lockstat

JSON
executablemacOS184.3 KBx86_64, arm64

System service — communicates with Apple infrastructure via network endpoints

Signed Apple executable that initiates outbound network connections to 6 distinct endpoints. Operates as a system-level daemon with access to private frameworks and maintains references to bundle identifiers and file paths. The 29 functions and minimal string count suggest a focused utility that handles internal system communication rather than user-facing operations. Purpose tied to remote connectivity with Apple services.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
184.3 KB
UUID
709FAEE0-A4D2-3BB1-9E51-88F182339D26
Analyzed
2026-04-07T05:21:17Z
CDHash
c4650a2fcbb3c61d32d3ff639b0af0c6bf85e34ef6e30e717cc814e95732628f

Interesting Strings

Network Surface

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
0
File Paths
1
Bundle IDs
1
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 29 functions identified

Functions(29)

0x100000698dtrace_gethrtime
0x1000006f8main
0x10000297csub_10000297c
0x100002a58fail
0x100002af4dfail
0x100002b80usage
0x100002c2cfilter_add
0x100002d58predicate_add
0x100002e60dprog_add
0x100002f20format_symbol
0x100003030lockstat_mergesort
0x100003160coalesce
0x100003260coalesce_symbol
0x1000032b8countcmp
0x1000032ectimecmp
0x10000332csitecmp_anylock
0x1000033a0site_and_count_cmp_anylock
0x100003420lockcmp_anywhere
0x100003460lock_and_count_cmp_anywhere
0x1000034a8lockcmp

Imports72 symbols from 3 dylibs

Exports1

_mh_execute_header0x0