mobile_storage_proxy
executablemacOS431.2 KBx86_64, arm64
System hardware abstraction layer — manages IOKit drivers and device communication
Provides low-level hardware abstraction and device driver management through IOKit user client access. Communicates with hardware and drivers directly via exceptions to normal IOKit restrictions. Exposes 7 XPC services to other system components requesting hardware access and device operations. Accesses device encryption keys from the keychain and maintains private storage areas. Makes outgoing network connections and contacts 8 network endpoints, likely for device telemetry or configuration data. Runs with elevated privileges to mediate hardware access across the system.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 431.2 KB
- UUID
- 469EEE86-619E-3EA9-8E23-2B0635A6A32C
- Analyzed
- 2026-04-09T09:56:09Z
- CDHash
- 02d029168be30105a155bd29a9d6808ca86d9a5101b32b09096b0ca2ea7b1c4e
Capabilities
KeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagStoragePrivate storage area access
com.apple.private.security.storage.MobileStorageMounter[object Object]StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-only/private/var/mobile/Library/.FactoryMacCheckEnabledHardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-classHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-nameFrameworks12
Entitlements12
Interesting Strings
Bundle IDs(43)
File Paths(18)
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit/System/Library/PrivateFrameworks/DiskImages2.framework/Versions/A/DiskImages2/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag
telemetry(1)
Network Surfaceentitled
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
1
Network
1
Storage
2
Hardware
2
IPC
1
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
1
File Paths
18
Bundle IDs
43
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 308 functions identified
Functions(308)
0x100000e08sub_100000e08
0x100000e4csub_100000e4c
0x100000e90sub_100000e90
0x100000f64sub_100000f64
0x100000fa8sub_100000fa8
0x100000fb0sub_100000fb0
0x100000fb8sub_100000fb8
0x100001048sub_100001048
0x1000010c0sub_1000010c0
0x10000117csub_10000117c
0x1000011a0sub_1000011a0
0x1000011b0sub_1000011b0
0x1000011bcsub_1000011bc
0x10000124csub_10000124c
0x10000125csub_10000125c
0x100001318sub_100001318
0x100001330sub_100001330
0x100001364sub_100001364
0x100001b50sub_100001b50
0x10000252csub_10000252c
Imports181 symbols from 12 dylibs
Exports1
_mh_execute_header0x0