hdiutil
executablemacOS715.7 KBx86_64, arm64
Security certificate validation — verifies code signatures and certificate authenticity
Validates cryptographic certificates, code signatures, and keychain items for macOS security enforcement. Performs certificate chain verification, checks revocation status against network endpoints, and applies certificate pinning logic. Submits validation telemetry to Apple's unified analytics system. Accesses multiple keychain items and performs direct hardware operations for cryptographic validation, with entitlements restricted to security-related operations only.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 715.7 KB
- UUID
- 7C5DBAAA-15B3-314A-8166-456582B7F1C2
- Analyzed
- 2026-04-07T05:21:16Z
- CDHash
- 5c7329d25be8328ac4bbe6f60ff06e9aba99ef7e2396902147b4eb9bfe653ea9
Capabilities
HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks12
Entitlements1
Interesting Strings
Bundle IDs(8)
4com.apple.private.diskimages.kext.user-client-access<key>com.apple.private.diskimages.kext.user-client-access</key>analytics_send_event_lazy("com.apple.DiskImages.hdiutil.usage", ^xpc_object_t _Nullable { xpc_object_t event = xpc_dictionary_create_empty(); xpc_dictionary_set_string(event, "verb_type", eventType); eventPayloadBuilder(&event); return event; })com.apple.DiscRecordingcom.apple.DiskImages.hdiutil.usage
File Paths(12)
telemetry(4)
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsDiagnostics mode_analytics_send_event_lazyanalytics_send_event_lazy("com.apple.DiskImages.hdiutil.usage", ^xpc_object_t _Nullable { xpc_object_t event = xpc_dictionary_create_empty(); xpc_dictionary_set_string(event, "verb_type", eventType); eventPayloadBuilder(&event); return event; })
URLs & Endpoints(7)
Network Surface
Networking Frameworks
Endpoints(6)
API Usage
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
1
IPC
0
Analytics
1
Security
1
System
0
Behavioral Profile
URL Endpoints
7
Telemetry Strings
4
File Paths
12
Bundle IDs
8
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 375 functions identified
Functions(375)
0x100000c08sub_100000c08
0x100000e64sub_100000e64
0x100000ec4sub_100000ec4
0x100000f18sub_100000f18
0x100000f70sub_100000f70
0x100001d74sub_100001d74
0x100001f60sub_100001f60
0x1000038a4sub_1000038a4
0x100003c84sub_100003c84
0x100003cd4sub_100003cd4
0x100003e30sub_100003e30
0x100003ea8sub_100003ea8
0x1000042c4sub_1000042c4
0x100004304sub_100004304
0x100004344sub_100004344
0x1000043a8sub_1000043a8
0x100004444sub_100004444
0x1000044e0sub_1000044e0
0x10000457csub_10000457c
0x100004714sub_100004714
Imports548 symbols from 10 dylibs
Exports1
_mh_execute_header0x0