ContinuityCaptureAgent
executablemacOS174.6 KBx86_64, arm64
Wi-Fi peer-to-peer daemon — manages direct device connections and wireless synchronization
Establishes and maintains Wi-Fi Direct connections between Apple devices without requiring a traditional network infrastructure. Handles peer discovery, authentication, and data synchronization over direct wireless links. Listens for incoming network connections and performs Wi-Fi authentication. Communicates with other system daemons via XPC and restricted Mach services, and queries RunningBoard for process state management. Interfaces with paired Apple devices through IOKit and exposes an XPC interface for application group access.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 174.6 KB
- UUID
- 05AFF77E-0AEF-3B59-9A2A-23D290804510
- Analyzed
- 2026-04-09T09:38:05Z
- CDHash
- 09e517b091be8c2338dfd4a0b47632e324b0d48cb60dad4d5837ddf363d42e2c
Capabilities
HardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-classIpcRestricted application group access
com.apple.private.security.restricted-application-groupsIpcShared application group container access
com.apple.security.application-groupsIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-namecom.apple.usernotifications.usernotificationservicecom.apple.telephonyutilities.callservicesdaemon.callstatecontrollercom.apple.timesync.expositorcom.apple.timesync.managercom.apple.timesync.ptp.managercom.apple.wifip2pdcom.apple.CompanionLinkcom.apple.RemoteDisplaycom.apple.cmio.ContinuityCaptureAgentcom.apple.mediaremoted.xpccom.apple.coremedia.endpointremotecontrolsession.xpc
Frameworks9
Entitlements34
com.apple.security.exception.mach-lookup.global-name
com.apple.usernotifications.usernotificationservicecom.apple.telephonyutilities.callservicesdaemon.callstatecontrollercom.apple.timesync.expositorcom.apple.timesync.managercom.apple.timesync.ptp.managercom.apple.wifip2pdcom.apple.CompanionLinkcom.apple.RemoteDisplaycom.apple.cmio.ContinuityCaptureAgentcom.apple.mediaremoted.xpccom.apple.coremedia.endpointremotecontrolsession.xpc
Interesting Strings
Bundle IDs(98)
File Paths(7)
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/CoreMedia.framework/Versions/A/CoreMedia/System/Library/Frameworks/CoreMediaIO.framework/Versions/A/CoreMediaIO/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation/System/Library/PrivateFrameworks/CMContinuityCaptureCore.framework/Versions/A/CMContinuityCaptureCore
Network Surfaceentitled
Networking Frameworks
Endpoints(8)
DNA Capability Vector
Location
0
Keychain
0
Network
1
Storage
0
Hardware
2
IPC
5
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
5
Telemetry Strings
0
File Paths
7
Bundle IDs
98
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 36 functions identified
Functions(36)
0x100000ea8sub_100000ea8
0x100000ed8sub_100000ed8
0x10000118csub_10000118c
0x1000011bcsub_1000011bc
0x1000011f0sub_1000011f0
0x100001224sub_100001224
0x100001300sub_100001300
0x100001330sub_100001330
0x100001370-[CMContinuityCaptureAgentXPCClient initWithDeviceIdentifier:]
0x100001460-[CMContinuityCaptureAgentXPCClient executePostEvent:data:]
0x100001744sub_100001744
0x1000017d8sub_1000017d8
0x1000017e0sub_1000017e0
0x1000017e8-[CMContinuityCaptureAgentXPCClient notifyStateChange:forEntity:]
0x100001958-[CMContinuityCaptureAgentXPCClient executeUserDisconnect]
0x100001a00-[CMContinuityCaptureAgentXPCClient logDebugInfo]
0x100001a74sub_100001a74
0x100001b28-[CMContinuityCaptureAgentXPCClient disableAutoTransportSwitch:]
0x100001b98-[CMContinuityCaptureAgentXPCClient setControlValue:value:]
0x100001c40-[CMContinuityCaptureAgentXPCClient unhideDevice]
Imports78 symbols from 8 dylibs
Exports1
_mh_execute_header0x0