nehelper
executablemacOS621.2 KBx86_64, arm64
Wi-Fi system daemon — configures wireless interfaces and manages connectivity
Manages Wi-Fi hardware configuration, network association, and connection state through private Apple80211 framework APIs and CoreWiFi. Controls Wi-Fi interface power, scans for networks, and handles roaming decisions. Accesses location services for Wi-Fi-based positioning without user prompts and reads system keychain for stored network credentials. Submits analytics to Apple and exposes 35 XPC services for system clients to query and control Wi-Fi settings and status. Integrates with VPN and DNS proxy APIs to coordinate network routing.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 621.2 KB
- UUID
- 2B5B02FF-791C-3A4E-A3F7-3A50140E3419
- Analyzed
- 2026-04-09T09:57:22Z
- CDHash
- 6fcd2d57aec730616485223a90bf81cc44d1160fb4fb37794d70d2ce5bafb6ef
Capabilities
LocationAccess location as a system bundle (no user prompt)
com.apple.locationd.effective_bundle[object Object]LocationAccess WiFi-based location without user consent
com.apple.wifi.bypass-location-services[object Object]LocationLocation services access
/System/Library/Frameworks/CoreLocation.framework/Versions/A/CoreLocationKeychainKeychain access group membership
keychain-access-groupsNetworkModern networking framework (NWConnection)
/System/Library/Frameworks/Network.framework/Versions/A/NetworkNetworkVPN, content filter, DNS proxy APIs
/System/Library/Frameworks/NetworkExtension.framework/Versions/A/NetworkExtensionNetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationStoragePrivate storage area access
com.apple.private.security.storage.NetworkExtension[object Object]HardwareWiFi interface control
/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLANHardwareWiFi configuration (private)
/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFiAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks20
CoreWLANCoreAnalyticsSetupAssistantFramework(weak)CoreWiFi(weak)libicucore.A.dylibApplicationFirewallSharedWebCredentials(weak)RunningBoardServices(weak)CoreLocation(weak)AppSupport(weak)NetworkNetworkExtensionlibbsm.0.dylibCoreServicesSecuritySystemConfigurationFoundationlibobjc.A.dyliblibSystem.B.dylibCoreFoundation
Entitlements21
Interesting Strings
Bundle IDs(174)
File Paths(60)
/AppleInternal/Library/Frameworks/LivabilityKit.framework/Support/livabilityd/AppleInternal/Library/Frameworks/Python.framework/Versions/3.9/Resources/Python.app/Contents/MacOS/Python/Library/Managed Preferences/mobile/com.apple.networkextension.control.plist/Library/Preferences/com.apple.networkextension.cache.plist/Library/Preferences/com.apple.networkextension.control.plist
telemetry(5)
Network Surface
Networking Frameworks
Endpoints(14)
Ipv4100.6.1.9
Ipv4100.6.2.6
Ipv4100.6.1.13
Hostnamefield.1.2.840.113635.100.6.1.9
Hostnamefield.1.2.840.113635.100.6.2.6
Hostnamefield.1.2.840.113635.100.6.1.13
Ipv60:8:16
Hostnamewww.apple.com
Hostnamemacosx26.1.internal
Hostnamecrl.apple.com
DNA Capability Vector
Location
3
Keychain
2
Network
3
Storage
1
Hardware
2
IPC
0
Analytics
1
Security
1
System
1
Behavioral Profile
URL Endpoints
6
Telemetry Strings
5
File Paths
60
Bundle IDs
174
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 246 functions identified
Functions(246)
0x1000014b0-[NEHelperRelayManager handleMessage:]
0x1000017f0sub_1000017f0
0x100002118sub_100002118
0x10000215csub_10000215c
0x1000021a0-[NEHelperRelayManager initWithFirstMessage:]
0x100002214sub_100002214
0x100002318sub_100002318
0x100002320sub_100002320
0x100002328-[NEHelperAppTrackerManager handleMessage:]
0x1000025a0-[NEHelperAppTrackerManager handlerQueue]
0x1000025ac-[NEHelperAppTrackerManager initWithFirstMessage:]
0x100002664sub_100002664
0x1000026d0-[NEHelperTrackerManager .cxx_destruct]
0x1000026dc-[NEHelperTrackerManager handleMessage:]
0x100002db4sub_100002db4
0x100004870sub_100004870
0x100004eecsub_100004eec
0x100004f1csub_100004f1c
0x100005114-[NEHelperTrackerManager handlerQueue]
0x100005120-[NEHelperTrackerManager initWithFirstMessage:]
Imports304 symbols from 17 dylibs
Exports1
_mh_execute_header0x0