securityd_system
executablemacOS1011.4 KBx86_64, arm64
Secure Enclave and cryptographic key manager — handles hardware-backed encryption operations
Manages cryptographic operations using hardware security features including the Secure Enclave and device key bag. Reads and uses keychain encryption keys for protecting sensitive data, with direct hardware driver communication to access secure storage. Implements security framework extensions for code signing and certificate operations. Submits diagnostic reports about its operations through Apple's symptom reporting framework. Exposes 18 XPC services for system components to request cryptographic operations and key management, with protocol buffer serialization for inter-process communication.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1011.4 KB
- UUID
- C98378A8-C584-3986-BE00-3F3C206C2911
- Analyzed
- 2026-04-09T10:03:23Z
- CDHash
- 80913854f0c3cbf5599374204bc7529bce3066caccf9e54bb88763731235da51
Capabilities
KeychainHardware key storage (Secure Enclave)
/System/Library/PrivateFrameworks/AppleKeyStore.framework/Versions/A/AppleKeyStoreKeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitIpcProtocol buffer serialization
/System/Library/PrivateFrameworks/ProtocolBuffer.framework/Versions/A/ProtocolBufferAnalyticsSymptom/diagnostic reporting framework
/System/Library/PrivateFrameworks/SymptomDiagnosticReporter.framework/Versions/A/SymptomDiagnosticReporterSecuritySecurity framework extensions
/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundationSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks16
Entitlements11
Interesting Strings
Bundle IDs(110)
File Paths(23)
*com.apple.private.sqlite.sqlite-encryption/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/ACMLib/ACMLib.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibCall.c/Library/Keychains/TrustStore.sqlite3/Library/Keychains/caissuercache.sqlite3
telemetry(3)
Network Surface
Networking Frameworks
Endpoints(9)
DNA Capability Vector
Location
0
Keychain
3
Network
0
Storage
1
Hardware
1
IPC
1
Analytics
2
Security
2
System
0
Behavioral Profile
URL Endpoints
6
Telemetry Strings
3
File Paths
23
Bundle IDs
110
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1052 functions identified
Functions(1052)
0x100001340sub_100001340
0x100001350sub_100001350
0x10000135csub_10000135c
0x100001384+[KCSharingStubXPCListenerDelegate sharedInstance]
0x1000013c8sub_1000013c8
0x100001420-[KCSharingStubXPCListenerDelegate init]
0x1000014a8-[KCSharingStubXPCListenerDelegate listener:shouldAcceptNewConnection:]
0x1000014b0-[KCSharingStubXPCListenerDelegate .cxx_destruct]
0x1000014bcsub_1000014bc
0x10000150csub_10000150c
0x100001580sub_100001580
0x1000015d4sub_1000015d4
0x100001604sub_100001604
0x10000160csub_10000160c
0x100001614sub_100001614
0x100001650sub_100001650
0x10000168csub_10000168c
0x10000169csub_10000169c
0x100001760sub_100001760
0x100001840sub_100001840
Imports578 symbols from 15 dylibs
Exports1
_mh_execute_header0x0