securityuploadd
executablemacOS449.6 KBx86_64, arm64
System authentication manager — handles Apple ID validation and cryptographic operations
Manages Apple ID authentication workflows and accesses device encryption keys through the Keychain for cryptographic operations. Communicates with Apple servers via 9 network endpoints to validate credentials, sync authentication state, and manage certificates. Exposes 5 XPC services for other system components to request authentication and key material. Performs code signing validation and maintains private storage for authentication-related data. Collects 102 telemetry events across its operations to report usage patterns back to Apple.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 449.6 KB
- UUID
- 6FA5DBD5-2993-3477-A483-86CE0B0EBE62
- Analyzed
- 2026-04-09T10:03:29Z
- CDHash
- f47aae2fe640bf374233d7c61f076c22deca83c953c35ef68f49ba8f738130b9
Capabilities
KeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitSecurityApple ID authentication
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKitSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks22
AppleAccount(weak)CrashReporterSupportMobileKeyBagAccounts(weak)libz.1.dylibIOKitAuthKit(weak)OSAnalyticsSecurityFoundationlibobjc.A.dyliblibSystem.B.dylibCoreFoundationlibswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftDispatch.dylib(weak)libswiftIOKit.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswiftos.dylib
Entitlements8
Interesting Strings
Bundle IDs(26)
File Paths(32)
telemetry(102)
Network Surfaceentitled
Networking Frameworks
Endpoints(9)
API Usage
DNA Capability Vector
Location
0
Keychain
1
Network
1
Storage
1
Hardware
1
IPC
0
Analytics
0
Security
2
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
102
File Paths
32
Bundle IDs
26
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 366 functions identified
Functions(366)
0x100001630sub_100001630
0x100001638sub_100001638
0x10000167csub_10000167c
0x1000016a4sub_1000016a4
0x1000016e4sub_1000016e4
0x100001700sub_100001700
0x100001704sub_100001704
0x100001708sub_100001708
0x100001744sub_100001744
0x100001780sub_100001780
0x100001784sub_100001784
0x100001788sub_100001788
0x1000017c8sub_1000017c8
0x100001c6csub_100001c6c
0x100001dd4sub_100001dd4
0x100002198sub_100002198
0x1000022e4sub_1000022e4
0x100002548sub_100002548
0x100002cc8sub_100002cc8
0x100002dccsub_100002dcc
Imports356 symbols from 12 dylibs
Exports1
_mh_execute_header0x0