fskitd
executablemacOS892.1 KBx86_64, arm64
Application launcher and lifecycle manager — starts and monitors processes with restricted permissions
Launches and manages application lifecycles with enforced process isolation through restricted application group access. Controls process creation, termination, and lifecycle events via system capabilities. Maintains connections to keychain and certificate stores for credential and code signing verification. Exposes three XPC services that allow authorized clients to trigger application launches and query process state. References 48 bundle identifiers and multiple network endpoints, suggesting coordination with system services and remote reporting infrastructure.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 892.1 KB
- UUID
- 69D909CE-A210-373C-A7EB-2BC5AEF6F142
- Analyzed
- 2026-04-09T09:50:06Z
- CDHash
- a43ea126797825cefc25b02122f345150b889633f3727fe7ccfdeb67f510381c
Capabilities
IpcRestricted application group access
com.apple.private.security.restricted-application-groupsIpcShared application group container access
com.apple.security.application-groupsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks12
Entitlements14
Interesting Strings
Bundle IDs(48)
File Paths(11)
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration/System/Library/Frameworks/ExtensionFoundation.framework/Versions/A/ExtensionFoundation/System/Library/Frameworks/FSKit.framework/Versions/A/FSKit/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
Network Surface
Networking Frameworks
Endpoints(8)
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
2
Analytics
0
Security
1
System
1
Behavioral Profile
URL Endpoints
5
Telemetry Strings
0
File Paths
11
Bundle IDs
48
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1217 functions identified
Functions(1217)
0x100001060-[liveFilesMountServiceDelegate listener:shouldAcceptNewConnection:]
0x1000013d4sub_1000013d4
0x100001494sub_100001494
0x10000149csub_10000149c
0x1000014a4sub_1000014a4
0x1000014acsub_1000014ac
0x1000014b8sub_1000014b8
0x1000014c0sub_1000014c0
0x100001580sub_100001580
0x100001588sub_100001588
0x100001bd4sub_100001bd4
0x100001cd0sub_100001cd0
0x100001ce4sub_100001ce4
0x100001cf8sub_100001cf8
0x100002028sub_100002028
0x1000020f8sub_1000020f8
0x1000021f8sub_1000021f8
0x100002200sub_100002200
0x10000221csub_10000221c
0x100002228sub_100002228
Imports244 symbols from 12 dylibs
Exports1
_mh_execute_header0x0