spindump

executablemacOS3.5 MBx86_64, arm64

System diagnostics and telemetry daemon — collects hardware and network metrics for Apple

Gathers system diagnostics including hardware status, network configuration, and reachability data, then submits analytics to Apple's unified telemetry system. Accesses IOKit user clients and hardware drivers to monitor device state, manages background task scheduling for periodic collection, and stores data in private storage areas. Uses 8 network endpoints to report findings and exposes 8 XPC services for inter-process communication with other system components. Includes exception entitlements for accessing additional file paths beyond standard restrictions.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 3.5 MB
UUID: 93212E73-E0D9-3C9F-9F18-3568132925AE
Analyzed: 2026-04-09T10:16:25Z
CDHash: c2e918dc55c091b38a551a3e14a5985e58ddc6726239fd9bfe4539a327756305

Capabilities

NetworkNetwork configuration and reachability

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

StoragePrivate storage area access

com.apple.private.security.storage.os_eligibility.readonly [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.spindump [object Object]

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-only

/private/var/db/eligibilityd/eligibility.plist /private/var/db/os_eligibility/eligibility.plist

HardwareException: access additional IOKit user clients

com.apple.security.exception.iokit-user-client-class

IOReportUserClient

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SystemBackground task scheduling

/System/Library/PrivateFrameworks/BackgroundSystemTasks.framework/Versions/A/BackgroundSystemTasks

Entitlements28

GenerativeModels.GenerativeFunctions.Instrumentation GenerativeModels.GenerativeFunctions.SystemInstrumentation

com.apple.SampleAnalysis <dict>

com.apple.diagnosticpipeline.requesttrue

com.apple.duet.activityscheduler.allowtrue

com.apple.lsapplicationproxy.deviceidentifierforvendortrue

com.apple.modelmanager.querytrue

com.apple.private.applesmc.user-accesstrue

com.apple.private.biome.client-identifier com.apple.spindump

com.apple.private.biome.read-only

GenerativeModels.GenerativeFunctions.Instrumentation GenerativeModels.GenerativeFunctions.SystemInstrumentation

com.apple.private.intelligenceplatform.use-cases <dict>

com.apple.private.kernel.get-kext-infotrue

com.apple.private.logging.diagnostictrue

com.apple.private.logging.streamtrue

com.apple.private.osanalytics.defaults.allowtrue

com.apple.private.roots-installed-read-onlytrue

com.apple.private.security.storage.os_eligibility.readonlytrue

com.apple.private.security.storage.spindumptrue

com.apple.private.stackshottrue

com.apple.private.xpc.launchd.per-user-lookuptrue

com.apple.security.exception.files.absolute-path.read-only

/private/var/db/eligibilityd/eligibility.plist /private/var/db/os_eligibility/eligibility.plist

com.apple.security.exception.iokit-user-client-class

IOReportUserClient

com.apple.security.system-groups

systemgroup.com.apple.osanalytics

com.apple.security.temporary-exception.files.absolute-path.read-only

/private/var/db/eligibilityd/eligibility.plist /private/var/db/os_eligibility/eligibility.plist

com.apple.signpostsupport.notification.listentrue

com.apple.system-task-ports.readtrue

com.apple.tailspin.dump-outputtrue

com.apple.trial.status.deployment-environment.allow

com.apple.usermanagerd.persona.fetchtrue

Interesting Strings

Bundle IDs(100)

com.apple.private.logging.stream com.apple.security.system-groups0# com.apple.system-task-ports.read !com.apple.private.biome.read-only0r !systemgroup.com.apple.osanalytics0

File Paths(75)

%s [%d]: %s: NULL expectedRealDir (from /var/tmp)%s [%d]: %s: expectedRealDir of / (from /var/tmp)%s [%d]: generate spindump: filepath %s not in /var/tmp %s: /private/var/db/spindump already exists and isnt a directory!%s: NULL expectedRealDir (from /var/tmp)

telemetry(209)

!global_report_preferences.apple_internal || !global_report_preferences.submit_reports_for_spins !global_report_preferences.submit_reports_for_service_watchdog !global_report_preferences.submit_reports_for_spins !systemgroup.com.apple.osanalytics0 !userRequestedReport && !submit

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(8)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostname4GenerativeModels.GenerativeFunctions.Instrumentation

HostnameDcom.apple.security.temporary-exception.files.absolute-path.read-only0b

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

1

Storage

3

Hardware

2

IPC

0

Analytics

1

Security

0

System

1

Behavioral Profile

URL Endpoints

4

Telemetry Strings

209

File Paths

75

Bundle IDs

100

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code13df1072cd8b3dfd18bff7f3f4dc3d3cdc647273260f42bd5674c90ca81bae20

Imports7d57f31959ce43493924897614d9dbbca8dfee5298b0d62e25003e7c2a890554

Frameworksdfb9b5735860217e4758e23873304e69f7f1bb6ec1bc8fd1658b7c419fda4270

Classesc974896ad58f11dfbf88cbedd3eb0bfa6f49a610ebe9b587f2c511481fe3bb14

Entitlements2030657bbd2e9be307c6fe115102e29261343db417ba78a8d3c8f79e5e7662f1

Symbolsbdaa599ba1f1b9fa02e8acc68c2be1d583678250b330a7c681735fd737918424

Static Libraries0 / 2668 functions identified

Functions(2668)

0x1000016a8sub_1000016a8

0x100033960sub_100033960

0x1000356e4sub_1000356e4

0x1000357c8sub_1000357c8

0x1000358d4sub_1000358d4

0x100035b34sub_100035b34

0x100035b9csub_100035b9c

0x100035ec4sub_100035ec4

0x100035f54sub_100035f54

0x100035fb8sub_100035fb8

0x100035fd8sub_100035fd8

0x100037adcsub_100037adc

0x100037b74sub_100037b74

0x100039534sub_100039534

0x100039568sub_100039568

0x1000395f4sub_1000395f4

0x100039630sub_100039630

0x100039694sub_100039694

0x1000396b4sub_1000396b4

0x10003c078sub_10003c078

Imports449 symbols from 21 dylibs

libSystem.B.dylib250 CoreFoundation36 libobjc.A.dylib35 CrashReporterSupport33 SampleAnalysis17

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

signpost_reporter

thermalmonitord