logd

executablemacOS564.8 KBx86_64, arm64

Cryptographic key management daemon — manages encryption keys and secure storage

Manages the device key bag and provides cryptographic key operations for system services through XPC interfaces. Communicates with hardware security features for key protection and performs encryption/decryption operations. Sends telemetry data to Apple endpoints and accesses multiple bundle identifiers for service coordination. Runs with hardened runtime restrictions and requires keychain entitlements to access encrypted key material.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 564.8 KB
UUID: 13EB21F6-CFF6-323D-A60B-7C150929FE56
Analyzed: 2026-04-09T09:54:13Z
CDHash: a15fb764de2b54a0e146b618a697bb03ac1ff9cf8f8aa9d58e62ad6241a017fa

Capabilities

KeychainDevice key bag (encryption keys)

/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

SecurityHardened runtime process

com.apple.developer.hardened-process [object Object]

Frameworks14

MobileKeyBag WatchdogClient(weak)Tightbeam(weak)libz.1.dylib TapToRadarKit(weak)CacheDelete(weak)libobjc.A.dylib libsqlite3.dylib libcompression.dylib IOKit libc++.1.dylib CoreFoundation Foundation libSystem.B.dylib

Entitlements11

com.apple.TapToRadarKit.service-accesstrue

com.apple.developer.hardened-processtrue

com.apple.developer.hardened-process.hardened-heaptrue

com.apple.notify.root_accesstrue

com.apple.private.exclaves.kernel-domaintrue

com.apple.private.kernel.get-kext-infotrue

com.apple.private.logging.helpertrue

com.apple.private.set-atm-diagnostic-flagtrue

com.apple.private.tcc.allow

kTCCServiceSystemPolicySysAdminFiles

com.apple.rootless.volume.Preboottrue

com.apple.security.exception.sysctl.read-only

kern.exclaves_status

Interesting Strings

Bundle IDs(68)

com.apple.private.logging.helper !com.apple.rootless.volume.Preboot $com.apple.developer.hardened-process %s/com.apple.logd.highvol.plist &com.apple.TapToRadarKit.service-access

File Paths(20)

%s/%s.plist %s/%s/%s.plist %s/.plist-cache.XXXXXXXX %s/com.apple.logd.highvol.plist .plist

telemetry(4)

/private/var/db/diagnostics /private/var/db/diagnostics/timesync diagnostics diagnostics/timesync

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(15)

Hostnamelibdispatch-1542.0.4

Hostnamelibtrace-1815.40.20

Hostnamelogdata.statistics.0.txt

Hostnamelogdata.statistics.0.jsonl

Hostnamelogdata.statistics.1.txt

Hostnamelogdata.statistics.1.jsonl

Hostnameuuid.purged.0.txt

Hostnameuuid.purged.1.txt

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

1

Network

0

Storage

0

Hardware

1

IPC

0

Analytics

0

Security

1

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

4

File Paths

20

Bundle IDs

68

IOKit Constants

0

Library Functions

1

Structural HashesSHA-256

Codeb9b43e17422cf5e176ba901c9dcf0e3bb3ef4e4879867004a482def79b727d71

Imports67f922e9e67d810f213c4898ddec3e07f60ea47ab5f2f7efc204ef21a774050a

Frameworks92fc731cddcd9a77d2724d47e5723f6ad2ee2070e205d66a04006b7450f6db16

Classesd61d9dbd2b36363a77dfe0afef77310342e4c4b898630c03e6ce9c7424bc804b

Entitlementse222d287f1732cfd82f8fd47c3fb4cdbbed8a9356a6c95cc1f930455d6f455f1

Symbolscf7705c04be40e3d30c7b43aba36a26340c6604e41536549c9bfb33c941e103e

Static Libraries1 / 534 functions identified

Identified Libraries

flatbuffers 25.9.23 (1 fn)

Functions(534)

0x1000010a0-[OS_firehose_client init]

0x1000010c0-[OS_firehose_client dealloc]

0x100001108-[OS_firehose_client debugDescription]

0x100001110sub_100001110

0x10000117csub_10000117c

0x1000011a8sub_1000011a8

0x1000011b0sub_1000011b0

0x1000011b8sub_1000011b8

0x1000011ccsub_1000011cc

0x1000011d4sub_1000011d4

0x1000011e0sub_1000011e0

0x1000011ecsub_1000011ec

0x1000011f8sub_1000011f8

0x1000014bcsub_1000014bc

0x100001524sub_100001524

0x100001550sub_100001550

0x100001590sub_100001590

0x1000015b4sub_1000015b4

0x100001670sub_100001670

0x10000174csub_10000174c

Imports445 symbols from 13 dylibs

libSystem.B.dylib352 Tightbeam22 CoreFoundation19 libobjc.A.dylib16 IOKit13

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

systemsoundserverd

appleh16camerad