xprotect

JSON
executablemacOS233.3 KBx86_64, arm64

System service component — manages framework and entitlement-based operations

Executes framework-dependent operations across multiple private and public Apple frameworks, suggesting integration with core system services. Communicates over 6 network endpoints and references 4 bundle identifiers, indicating coordination with other system components. Holds a single entitlement that governs its privileged access. Processes file paths and URLs through 217 internal functions, performing operations that require framework-level integration and network communication typical of daemon-class system utilities.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
233.3 KB
UUID
733FE78A-69FF-302C-985F-E6935753EE98
Analyzed
2026-04-07T05:21:14Z
CDHash
59d62e00ecf32f8cecdec23f7de947380acb7a06f18ffe4136333f4c94565f80

Interesting Strings

Network Surface

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
0
File Paths
5
Bundle IDs
4
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 217 functions identified

Functions(217)

0x100000fe0sub_100000fe0
0x100001018sub_100001018
0x10000106csub_10000106c
0x10000107csub_10000107c
0x1000011f0sub_1000011f0
0x10000137csub_10000137c
0x100001424sub_100001424
0x100001428sub_100001428
0x100001440sub_100001440
0x100001444sub_100001444
0x10000145csub_10000145c
0x100001460sub_100001460
0x100001488sub_100001488
0x10000148csub_10000148c
0x1000014e0sub_1000014e0
0x1000014e4sub_1000014e4
0x100001538sub_100001538
0x100001570sub_100001570
0x1000015b8sub_1000015b8
0x10000161csub_10000161c

Imports204 symbols from 9 dylibs

Exports1

_mh_execute_header0x0