mobile_obliterator
executablemacOS390.1 KBx86_64, arm64
System configuration and NVRAM management — reads and writes low-level firmware settings
Manages system NVRAM variables and low-level firmware configuration on macOS. Accesses the device key bag for encryption operations and interacts with Keychain for certificate and code signing operations. Communicates directly with hardware and drivers through multiple private frameworks. Exposes an XPC service for other system components to query and modify settings. Connects to 7 network endpoints and references multiple bundle identifiers, suggesting integration with system preference mechanisms and Apple services.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 390.1 KB
- UUID
- 3AE517BE-A8CF-3E8D-9379-09E3AAFD9B2F
- Analyzed
- 2026-04-09T09:56:03Z
- CDHash
- e666b5514bf96955e3fd59c6affbb6fa013cb95bde96f81f8cfa42a6f0c501a0
Capabilities
KeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagStorageRead and write system NVRAM variables
com.apple.private.iokit.system-nvram-allow[object Object]StoragePrivate storage area access
com.apple.private.security.storage-exempt.heritable[object Object]HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks29
MultiverseSupportDiskArbitrationDiskManagementRemoteServiceDiscoveryBridgeOSObliterationlibbootpolicy.dyliblibIASUnifiedProgress.dylib(weak)IASUtilities(weak)apfs_boot_mountMediaKitlibarchive.2.dylibFoundationMSUDataAccessorBomServiceManagementAPFSlibz.1.dyliblibc++.1.dyliblibutil.dylibCoreFoundationCoreGraphics(weak)ImageIO(weak)IOKitIOSurfacelibMobileGestalt.dylibMobileKeyBagSecuritylibobjc.A.dyliblibSystem.B.dylib
Entitlements29
Interesting Strings
Bundle IDs(70)
File Paths(36)
telemetry(1)
Network Surface
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
1
Network
0
Storage
3
Hardware
1
IPC
0
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
1
File Paths
36
Bundle IDs
70
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 168 functions identified
Functions(168)
0x100001770sub_100001770
0x1000018ecsub_1000018ec
0x100001958+[DiskSupport sharedInstance]
0x1000019e8sub_1000019e8
0x100001a10sub_100001a10
0x100001a20sub_100001a20
0x100001a2c-[DiskSupport init]
0x100001b18-[DiskSupport roleName:]
0x100001cdc-[DiskSupport setNSErrorAndLog:errorCode:errorString:]
0x100001dcc-[DiskSupport scanAllDiskNamesForDeletableDisk:scanForDelete:scanForEACS:allowAnyContainer:]
0x100002a60sub_100002a60
0x100002b94-[DiskSupport allDeletableContainerDiskNames:allowAnyContainer:]
0x100002bf4-[DiskSupport deviceBeforeFreeSpace:]
0x100002c88-[DiskSupport getDADiskRef:]
0x100002ce8-[DiskSupport getVolumeIndex:]
0x100002d90-[DiskSupport deleteAPFSContainer:error:progressUpdater:]
0x1000031a4-[DiskSupport resizePreservedOSContainer:error:progressUpdater:]
0x100003334-[DiskSupport deleteAPFSVolume:]
0x1000033d8-[DiskSupport deletePartition:error:]
0x100003464-[DiskSupport deletePartitionByDiskRef:error:]
Imports216 symbols from 18 dylibs
Exports1
_mh_execute_header0x0