kextcache

executablemacOS991.7 KBx86_64, arm64

System security service — manages cryptographic keys, certificates, and code signatures

Provides cryptographic operations and certificate management for system services and applications. Maintains Keychain access, validates code signatures, and manages digital certificates used throughout macOS. Communicates with 19 network endpoints for certificate validation, revocation checking, and trust evaluation. Exposes three XPC services for other system components to request cryptographic operations and certificate status. Logs security events through telemetry.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 991.7 KB
UUID: 32CA2B15-9325-33E6-BA5D-0CF0F356BEB3
Analyzed: 2026-04-07T05:21:11Z
CDHash: e59f69efd7cc4e45f65b278f509de80b91599b817c5a311e7a029fe84f037409

Capabilities

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

Frameworks19

libc++.1.dylib KernelManagement(weak)APFS Bom CoreFoundation Foundation IOKit DiskArbitration CoreGraphics(weak)EFILogin(weak)Security SystemPolicy(weak)libCoreStorage.dylib(weak)CoreText(weak)libcsfde.dylib(weak)libkxld.dylib libz.1.dylib libobjc.A.dylib libSystem.B.dylib

Entitlements2

com.apple.private.kernel.get-kext-infotrue

com.apple.rootless.internal-installer-equivalenttrue

Interesting Strings

Bundle IDs(61)

&com.apple.private.kernel.get-kext-info /.com.apple.NetBootX/shadowfile /System/Library/Caches/com.apple.bootstamps /System/Library/Caches/com.apple.corestorage/EncryptedRoot.plist.wipekey /System/Library/Caches/com.apple.kext.caches

File Paths(69)

%s has no Info.plist file.%s: error %d reading /usr/standalone/bootcaches.plist .plist.gz /AppleInternal/Library/Extensions /Library/Apple/System/Library/Extensions

iokit_constants(1)

kIOKitPersonalitiesKey

telemetry(6)

print diagnostics for kexts with problems /Diagnostics Diagnostics Kext library recording diagnostics%s%s%s%s%s.RecordsDiagnostics

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(19)

Hostnamefield.1.2.840.113635.100.6.2.6

Hostnamefield.1.2.840.113635.100.6.1.13

Hostnamefield.1.2.840.113635.100.6.1.18

Hostnamefield.1.2.840.113635.100.6.1.9

Hostnamefield.1.2.840.113635.100.6.1.9.1

Hostnamefield.1.2.840.113635.100.6.1.12

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

0

Hardware

1

IPC

0

Analytics

0

Security

1

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

6

File Paths

69

Bundle IDs

61

IOKit Constants

1

Library Functions

2

Structural HashesSHA-256

Code1daa097194de7db2f8deb7d76a36138edd0f071b12470480aa45e4dd92fd52f1

Imports4ab36fcaed04a133a8fa55053f2702e9e005b9d0bc5d56b85976b877cebbde7b

Frameworks8c57ebf8c2f1d3cfcb210ac7ceae51f188f457b82a96e6b4af1c6a1467190088

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlementsc63c9a1912d8577976002022c7ff829aeb590c5559a7b47dfd2e24ef115c8db6

Symbols4ab36fcaed04a133a8fa55053f2702e9e005b9d0bc5d56b85976b877cebbde7b

Static Libraries2 / 649 functions identified

Identified Libraries

flatbuffers 25.9.23 (2 fn)

Functions(649)

0x1000010c0sub_1000010c0

0x100001a64sub_100001a64

0x100002484sub_100002484

0x100002588sub_100002588

0x1000025ccsub_1000025cc

0x1000026fcsub_1000026fc

0x100002c30sub_100002c30

0x100002f80sub_100002f80

0x10000314csub_10000314c

0x10000352csub_10000352c

0x100003758sub_100003758

0x100003840sub_100003840

0x100004560sub_100004560

0x1000045b0sub_1000045b0

0x1000048ecsub_1000048ec

0x100004964sub_100004964

0x100004a64sub_100004a64

0x100004b1csub_100004b1c

0x100004c7csub_100004c7c

0x100004cccsub_100004ccc

Imports526 symbols from 18 dylibs

libSystem.B.dylib218 CoreFoundation165 IOKit34 Security25 libc++.1.dylib16

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

systemsoundserverd