biometrickitd
executablemacOS2.7 MBx86_64, arm64
System diagnostics and analytics daemon — collects hardware telemetry and display state
Gathers diagnostic data and performance metrics from the system, submitting telemetry through Apple's unified analytics framework and Symptom reporting service. Communicates directly with hardware and drivers to monitor device state, and controls the display via SkyLight window server integration. Accesses Secure Enclave sealed keys for cryptographic operations tied to hardware identity. Exposes seven XPC services for inter-process communication, enabling other system components to query diagnostics and contribute to telemetry collection. Logs comprehensive telemetry events (248 telemetry strings) and reports to multiple network endpoints.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 2.7 MB
- UUID
- 93A4ACF4-1FDF-3B21-A032-FD14DC5929AD
- Analyzed
- 2026-04-09T09:43:57Z
- CDHash
- 96257d307112e481a3b2cd448fa7b9cee888b44a5c02822d48c0db4b3e45a2fa
Capabilities
HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsAnalyticsSymptom/diagnostic reporting framework
/System/Library/PrivateFrameworks/SymptomDiagnosticReporter.framework/Versions/A/SymptomDiagnosticReporterSystemControl display via SkyLight (window server)
com.apple.private.SkyLight.displaycontrol[object Object]SystemWindow server (display control)
/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/SkyLightFrameworks25
libFDR.dyliblibMobileGestalt.dylibSkyLightCoreAnalyticsSymptomDiagnosticReporter(weak)BiometricSupportIOKitCocoaFoundationCoreFoundationOpenDirectorylibbsm.0.dyliblibEndpointSecuritySystem.dylib(weak)libobjc.A.dyliblibSystem.B.dylibAppKitBiometricKitlibswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftDispatch.dyliblibswiftIOKit.dylib(weak)libswiftObjectiveC.dyliblibswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswiftos.dylib
Entitlements11
Interesting Strings
Bundle IDs(75)
File Paths(32)
/AppleInternal/Library/BuildRoots/4~CAeWugA-4_Ggr6jmMtBiEebdmoKYeQ9ayR8Z5Ic/Library/Caches/com.apple.xbs/Sources/Mesa_NonUI/AppleBiometricServices/BioLog/BLHelper.m/AppleInternal/Library/BuildRoots/4~CAeWugA-4_Ggr6jmMtBiEebdmoKYeQ9ayR8Z5Ic/Library/Caches/com.apple.xbs/Sources/Mesa_NonUI/AppleBiometricServices/BioLog/BLTimeBox.m/AppleInternal/Library/BuildRoots/4~CAeWugA-4_Ggr6jmMtBiEebdmoKYeQ9ayR8Z5Ic/Library/Caches/com.apple.xbs/Sources/Mesa_NonUI/AppleBiometricServices/BioLog/BioLog.m/AppleInternal/Library/BuildRoots/4~CAeWugA-4_Ggr6jmMtBiEebdmoKYeQ9ayR8Z5Ic/Library/Caches/com.apple.xbs/Sources/Mesa_NonUI/AppleBiometricServices/BioLog/BioLog.swift/AppleInternal/Library/BuildRoots/4~CAeWugA-4_Ggr6jmMtBiEebdmoKYeQ9ayR8Z5Ic/Library/Caches/com.apple.xbs/Sources/Mesa_NonUI/AppleBiometricServices/BioLog/BioLogRetention.swift
iokit_constants(4)
telemetry(248)
Network Surface
Networking Frameworks
Endpoints(8)
DNA Capability Vector
Location
0
Keychain
1
Network
0
Storage
0
Hardware
1
IPC
0
Analytics
2
Security
0
System
2
Behavioral Profile
URL Endpoints
4
Telemetry Strings
248
File Paths
32
Bundle IDs
75
IOKit Constants
4
Library Functions
1
Structural HashesSHA-256
Static Libraries1 / 4859 functions identified
Identified Libraries
Functions(4859)
0x1000019c8-[MesaAutoBugCapture getTypeForReason:]
0x100001a40-[MesaAutoBugCapture getSubtypeForReason:]
0x100001ab8+[BioLogBase updateLogger:withServerObject:identities:]
0x100001f78+[BioLogBase enableSensorStatusMessages:withServerObject:]
0x100002004-[BioLogBase logNameFromDate:]
0x1000020dcsub_1000020dc
0x100002134-[BioLogBase compactLog]
0x100002308-[BioLogBase createNewLog]
0x1000027f8sub_1000027f8
0x100002800sub_100002800
0x100002808sub_100002808
0x100002810-[BioLogBase logUnlockedStateSyncWithIdentities:]
0x100002b28-[BioLogBase logUnlockedStateWithIdentities:]
0x100002b2c-[BioLogBase initToPath:withServerObject:identities:mode:]
0x100002f60-[BioLogBase dealloc]
0x100002fb0-[BioLogBase logQueue]
0x100002fb8-[BioLogBase updateIdentity:]
0x100002fc0-[BioLogBase getLogPath]
0x100002fc8-[BioLogBase synchronizeLogFile]
0x1000030b4sub_1000030b4
Imports743 symbols from 17 dylibs
Exports1
_mh_execute_header0x0