 7 network endpoints and collects 4 telemetry signals, likely reporting key usage and system state to Apple. References 37 bundle identifiers, indicating integration with multiple system and application components for key provisioning and authentication workflows.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
136.6 KB
UUID
2DCEA3F5-AD41-34A4-B4EF-7A6726550CBD
Analyzed
2026-04-09T09:39:25Z
CDHash
044724799e85138835adc5a149be104461cdd3d05f618f26a10724dcb8bfe49e

Capabilities

Interesting Strings

Network Surface

Networking Frameworks

DNA Capability Vector

Location
0
Keychain
1
Network
0
Storage
0
Hardware
1
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
4
File Paths
6
Bundle IDs
37
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 24 functions identified

Functions(24)

0x100000c98sub_100000c98
0x100000da0-[MobileGestaltHelperListener listener:shouldAcceptNewConnection:]
0x100000e30-[MobileGestaltHelperListener processNameForConnection:]
0x100001094-[MobileGestaltHelperListener getSpringboardRegionOverride:reply:]
0x10000112c-[MobileGestaltHelperListener getServerAnswerForQuestion:reply:]
0x10000148c-[MobileGestaltHelperListener getAppleTVMode:]
0x100001504-[MobileGestaltHelperListener rebuildCache:]
0x100001640-[MobileGestaltHelperListener setCacheSentinel:]
0x100001788-[MobileGestaltHelperListener queryBootUUID]
0x1000018c4-[MobileGestaltHelperListener getSentinelPath]
0x1000018d8-[MobileGestaltHelperListener setCacheSentinel]
0x1000019d8-[MobileGestaltHelperListener needsNewCachePostBoot]
0x100001c18sub_100001c18
0x100001de0sub_100001de0
0x100001e0csub_100001e0c
0x100001ed8sub_100001ed8
0x100001f14sub_100001f14
0x100001f50sub_100001f50
0x100001f60sub_100001f60
0x100001f6csub_100001f6c

Imports56 symbols from 5 dylibs

Exports1

_mh_execute_header0x0