otctl

executablemacOS429.3 KBx86_64, arm64

Apple authentication and security token manager — handles Keychain, certificates, and code signing operations

Manages Apple ID authentication, Keychain access, and digital certificate operations for system security functions. Communicates with Apple's authentication endpoints and handles code signing validation. Uses protocol buffer serialization for IPC communication with other system components. Sends telemetry data to Apple services. Accesses Keychain items and manages credential lifecycle through 7 entitlements covering security-sensitive operations.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 429.3 KB
UUID: D0FEA742-64F7-32D4-90CD-35B15A50FA7B
Analyzed: 2026-04-07T05:21:13Z
CDHash: 1a5893c9547b79fd636b4cfa5c78ff2e11af5fa0eaad61f2be76ed56b37efadc

Capabilities

IpcProtocol buffer serialization

/System/Library/PrivateFrameworks/ProtocolBuffer.framework/Versions/A/ProtocolBuffer

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SecurityApple ID authentication

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKit

Frameworks9

ProtocolBuffer KeychainCircle OctagonTrust Security AuthKit Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements7

com.apple.authkit.client.privatetrue

com.apple.private.ckkstrue

com.apple.private.escrow-updatetrue

com.apple.private.octagontrue

com.apple.private.octagon.walrustrue

com.apple.securebackupd.accesstrue

keychain-cloud-circletrue

Interesting Strings

Bundle IDs(16)

com.apple.authkit.client.private com.apple.private.octagon.walrus <key>com.apple.authkit.client.private</key><key>com.apple.private.ckks</key><key>com.apple.private.escrow-update</key>

File Paths(7)

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/Security.framework/Versions/A/Security /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKit /System/Library/PrivateFrameworks/KeychainCircle.framework/Versions/A/KeychainCircle

telemetry(12)

StringAsSendingMetricsPermitted:Ti,N,V_sendingMetricsPermitted _OBJC_CLASS_$_AAFAnalyticsEventSecurity _sendingMetricsPermitted hasSendingMetricsPermitted

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(8)

HostnameSecurity-61901.40.77

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

0

Hardware

0

IPC

1

Analytics

0

Security

2

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

12

File Paths

7

Bundle IDs

16

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code8866ec15e13f59f751c81dd20228dae4a87b677d3f49e22199d000c345744268

Importsebd68d69591ae569c5f0447b1b1af86381309395ea42020517885159e2c64cb2

Frameworks2a53eb56ff6cb8fba3c82ab4bf480607d80c3d5fb7d1abba6048bfefe491a6a8

Classes4372c87985df508451bc91a231315c90225e1cb83b9ee3945a7427244aafa9da

Entitlements5309afcbc7334ae4d46b1c42c7a3adc63a328a9b2c1701617bb0f400b6f3f4f4

Symbols3ec6da0ac1bff1e8b746e97c365cbc137d1ee9bc2ffdfdb14d46d8efd2707e56

Static Libraries0 / 304 functions identified

Functions(304)

0x100000fa0-[EscrowRequestCLI .cxx_destruct]

0x100000fac-[EscrowRequestCLI setEscrowRequest:]

0x100000fb4-[EscrowRequestCLI escrowRequest]

0x100000fc0-[EscrowRequestCLI storePrerecordsInEscrow]

0x100001080-[EscrowRequestCLI reset]

0x100001130-[EscrowRequestCLI status]

0x100001348-[EscrowRequestCLI trigger]

0x100001400-[EscrowRequestCLI initWithEscrowRequest:]

0x10000147csub_10000147c

0x1000015acsub_1000015ac

0x100001624sub_100001624

0x100001bf4sub_100001bf4

0x100001cacsub_100001cac

0x100004e5c-[OTControlCLI .cxx_destruct]

0x100004e68-[OTControlCLI setControl:]

0x100004e70-[OTControlCLI control]

0x100004e7c-[OTControlCLI performCKServerUnreadableDataRemoval:appleID:isGuitarfish:dsid:]

0x100005068sub_100005068

0x10000524csub_10000524c

0x10000525csub_10000525c

Imports120 symbols from 9 dylibs

libSystem.B.dylib37 libobjc.A.dylib21 Security15 CoreFoundation12 ProtocolBuffer11

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

peakpowermanagerd

securityuploadd

securityd_system

proactiveeventtrackerd