enhancedloggingd
executablemacOS744.3 KBx86_64, arm64
System service — manages privileged operations and exception handling
Provides exception handling and access control for additional Mach services and file paths beyond standard sandbox restrictions. Exposes two XPC services for inter-process communication with other system components. Connects to network endpoints and collects telemetry data. Interacts with multiple frameworks and manages bundle identifiers, suggesting coordination across multiple system subsystems. Runs with elevated privileges to enforce policy decisions for resource access.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 744.3 KB
- UUID
- 2AA7C1D6-2F33-394C-9935-9411E4CC9C47
- Analyzed
- 2026-04-09T09:48:47Z
- CDHash
- 907724cc9388f79036057ccabb0ad0f035caa9059385cde65858a3196579c96c
Capabilities
StorageException: access additional file paths
com.apple.security.exception.files.home-relative-path.read-writeIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-nameFrameworks35
CoreFollowUpEnhancedLoggingAppleServiceToolkitDiagnosticExtensionsDaemonDiagnosticsKitFoundationDiagnosticExtensionsEnhancedLoggingStatelibobjc.A.dyliblibSystem.B.dylibCoreFoundationHomeKitlibMobileGestalt.dyliblibswiftAVFoundation.dylib(weak)libswiftCompression.dylib(weak)libswiftCore.dyliblibswiftCoreAudio.dylib(weak)libswiftCoreFoundation.dylib(weak)libswiftCoreImage.dylib(weak)libswiftCoreLocation.dylib(weak)libswiftCoreMIDI.dylib(weak)libswiftCoreMedia.dylib(weak)libswiftDispatch.dyliblibswiftIOKit.dylib(weak)libswiftMetal.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dyliblibswiftQuartzCore.dylib(weak)libswiftSynchronization.dyliblibswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_Concurrency.dyliblibswiftos.dyliblibswiftsimd.dylib(weak)
Entitlements13
Interesting Strings
Bundle IDs(41)
File Paths(11)
/System/Library/CoreServices/Enhanced Logging.app/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation/System/Library/PrivateFrameworks/AppleServiceToolkit.framework/Versions/A/AppleServiceToolkit/System/Library/PrivateFrameworks/CoreFollowUp.framework/Versions/A/CoreFollowUp
Network Surface
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
1
Hardware
0
IPC
1
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
1
File Paths
11
Bundle IDs
41
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 772 functions identified
Functions(772)
0x100001ba8-[EnhancedLoggingStateInputs validateAndInitializeParameters:]
0x100001f98sub_100001f98
0x1000025bcsub_1000025bc
0x1000025c4sub_1000025c4
0x1000025ccsub_1000025cc
0x100002680-[EnhancedLoggingStateInputs validateAndInitializeSpecifications:]
0x1000026f8-[EnhancedLoggingStateInputs initWithParameters:]
0x10000285c-[EnhancedLoggingStateInputs rawParameters]
0x100002864-[EnhancedLoggingStateInputs setRawParameters:]
0x100002870-[EnhancedLoggingStateInputs command]
0x100002878-[EnhancedLoggingStateInputs setCommand:]
0x100002880-[EnhancedLoggingStateInputs queue]
0x100002888-[EnhancedLoggingStateInputs setQueue:]
0x100002894-[EnhancedLoggingStateInputs parameterPayloads]
0x10000289c-[EnhancedLoggingStateInputs setParameterPayloads:]
0x1000028a8-[EnhancedLoggingStateInputs specificationPayloads]
0x1000028b0-[EnhancedLoggingStateInputs setSpecificationPayloads:]
0x1000028bc-[EnhancedLoggingStateInputs retries]
0x1000028c4-[EnhancedLoggingStateInputs setRetries:]
0x1000028cc-[EnhancedLoggingStateInputs metadata]
Imports475 symbols from 17 dylibs
Exports1
_mh_execute_header0x0