bluetoothuserd
executablemacOS1.3 MBx86_64, arm64
iMessage and contacts daemon — manages encrypted messaging, identities, and address book sync
Handles iMessage account registration, encryption key management, and contact identity resolution. Maintains persistent connections to Apple messaging infrastructure and syncs contact information with the local address book and iCloud. Accesses the device keychain and key bag for cryptographic operations, manages Bluetooth LE connections for nearby device discovery, and exposes 19 XPC services for system components and applications to query messaging state and send messages. Runs as a hardened runtime process with exceptions to access additional IOKit user clients and Mach services.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1.3 MB
- UUID
- 94EFB62D-AA5A-3E8A-93E3-6B501471372F
- Analyzed
- 2026-04-09T09:44:04Z
- CDHash
- bcbf65135830c6f5f2217514ac5576dc1a1b6e367316e4eb4a57aab5943bb338
Capabilities
KeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagNetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationStorageException: access additional file paths
com.apple.security.exception.files.home-relative-path.read-writeStorageAddress book access
/System/Library/Frameworks/Contacts.framework/Versions/A/ContactsHardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-classHardwareBluetooth LE device access
/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetoothIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-namecom.apple.accountsd.accountmanagercom.apple.aps.bluetoothuserdcom.apple.apsdcom.apple.bluetooth.xpccom.apple.bluetoothdcom.apple.clouddcom.apple.contactsdcom.apple.identityservicesd.embedded.authcom.apple.kvsdcom.apple.server.bluetoothcom.apple.server.bluetooth.le.att.xpccom.apple.usernotifications.listenercom.apple.usernotifications.usernotificationservice
IpcApple identity/messaging services (iMessage)
/System/Library/PrivateFrameworks/IDS.framework/Versions/A/IDSFrameworks41
libMobileGestalt.dylibAppleAccount(weak)ApplePushService(weak)BluetoothServices(weak)Contacts(weak)CoreBluetooth(weak)CoreUtils(weak)CloudKit(weak)IDS(weak)MobileKeyBag(weak)SystemConfiguration(weak)UserNotifications(weak)CoreBluetoothUI(weak)Foundationlibobjc.A.dyliblibSystem.B.dylibAccountsCoreFoundationBiomeLibraryCoreUtilsSwiftlibswiftAccelerate.dylib(weak)libswiftCompression.dylib(weak)libswiftCore.dyliblibswiftCoreAudio.dylib(weak)libswiftCoreFoundation.dyliblibswiftCoreImage.dylib(weak)libswiftCoreLocation.dylib(weak)libswiftCoreMIDI.dylib(weak)libswiftDispatch.dyliblibswiftIOKit.dylib(weak)libswiftMetal.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dyliblibswiftQuartzCore.dylib(weak)libswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_Concurrency.dyliblibswift_DarwinFoundation1.dyliblibswiftos.dyliblibswiftsimd.dylib(weak)
Entitlements40
com.apple.security.exception.mach-lookup.global-name
com.apple.accountsd.accountmanagercom.apple.aps.bluetoothuserdcom.apple.apsdcom.apple.bluetooth.xpccom.apple.bluetoothdcom.apple.clouddcom.apple.contactsdcom.apple.identityservicesd.embedded.authcom.apple.kvsdcom.apple.server.bluetoothcom.apple.server.bluetooth.le.att.xpccom.apple.usernotifications.listenercom.apple.usernotifications.usernotificationservice
Interesting Strings
Bundle IDs(169)
File Paths(19)
/System/Library/Frameworks/Accounts.framework/Versions/A/Accounts/System/Library/Frameworks/CloudKit.framework/Versions/A/CloudKit/System/Library/Frameworks/Contacts.framework/Versions/A/Contacts/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
telemetry(2)
Network Surface
Networking Frameworks
Endpoints(9)
DNA Capability Vector
Location
0
Keychain
2
Network
2
Storage
2
Hardware
2
IPC
2
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
5
Telemetry Strings
2
File Paths
19
Bundle IDs
169
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1799 functions identified
Functions(1799)
0x100001cb0sub_100001cb0
0x100001ce0sub_100001ce0
0x100001d28sub_100001d28
0x100001da4sub_100001da4
0x100001df4sub_100001df4
0x100001e00sub_100001e00
0x100001e60sub_100001e60
0x100001eb0sub_100001eb0
0x100001eb4sub_100001eb4
0x100001f2csub_100001f2c
0x100001f30sub_100001f30
0x100001f8csub_100001f8c
0x100001fecsub_100001fec
0x10000204csub_10000204c
0x1000020a8sub_1000020a8
0x1000020d8sub_1000020d8
0x100002254sub_100002254
0x100002258sub_100002258
0x1000025f0sub_1000025f0
0x100002720sub_100002720
Imports743 symbols from 24 dylibs
Exports1
_mh_execute_header0x0