appleh13camerad

executablemacOS3.1 MBarm64

Diagnostic telemetry daemon — collects and submits system health data to Apple

Gathers diagnostic information about system performance, hardware state, and software health, then submits reports to Apple's analytics infrastructure. Accesses the Secure Enclave through sealed keys for authenticated reporting. Communicates with 13 network endpoints and submits data via Apple unified analytics and symptom diagnostic protocols. Exposes an XPC service for other system components to contribute telemetry data. Performs direct hardware communication to inspect device state and driver health.AI

Fingerprint

Platform: macOS
Type: executable
Arch: arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 3.1 MB
UUID: 0E21A95B-C22C-3E6A-BD4E-580235472DED
Analyzed: 2026-04-09T09:41:38Z
CDHash: 6bf5c6d2814c293cf576a623fba8da0ae6a5efaa24af4c9ec8ed75a0dc72dab1

Capabilities

KeychainAccess Secure Enclave sealed keys (SIK)

com.apple.keystore.sik.access [object Object]

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

IpcProtocol buffer serialization

/System/Library/PrivateFrameworks/ProtocolBuffer.framework/Versions/A/ProtocolBuffer

AnalyticsSubmit symptom diagnostic reports

com.apple.symptom_diagnostics.report [object Object]

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

Entitlements13

com.apple.aned.private.allowtrue

com.apple.camera.iokit-user-accesstrue

com.apple.coreaudio.register-internal-austrue

com.apple.driver.VADResource.user-accesstrue

com.apple.keystore.sik.accesstrue

com.apple.pearl.iokit-user-accesstrue

com.apple.photondetector.iokit-user-accesstrue

com.apple.private.ZhuGeSupport.CopyValuetrue

com.apple.private.cmio.extension.configurationtrue

com.apple.private.tcc.manager.check-by-audit-token

kTCCServiceCamera

com.apple.security.iokit-user-client-class

AGXCommandQueue AGXDevice AGXDeviceUserClient AGXSharedUserClient AppleH13CamInUserClient H11ANEInDirectPathClient H1xANELoadBalancerDirectPathClient IOAccelContext IOAccelContext2 IOAccelDevice IOAccelDevice2 IOAccelSharedUserClient IOAccelSharedUserClient2 IOAccelSubmitter2 IOSurfaceRootUserClient VADResourceArbiterUserClient ApplePhotonDetectorUserClient IOUserClient

com.apple.symptom_diagnostics.reporttrue

com.apple.systemstatus.publisher.domains

Interesting Strings

Bundle IDs(64)

!com.apple.pearl.iokit-user-access "com.apple.camera.iokit-user-access $com.apple.symptom_diagnostics.report (com.apple.driver.VADResource.user-access (com.apple.private.ZhuGeSupport.CopyValue

File Paths(40)

%s/reference-%s.plist .plist /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

telemetry(8)

$com.apple.symptom_diagnostics.report *** Metrics for command %d ****** Metrics report for firmware work processor ***/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics <key>com.apple.symptom_diagnostics.report</key>

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(13)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

HostnameAppleH13CameraInterface-10.101.0

Hostnamemacosx26.1.internal

Hostnameh.8.3.7.R

Hostname3.5.6L5R3X1d

Hostnamep.B.2.8.S

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

1

Network

0

Storage

0

Hardware

1

IPC

1

Analytics

2

Security

0

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

8

File Paths

40

Bundle IDs

64

IOKit Constants

0

Library Functions

3

Structural HashesSHA-256

Codec7d450fd9080c548c03c8ad34af1e3e5fa320a16095439952b9db5e0145edfda

Imports1e6e3b3c9bb4b58de42b0e8ce8235ae1bd45ca6614f12394b8732da98bae87d0

Frameworks25c92eb49a5d41c95855b895cdf6416937d4b431d17f4d3ccf9b46a14a314bd8

Classes24948baff636f14b0c56c3255647a883d2fbcee85685be91900423c63e9d9e8f

Entitlements73f862a31b0b3e26f09925133e75b23ca2f44805af0913d147284fe53a91e93b

Symbolsd2583e0869e3afa49c77af47eb785922934d5702e81a9991ae7fc4eaa5d21777

Static Libraries3 / 891 functions identified

Identified Libraries

flatbuffers 25.9.23 (2 fn)tesseract 5.5.2 (1 fn)

Functions(891)

0x1000016d0-[H13ISPExtensionDeviceShim init:device:channel:]

0x1000018e0sub_1000018e0

0x1000018e8-[H13ISPExtensionDeviceShim dealloc]

0x100001a18-[H13ISPExtensionDeviceShim getDeviceObject]

0x100001a28-[H13ISPExtensionDeviceShim sendSuspendNotification:]

0x100001adc-[H13ISPExtensionDeviceShim availableProperties]

0x100001aec-[H13ISPExtensionDeviceShim devicePropertiesForProperties:error:]

0x100001b04-[H13ISPExtensionDeviceShim setDeviceProperties:error:]

0x100001b1csub_100001b1c

0x100001b80sub_100001b80

0x100001c2csub_100001c2c

0x100001c68sub_100001c68

0x1000022dcsub_1000022dc

0x100002618sub_100002618

0x10000290csub_10000290c

0x10000298csub_10000298c

0x100002b98sub_100002b98

0x100002bccsub_100002bcc

0x100002d00sub_100002d00

0x100002efcsub_100002efc

Imports876 symbols from 21 dylibs

CMCaptureCore399 libSystem.B.dylib158 CoreFoundation91 CoreVideo63 libc++.1.dylib30

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

appleh16camerad

endpointsecurityd

MobileGestaltHelper