csrutil
executablemacOS390.3 KBx86_64, arm64
System authentication agent — manages biometric and credential-based access control
Handles authentication requests using Touch ID, Face ID, and password verification mechanisms. Reads and writes system NVRAM variables to persist authentication state and configuration. Communicates with hardware security components for biometric verification and maintains network connectivity with 6 endpoints for policy updates or authentication services. Enforces access control decisions across the system through 11 entitlements that govern privileged operations and sensor access.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 390.3 KB
- UUID
- 2F9645E5-D318-35EA-869E-4EB29E0101E0
- Analyzed
- 2026-04-07T05:21:12Z
- CDHash
- b258067f14cc554e7f82c6f4d8e074d0c48d2dc8688859b74739a5b06ec8c18f
Capabilities
StorageRead and write system NVRAM variables
com.apple.private.iokit.system-nvram-allow[object Object]HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitSecurityTouch ID / Face ID / password auth
/System/Library/Frameworks/LocalAuthentication.framework/Versions/A/LocalAuthenticationFrameworks13
Entitlements11
Interesting Strings
Bundle IDs(30)
File Paths(15)
/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/ACMLib/ACMLib.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/CommonUtil.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibCall.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibCallBlock.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibSerialization.c
Network Surface
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
1
Hardware
1
IPC
0
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
0
File Paths
15
Bundle IDs
30
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 549 functions identified
Functions(549)
0x100001018sub_100001018
0x100001038sub_100001038
0x100001114sub_100001114
0x100001134sub_100001134
0x100001210+[CSRRecoveryUser userWithName:fullName:UUID:]
0x1000012d8-[CSRRecoveryUser authenticationContextWithPassword:]
0x100001594-[CSRRecoveryUser userName]
0x1000015a0-[CSRRecoveryUser fullName]
0x1000015ac-[CSRRecoveryUser uuid]
0x1000015b8-[CSRRecoveryUser .cxx_destruct]
0x100001608-[CSROSInstall initWithDiskArbitrationSession:manager:volumeEntry:volumeGroupUUID:]
0x100001a24sub_100001a24
0x100001a9c+[CSROSInstall allEligibleOSInstallations]
0x100001ae0sub_100001ae0
0x100001c78+[CSROSInstall currentlyBootedInstall]
0x100001cbcsub_100001cbc
0x100001e94sub_100001e94
0x100001f28-[CSROSInstall recoveryUsers]
0x100002184sub_100002184
0x100002194sub_100002194
Imports174 symbols from 12 dylibs
Exports1
_mh_execute_header0x0