odutil

executablemacOS262.2 KBx86_64, arm64

System service — manages Apple telemetry collection and reporting

Collects system diagnostics and telemetry data from the local machine and transmits it to Apple endpoints over the network. Operates as a system daemon with XPC service exposure for inter-process communication with other system components. Handles bundled data from multiple sources and prepares it for delivery to remote telemetry servers. Runs with minimal user-facing interface and operates in the background during normal system operation.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 262.2 KB
UUID: F5C9F2A7-9A0F-3EB8-8FF2-4FBC98C6D94E
Analyzed: 2026-04-07T05:21:12Z
CDHash: d174b9fce216bb51aa88b65ed566df1f129ddf87b0b72de6a728824e80b1e0f8

Frameworks6

LoggingSupport OpenDirectory Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements1

com.apple.private.logging.admintrue

Interesting Strings

Bundle IDs(8)

<key>com.apple.private.logging.admin</key>com.apple.odutil com.apple.opendirectoryd com.apple.private.logging.admin com.apple.private.opendirectoryd.rpc

File Paths(7)

/Library/OpenDirectory/Templates/%@.plist /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory /System/Library/OpenDirectory/Templates/%@.plist

telemetry(1)

_os_variant_has_internal_diagnostics

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(6)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

0

Hardware

0

IPC

0

Analytics

0

Security

0

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

1

File Paths

7

Bundle IDs

8

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codec8be2aa34a7de19aed8885969a58fc4997e9f6568d385d680ee83c588de613f0

Imports36608b6973196c618e450eef47fda260f86450fac5470016d691001e07b8b2c1

Frameworks3dc4b928d4566bb8dc2fd6fdf7a8d38ab5444c157c2eb970c06c6f664c96d196

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements8be93a5a07c7356fcbb8c30fb23b9e8646381a92a4e343e9ec93b8abb365214f

Symbols36608b6973196c618e450eef47fda260f86450fac5470016d691001e07b8b2c1

Static Libraries0 / 105 functions identified

Functions(105)

0x100000b88sub_100000b88

0x100000db0sub_100000db0

0x1000012fcsub_1000012fc

0x100001318sub_100001318

0x1000013acsub_1000013ac

0x100001428sub_100001428

0x100001444sub_100001444

0x100001460sub_100001460

0x1000014f0sub_1000014f0

0x100001558sub_100001558

0x100001638sub_100001638

0x100001654sub_100001654

0x100001708sub_100001708

0x100001730sub_100001730

0x100001980sub_100001980

0x100001a54sub_100001a54

0x100001ae8sub_100001ae8

0x100001d28sub_100001d28

0x10000208csub_10000208c

0x1000021ecsub_1000021ec

Imports139 symbols from 6 dylibs

libSystem.B.dylib76 CoreFoundation40 libobjc.A.dylib15 Foundation4 OpenDirectory3

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

KernelEventAgent