powerdatad

executablemacOS254.8 KBx86_64, arm64

System diagnostics and telemetry collector — gathers hardware, performance, and analytics data

Collects system diagnostics including hardware status, performance metrics, and location information, then submits telemetry to Apple endpoints. Accesses IOKit for hardware and power state reporting, queries the device key bag for encryption keys, and reads system configuration files from private storage areas. Exposes two XPC services for other system processes to request diagnostic data. Makes outgoing network connections to transmit analytics and connects to Keychain for certificate-based operations.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 254.8 KB
UUID: 2743343E-29B9-3631-9C38-6AE646E12AD9
Analyzed: 2026-04-09T09:59:48Z
CDHash: fe686d513c6b21fcff613984d5433af2bf9e27a63344276d1335014e55fdb6cc

Capabilities

LocationAccess location as a system bundle (no user prompt)

com.apple.locationd.effective_bundle [object Object]

KeychainDevice key bag (encryption keys)

/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag

NetworkMake outgoing network connections

com.apple.security.network.client [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.SoC [object Object]

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-only

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-write

/private/var/db/SoC//private/var/root/Library/Preferences/

HardwareException: access additional IOKit user clients

com.apple.security.exception.iokit-user-client-class

IOReportUserClient

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

HardwareIOKit power/performance reporting

/usr/lib/libIOReport.dylib

IpcException: access additional Mach services

com.apple.security.exception.mach-lookup.global-name

com.apple.locationd.synchronous com.apple.locationd.registration com.apple.powerlog.plxpclogger.xpc com.apple.griddatad.registration

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

Frameworks13

CoreAnalytics PowerLog OSAnalytics SoftLinking libMobileGestalt.dylib MobileKeyBag IOKit Security libIOReport.dylib Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements13

Interesting Strings

Bundle IDs(43)

com.apple.griddatad.registration0Y com.apple.locationd.registration !com.apple.security.network.client "com.apple.powerlog.plxpclogger.xpc $com.apple.locationd.effective_bundle

File Paths(32)

&/private/var/root/Library/Preferences/0L /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit /System/Library/Frameworks/Security.framework/Versions/A/Security

telemetry(22)

/System/Library/LocationBundles/CarbonAnalytics.bundle /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics /System/Library/PrivateFrameworks/OSAnalytics.framework/Versions/A/OSAnalytics Current accum telemetry %@Energy telemetry unsupported. De-registering xpc activity

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surfaceentitled

Networking Frameworks

CoreFoundation Foundation

Endpoints(7)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

1

Keychain

1

Network

1

Storage

3

Hardware

3

IPC

1

Analytics

1

Security

1

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

22

File Paths

32

Bundle IDs

43

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code73459a3d46ed98dc3784066313feed70754ba845389412554262f92b0b243b85

Importsf7ad173f2560b2c78d730991ce96a1c1ddca3cb6467acd9de9ae243a7eb422af

Frameworks8f715b62e75f693e58b0d1f9d364164e8b1e583c3629ac1e99df57fe9b6ab13b

Classesf740b3e48aa79c6b398265922cb6a6e41d291a1de50f8d1a76bb8a8a5927eba8

Entitlements116ecfe079df7bc6d3e41b2d7491ce297eeb0ada6083067a6680d333d9594b3c

Symbols1cf29135ab791e91b3c9772c1cd6232540f1e4db4636760998dab4aed94aac25

Static Libraries0 / 166 functions identified

Functions(166)

0x100001080sub_100001080

0x10000110csub_10000110c

0x1000012e0sub_1000012e0

0x1000013f8sub_1000013f8

0x10000155csub_10000155c

0x1000015f8sub_1000015f8

0x1000016d8sub_1000016d8

0x1000016e0sub_1000016e0

0x1000016e8sub_1000016e8

0x100001830sub_100001830

0x100001978sub_100001978

0x100001994sub_100001994

0x1000019a0sub_1000019a0

0x100001a88sub_100001a88

0x100001b80sub_100001b80

0x100001c98-[EnergyTelemetry init]

0x100001ee8sub_100001ee8

0x100001fc8+[EnergyTelemetry sharedInstance]

0x10000200csub_10000200c

0x10000204c-[EnergyTelemetry getUTCMidnightFor:]

Imports124 symbols from 12 dylibs

libSystem.B.dylib38 libobjc.A.dylib24 CoreFoundation23 libIOReport.dylib14 Foundation12

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

proactiveeventtrackerd

powerexperienced

thermalmonitord

securityuploadd