diskimagesiod
executablemacOS4.8 MBx86_64, arm64
System service — manages hardware diagnostics and telemetry reporting
Collects system diagnostics, hardware metrics, and performance data across multiple device components. Communicates with Apple's telemetry infrastructure via outgoing network connections to submit analytics. Accesses IOKit hardware interfaces and Mach services to query device state, and uses the Keychain and cryptographic operations to secure communications. Exposes 4 XPC services for other system components to interact with diagnostics collection. Operates as a privileged system daemon with broad hardware and storage access.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 4.8 MB
- UUID
- 8C31BD9D-0B97-311C-8AC9-4C2480877DF0
- Analyzed
- 2026-04-09T09:47:41Z
- CDHash
- a63bd6999e580cc3cf2852f87453b4a0e3272a194637b9c86b4bdba4631793eb
Capabilities
NetworkCore networking (HTTP, FTP, DNS)
/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetworkStorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-onlyHardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-classHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-nameAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySecurityCryptographic operations
/System/Library/Frameworks/CryptoKit.framework/Versions/A/CryptoKitFrameworks28
CoreAnalyticsMediaKitlibAppleArchive.dylib(weak)libcurl.4.dylib(weak)CFNetworklibz.1.dylibDiskArbitration(weak)libbz2.1.0.dylibCacheDelete(weak)SecurityIOKitlibcompression.dylibFoundationlibobjc.A.dyliblibc++.1.dyliblibSystem.B.dylibCoreFoundationCryptoKit(weak)libMobileGestalt.dyliblibswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftDispatch.dylib(weak)libswiftIOKit.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswiftos.dylib(weak)
Entitlements14
Interesting Strings
Bundle IDs(65)
File Paths(42)
/AppleInternal/Library/BuildRoots/4~B_wJugCAyTwbIQ17x7UQAHQckiLAzZ1SXwwtTDE/Library/Caches/com.apple.xbs/Sources/ParallelCompression/AppleArchive/AAJSONStreams.c/AppleInternal/Library/BuildRoots/4~B_wJugCAyTwbIQ17x7UQAHQckiLAzZ1SXwwtTDE/Library/Caches/com.apple.xbs/Sources/ParallelCompression/AppleArchive/AASerialization.c/AppleInternal/Library/BuildRoots/4~B_wJugCAyTwbIQ17x7UQAHQckiLAzZ1SXwwtTDE/Library/Caches/com.apple.xbs/Sources/ParallelCompression/AppleArchiveS3/AAS3Common.c/AppleInternal/Library/BuildRoots/4~B_wJugCAyTwbIQ17x7UQAHQckiLAzZ1SXwwtTDE/Library/Caches/com.apple.xbs/Sources/ParallelCompression/AppleArchiveS3/AAS3Context.c/AppleInternal/Library/BuildRoots/4~B_wJugCAyTwbIQ17x7UQAHQckiLAzZ1SXwwtTDE/Library/Caches/com.apple.xbs/Sources/ParallelCompression/AppleArchiveS3/AAS3DownloadStreamCurl.c
telemetry(29)
Network Surfaceentitled
Networking Frameworks
Endpoints(18)
Hostnamewkms.sd.apple.com
Hostnamesaks-ac-prod.g.apple.com
Hostnamewkms-uat.sd.apple.com
Hostnamesaks-ac-uat.g.apple.com
Hostnamewkms-dev.sd.apple.com
Hostnamesaks-ac-dev.g.apple.com
Ipv60:8:16
Hostnamewww.apple.com
Hostnamemacosx26.1.internal
Hostnamecrl.apple.com
API Usage
Methods
-[AAS3DownloadSession initWithURL:streamBase:maxAttempts:pauseInterval:maxRequestsInFlight:]-[DIAttachParams initWithURL:error:]-[DIAttachParams initWithURL:shadowURLs:error:]-[DIBaseParams initWithURL:error:]-[DIChpassParams initWithURL:error:]-[DICreateASIFParams initWithURL:numBlocks:error:]-[DICreateParams initWithURL:error:]-[DICreateParams initWithURL:numBlocks:error:]-[DICreateRAWParams initWithURL:numBlocks:error:]-[DICreateUDSBParams initWithURL:numBlocks:error:]-[DIImageInfoParams initWithURL:error:]-[DIResizeParams initWithURL:size:error:]-[DIShadowNode initWithURL:isCache:]-[DIStatsParams initWithURL:instanceId:error:]-[DIUserDataParams initWithURL:error:]-[DIVerifyParams initWithURL:error:]-[DIVerifyParams initWithURL:shadowURLs:error:]-[DiskImageParamsRAM_XPC initWithURL:error:]-[FileLocalXPC initWithURL:fileOpenFlags:]-[HTTPBackendXPC initWithURL:]-[HTTPBackendXPC setURL:]-[KNOXBackendXPC initWithURL:key:]-[KNOXBackendXPC setURL:]-[NativeDiskImageGraphNode initWithURL:tag:UUID:parentNode:metadata:isCache:]-[PluginBackendXPC initWithURL:openMode:]-[SparseBundleBackendXPC initWithURL:fileOpenFlags:]-[SparseBundleBackendXPC initWithURL:fileOpenFlags:bandSize:]
DNA Capability Vector
Location
0
Keychain
0
Network
2
Storage
1
Hardware
2
IPC
1
Analytics
1
Security
2
System
0
Behavioral Profile
URL Endpoints
17
Telemetry Strings
29
File Paths
42
Bundle IDs
65
IOKit Constants
0
Library Functions
22
Structural HashesSHA-256
Static Libraries22 / 9918 functions identified
Identified Libraries
Function Matches(1)
curl_easy_initlibcurl 8.6High
Functions(9918)
0x100001818sub_100001818
0x100001938sub_100001938
0x1000019d0sub_1000019d0
0x100001a38sub_100001a38
0x100001a3csub_100001a3c
0x100001aa0sub_100001aa0
0x100001aa4sub_100001aa4
0x100001ab8sub_100001ab8
0x100001b0csub_100001b0c
0x100001b10sub_100001b10
0x100001b14sub_100001b14
0x100001b4csub_100001b4c
0x100001b50sub_100001b50
0x100001b88sub_100001b88
0x100001bf4sub_100001bf4
0x100001c40sub_100001c40
0x100001c58sub_100001c58
0x100001cb4sub_100001cb4
0x100001ce8sub_100001ce8
0x100001d48sub_100001d48
Imports753 symbols from 19 dylibs
Exports1
_mh_execute_header0x0