seserviced

executablemacOS3.2 MBx86_64, arm64

Apple system daemon — manages authentication, encryption, and secure communications

Handles cryptographic operations, Apple ID authentication, and keychain/Secure Enclave access for system-wide security functions. Manages encryption keys, device identity, and iMessage services while exposing 59 XPC services for inter-process communication. Connects to 25 network endpoints and performs telemetry submission to Apple. Runs with hardened runtime protections and exception entitlements for direct hardware/driver communication, IOKit user clients, and additional Mach service access. Performs background task scheduling and process lifecycle management.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 3.2 MB
UUID: AF702402-C37F-337F-87FF-28A82AE31BD1
Analyzed: 2026-04-09T10:03:47Z
CDHash: 18de45565236143476051f94b6ec28d50815bc0298dcaa5ca8f1a1a2fea45e2b

Capabilities

KeychainRead and use keychain encryption keys

com.apple.keystore.access-keychain-keys [object Object]

KeychainAccess Secure Enclave sealed keys (SIK)

com.apple.keystore.sik.access [object Object]

KeychainKeychain access group membership

keychain-access-groups

com.apple.internal.seserviced.keysync.recoveryblobs com.apple.internal.seserviced.fidokeys lockdown-identities com.apple.seserviced com.apple.private.seserviced.privacykeys

KeychainDevice key bag (encryption keys)

/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag

NetworkMake outgoing network connections

com.apple.security.network.client [object Object]

NetworkVPN, content filter, DNS proxy APIs

/System/Library/Frameworks/NetworkExtension.framework/Versions/A/NetworkExtension

StoragePrivate storage area access

com.apple.private.security.storage.SecureElementService [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.os_eligibility.readonly [object Object]

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-only

/System/AppleInternal/Library//System/Library/Preferences/Logging//AppleInternal/Library/Preferences/Logging//Library/Preferences/Logging//usr/local/SLAM//private/var/hardware/FactoryData/System/Library/Caches/com.apple.factorydata//usr/libexec//usr/standalone/firmware/SLAM//private/preboot//private/var/db/os_eligibility/eligibility.plist /private/var/db/nearbyd

StorageException: access additional file paths

com.apple.security.exception.files.home-relative-path.read-write

Library/HTTPStorages/com.apple.secureelementservice/Library/HTTPStorages Library/Caches/com.apple.secureelementservice/Library/Logs/AppleSSE.log Library/SecureElementService/Library/Caches/com.apple.seserviced/

HardwareException: access additional IOKit user clients

com.apple.security.exception.iokit-user-client-class

AppleSSEUserClient AppleCredentialManagerUserClient AppleSPURoseDriverUserClient AppleSPUUserClient IOHIDEventServiceFastPathUserClient IOReportUserClient

HardwareBluetooth LE device access

/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

IpcQuery process state from RunningBoard

com.apple.runningboard.process-state [object Object]

IpcException: access additional Mach services

com.apple.security.exception.mach-lookup.global-name

com.apple.NPKCompanionAgent.Server com.apple.softposreaderd com.apple.SBUserNotification com.apple.carkit.pairing.service com.apple.NPKCompanionAgent.library com.apple.passd.library com.apple.bluetooth.xpc com.apple.powerlog.plxpclogger.xpc com.apple.securityd.ckks com.apple.security.octagon com.apple.nearbyd.xpc.diagnostics com.apple.secureelementservice.test.events com.apple.seservicexctests.credential-events com.apple.passd.nf-events com.apple.nfcd.credential-events com.apple.seld.tsmmanager com.apple.passd.payment com.apple.identityservicesd.embedded.auth com.apple.server.bluetooth.le.pipe.xpc com.apple.server.bluetooth.le.att.xpc com.apple.nearbyd.xpc.ranging com.apple.nfcd.hwmanager com.apple.CoreAuthentication.daemon com.apple.ak.auth.xpc com.apple.PowerManagement.control com.apple.idsremoteurlconnectionagent.embedded.auth com.apple.nearbyd.xpc.nearbyinteraction com.apple.commcenter.coretelephony.xpc com.apple.carousel.connectionstatusservice com.apple.SBUserNotification com.apple.wallet.application-authorization com.apple.duet.activityscheduler com.apple.frontboard.systemappservices com.apple.SESAngel.mach com.apple.passd.device-registration com.apple.mobileactivationd com.apple.seserviced.sereservation.client com.apple.CellularPlanDaemon.xpc com.apple.surfboard.applicationservice com.apple.surfboard.scenesessionservice com.apple.spotlight.IndexAgent

IpcApple identity/messaging services (iMessage)

/System/Library/PrivateFrameworks/IDS.framework/Versions/A/IDS

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SecurityHardened runtime process

com.apple.developer.hardened-process [object Object]

SecurityApple ID authentication

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKit

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SecurityCryptographic operations

/System/Library/Frameworks/CryptoKit.framework/Versions/A/CryptoKit

SystemProcess lifecycle management

/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServices

SystemBackground task scheduling

/System/Library/PrivateFrameworks/BackgroundSystemTasks.framework/Versions/A/BackgroundSystemTasks

Frameworks59

libTelephonyCapabilities.dylib libAppleSSE.dylib libSESShared.dylib libbsm.0.dylib PowerLog STSXPCHelperClient(weak)MSUDataAccessor NetworkExtension libamsupport.dylib libimage4.dylib libFDRDecode.dylib Accounts AuthKit libFDR.dylib MobileAsset MobileKeyBag FrontBoardServices CoreAnalytics CoreBluetooth SEService libSLAMDynamic.dylib IOKit libTelephonyUtilDynamic.dylib RunningBoardServices CryptoKitPrivate IDS libMobileGestalt.dylib Proximity NearbyInteraction DeviceIdentity CoreData CoreFoundation SoftLinking Security NearField Foundation libobjc.A.dylib libc++.1.dylib libSystem.B.dylib CryptoKit AtomicsInternal BackgroundSystemTasks CBORLibrary libswiftCompression.dylib(weak)libswiftCore.dylib libswiftCoreFoundation.dylib libswiftCoreLocation.dylib(weak)libswiftDispatch.dylib libswiftIOKit.dylib(weak)libswiftMetal.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dylib libswiftQuartzCore.dylib(weak)libswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dylib libswift_Builtin_float.dylib(weak)libswift_Concurrency.dylib libswiftos.dylib libswiftsimd.dylib(weak)

Entitlements89

allow-softwareupdatedtrue

application-identifier com.apple.seserviced

com.apple.BTServer.allowLEConnectionHandleQuerytrue

com.apple.CommCenter.fine-grained

com.apple.NPKCompanionAgent.clienttrue

com.apple.aop.rose.controller.admintrue

com.apple.application-identifier com.apple.seserviced

com.apple.authkit.client.privatetrue

com.apple.bluetooth.pairedInfoSecuritytrue

com.apple.bluetooth.systemtrue

com.apple.cards.all-accesstrue

com.apple.developer.hardened-processtrue

com.apple.developer.homekittrue

com.apple.duet.activityscheduler.allowtrue

com.apple.frontboard.launchapplicationstrue

com.apple.internal.seserviced.all.endpoints.and.castrue

com.apple.keystore.access-keychain-keystrue

com.apple.keystore.sik.accesstrue

com.apple.mobileactivationd.bridgetrue

com.apple.mobileactivationd.device-identifierstrue

com.apple.mobileactivationd.spitrue

com.apple.nano.nanoregistry.generalaccesstrue

com.apple.nearbyd.diagnosticstrue

com.apple.nearbyd.xpctrue

com.apple.nearbyinteraction.backgroundtrue

com.apple.nfcd.event.notificationtrue

com.apple.nfcd.hcetrue

com.apple.nfcd.hwmanagertrue

com.apple.nfcd.session.credential.managertrue

com.apple.nfcd.session.fieldOperationstrue

com.apple.nfcd.session.lpemConfigtrue

com.apple.nfcd.session.setrue

com.apple.nfcd.session.trusttrue

com.apple.payment.all-accesstrue

com.apple.peerpayment.all-accesstrue

com.apple.private.MobileGestalt.AllowedProtectedKeys

UniqueDeviceID BootManifestHash ArrowChipID ArrowUniqueChipID UniqueChipID SerialNumber

com.apple.private.accounts.allaccountstrue

com.apple.private.applecredentialmanager.allowtrue

com.apple.private.applesse.allowtrue

com.apple.private.assets.accessible-asset-types

com.apple.MobileAsset.SecureElementServiceAssets

com.apple.private.carkit.pairingtrue

com.apple.private.ckkstrue

com.apple.private.credential-state-accesstrue

com.apple.private.homekittrue

com.apple.private.homekit.home-locationtrue

com.apple.private.homekit.locationtrue

com.apple.private.ids.messaging

com.apple.private.alloy.keysharing

com.apple.private.ids.messaging.urgent-priority

com.apple.private.alloy.keysharing

com.apple.private.ids.remotecredentialstrue

com.apple.private.imcore.imremoteurlconnectiontrue

com.apple.private.nearbyinteraction.privilegedtrue

com.apple.private.octagontrue

com.apple.private.octagon.secureelementtrue

com.apple.private.security.bootpolicytrue

com.apple.private.security.storage.SecureElementServicetrue

com.apple.private.security.storage.os_eligibility.readonlytrue

com.apple.private.seserviced.sereservation.clienttrue

com.apple.private.tcc.allow

kTCCServiceWillow

com.apple.private.tcc.manager.access.read

com.apple.private.tcc.manager.check-by-audit-token

com.apple.runningboard.private.se.credentialtrue

com.apple.runningboard.process-statetrue

com.apple.runningboard.seservicedtrue

com.apple.security.attestation.accesstrue

com.apple.security.exception.files.absolute-path.read-only

/System/AppleInternal/Library//System/Library/Preferences/Logging//AppleInternal/Library/Preferences/Logging//Library/Preferences/Logging//usr/local/SLAM//private/var/hardware/FactoryData/System/Library/Caches/com.apple.factorydata//usr/libexec//usr/standalone/firmware/SLAM//private/preboot//private/var/db/os_eligibility/eligibility.plist /private/var/db/nearbyd

com.apple.security.exception.files.home-relative-path.read-write

Library/HTTPStorages/com.apple.secureelementservice/Library/HTTPStorages Library/Caches/com.apple.secureelementservice/Library/Logs/AppleSSE.log Library/SecureElementService/Library/Caches/com.apple.seserviced/

com.apple.security.exception.iokit-user-client-class

AppleSSEUserClient AppleCredentialManagerUserClient AppleSPURoseDriverUserClient AppleSPUUserClient IOHIDEventServiceFastPathUserClient IOReportUserClient

com.apple.security.exception.mach-lookup.global-name

com.apple.NPKCompanionAgent.Server com.apple.softposreaderd com.apple.SBUserNotification com.apple.carkit.pairing.service com.apple.NPKCompanionAgent.library com.apple.passd.library com.apple.bluetooth.xpc com.apple.powerlog.plxpclogger.xpc com.apple.securityd.ckks com.apple.security.octagon com.apple.nearbyd.xpc.diagnostics com.apple.secureelementservice.test.events com.apple.seservicexctests.credential-events com.apple.passd.nf-events com.apple.nfcd.credential-events com.apple.seld.tsmmanager com.apple.passd.payment com.apple.identityservicesd.embedded.auth com.apple.server.bluetooth.le.pipe.xpc com.apple.server.bluetooth.le.att.xpc com.apple.nearbyd.xpc.ranging com.apple.nfcd.hwmanager com.apple.CoreAuthentication.daemon com.apple.ak.auth.xpc com.apple.PowerManagement.control com.apple.idsremoteurlconnectionagent.embedded.auth com.apple.nearbyd.xpc.nearbyinteraction com.apple.commcenter.coretelephony.xpc com.apple.carousel.connectionstatusservice com.apple.SBUserNotification com.apple.wallet.application-authorization com.apple.duet.activityscheduler com.apple.frontboard.systemappservices com.apple.SESAngel.mach com.apple.passd.device-registration com.apple.mobileactivationd com.apple.seserviced.sereservation.client com.apple.CellularPlanDaemon.xpc com.apple.surfboard.applicationservice com.apple.surfboard.scenesessionservice com.apple.spotlight.IndexAgent

com.apple.security.exception.process-infotrue

com.apple.security.exception.shared-preference.read-only

com.apple.mobileactivationd com.apple.nsurlcache com.apple.facetime.bag com.apple.imessage.bag com.apple.AppSupport.plist com.apple.stockholm

com.apple.security.exception.shared-preference.read-write

com.apple.seserviced.shared com.apple.seserviced com.apple.secureelementservice com.apple.seserviced.contactlessCredential.settings com.apple.seserviced.designatedkeys com.apple.carkey.settings

com.apple.security.network.clienttrue

com.apple.security.ts.identity-services-clienttrue

com.apple.security.ts.power-assertionstrue

com.apple.security.ts.read-factory-filestrue

com.apple.security.ts.springboard-servicestrue

com.apple.seld.tsmmanagertrue

com.apple.seserviced.SESUIServiceApp.sessiontrue

com.apple.seserviced.seendpointstrue

com.apple.seserviced.seendpoints.certificateauthoritiestrue

com.apple.softposreaderd <integer>2</integer>

com.apple.softposreaderd.provision <integer>2</integer>

com.apple.springboard.monitorAppSwitcherUserQuittrue

com.apple.springboard.remote-alerttrue

com.apple.sts.xpcservice.clienttrue

com.apple.wallet.application-authorizationtrue

keychain-access-groups

com.apple.internal.seserviced.keysync.recoveryblobs com.apple.internal.seserviced.fidokeys lockdown-identities com.apple.seserviced com.apple.private.seserviced.privacykeys

platform-applicationtrue

seatbelt-profiles

temporary-sandbox

Interesting Strings

Bundle IDs(353)

com.apple.CellularPlanDaemon.xpc com.apple.application-identifier com.apple.authkit.client.private com.apple.carkit.pairing.service com.apple.duet.activityscheduler

File Paths(53)

$/System/Library/Preferences/Logging/+/AppleInternal/Library/Preferences/Logging///private/var/wireless/Library/Logs/CrashReporter/updater_output/SE/SEUpdaterEventsLog.plist /AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/ACMLib/ACMLib.c /AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibCall.c

telemetry(25)

!com.apple.nearbyd.xpc.diagnostics /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics <key>com.apple.nearbyd.diagnostics</key><string>com.apple.nearbyd.xpc.diagnostics</string>Error %@ while scheduling general analytics task

URLs & Endpoints(13)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 &com.apple.commcenter.coretelephony.xpc <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.commcenter.coretelephony.xpc</string>

Network Surfaceentitled

Networking Frameworks

CoreFoundation Foundation libswiftCoreFoundation.dylib

API Usage

DNA Capability Vector

Location

0

Keychain

4

Network

2

Storage

4

Hardware

3

IPC

3

Analytics

1

Security

4

System

2

Behavioral Profile

URL Endpoints

13

Telemetry Strings

25

File Paths

53

Bundle IDs

353

IOKit Constants

0

Library Functions

1

Structural HashesSHA-256

Code84f44fa29809a2b4aff8e96da7cb2051d894ccbeab7ac51e7e8d1df3e3ef98db

Imports30a887211e802e13022b04eb11611be3feb90787b4ea80b4bb9a97d720b01c4b

Frameworks1926d482d1acede3255d1697185eafff44d1c9fa939d32925e4c76fd74351e88

Classes11f3036a180f3082e80a63a8f76ab748aa772f68ef1a1dfc98ad4fd309fd5f30

Entitlements7852f41b96b40eddaf24db1675aa86015f16962db42ca28a4c0f3ad066f4f338

Symbolsc5591a2538dfad53de01c3bfb7ce146e1547ee3240bad05a300820ad4875ed4e

Static Libraries1 / 3438 functions identified

Identified Libraries

avcodec 8.0.1 (1 fn)

Functions(3438)

0x100002670-[SESEndpointAndKeyXPCServer instanceRepresentations]

0x10000267c-[SESEndpointAndKeyXPCServer setInstanceRepresentations:]

0x10000268c-[SESEndpointAndKeyXPCServer initializeRAMRepresentation:]

0x100002f58sub_100002f58

0x100003008sub_100003008

0x100003010sub_100003010

0x100003018sub_100003018

0x100003020-[SESEndpointAndKeyXPCServer handleMFDNotification:]

0x1000030b0sub_1000030b0

0x100003130-[SESEndpointAndKeyXPCServer _dumpState]

0x1000032f0sub_1000032f0

0x1000032f8-[SESEndpointAndKeyXPCServer keyServiceAvailable:reason:reply:]

0x100003308-[SESEndpointAndKeyXPCServer keyServiceAvailable:handoffToken:reason:reply:]

0x1000035bcsub_1000035bc

0x1000036acsub_1000036ac

0x1000037bcsub_1000037bc

0x10000385csub_10000385c

0x1000038b4sub_1000038b4

0x100003900sub_100003900

0x100003948sub_100003948

Imports1129 symbols from 32 dylibs

libswiftCore.dylib356 SEService162 Foundation138 libSystem.B.dylib114 CryptoKit60

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

promotedcontentd

online-auth-agent