cryptexd
executablemacOS1.6 MBx86_64, arm64
Security daemon — manages cryptographic operations and Secure Enclave communication
Performs cryptographic operations with direct access to the Secure Enclave through keychain hardware key storage. Manages process lifecycle and maintains private storage for sensitive data. Exposes three XPC services for inter-process communication with other system components. Communicates with 13 network endpoints and collects telemetry data. The ad-hoc signature and extensive hardware abstraction capabilities indicate this operates at a privileged system level for security-critical functions.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1.6 MB
- UUID
- 34DAB4D6-E1CB-3C48-8C8E-9A6EC5633B98
- Analyzed
- 2026-04-09T09:46:39Z
- CDHash
- e7fb44048db59c319c5e8e3b6c012ec233dd2900deaed8bd03b4e833dcee9cb4
Capabilities
KeychainHardware key storage (Secure Enclave)
/System/Library/PrivateFrameworks/AppleKeyStore.framework/Versions/A/AppleKeyStoreHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitSystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks37
libbsm.0.dylibIOKitStorageKitDiskImages2CoreFoundationFoundationRunningBoardServiceslibauthinstall.dyliblibamsupport.dylibServiceManagementlibobjc.A.dylibRemoteServiceDiscoveryRemoteXPCSecureConfigDB(weak)APFSlibarchive.2.dylibWatchdogServiceManagement(weak)AppleKeyStoreOpenDirectorylibcryptex_core.dyliblibcryptex_interface.dyliblibimage4.dyliblibsandbox.1.dylibAppServerSupportCryptexServerlibSystem.B.dylibCryptexKitlibswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftDispatch.dylib(weak)libswiftIOKit.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftSystem.dyliblibswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_Concurrency.dyliblibswiftos.dylib(weak)
Interesting Strings
Bundle IDs(174)
File Paths(122)
%{public}s: Failed to read Info.plist %{darwin.errno}d%{public}s: Failed to satisfy dependencies from Info.plist: %s %{darwin.errno}d%{public}s: Info.plist invalid contents: %s %{darwin.errno}d%{public}s: Info.plist invalid root type: %s %{darwin.errno}d%{public}s: Installing cryptex %{public}s is disallowed because it violates install limits in secure config.plist: %s
iokit_constants(1)
telemetry(10)
URLs & Endpoints(6)
$http://crl.apple.com/codesigning.crl0%http://www.apple.com/appleca/root.crl0<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><string>com.apple.compilers.llvm.clang.1_0</string>
Network Surface
Networking Frameworks
Endpoints(13)
Hostnamelibcryptex-589.40.18
Ipv60:8:16
Ipv621:47:27
Hostnamewww.apple.com
Hostnamemacosx26.1.internal
Hostname27.cold.1
Hostname27.cold.2
Hostnamecrl.apple.com
DNA Capability Vector
Location
0
Keychain
1
Network
0
Storage
1
Hardware
1
IPC
0
Analytics
0
Security
0
System
1
Behavioral Profile
URL Endpoints
6
Telemetry Strings
10
File Paths
122
Bundle IDs
174
IOKit Constants
1
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1241 functions identified
Functions(1241)
0x100001cf8-[CryptexPathMap init]
0x100001d60-[CryptexPathMap dict]
0x100001d68-[CryptexPathMap .cxx_destruct]
0x100001d74+[UpgradeTerminationAssertion logHandle]
0x100001db8sub_100001db8
0x100001e00-[UpgradeTerminationAssertion initWithGraftPath:]
0x100001f44-[UpgradeTerminationAssertion acquireWithError:]
0x100001f8c-[UpgradeTerminationAssertion invalidateWithError:]
0x100001fd4-[UpgradeTerminationAssertion terminationAssertion]
0x100001fdc-[UpgradeTerminationAssertion .cxx_destruct]
0x100001fe8-[UpgradeOperation initWithCryptexName:graftPath:]
0x100002100-[UpgradeOperation terminateJobsWithCompletion:]
0x100002200sub_100002200
0x1000026b8sub_1000026b8
0x100002700sub_100002700
0x10000273c-[UpgradeOperation terminateApplications]
0x10000287csub_10000287c
0x10000288csub_10000288c
0x100002894sub_100002894
0x100002e34sub_100002e34
Imports661 symbols from 25 dylibs
Exports182
$s8cryptexd12InventoryXPCC14createEndpointSo13OS_xpc_object_pyYaKF0x57098
$s8cryptexd12InventoryXPCC14createEndpointSo13OS_xpc_object_pyYaKFTq0x7e808
$s8cryptexd12InventoryXPCC14createEndpointSo13OS_xpc_object_pyYaKFTu0x69888
$s8cryptexd12InventoryXPCC5queueACSo012OS_dispatch_D7_serialC_tKcfC0x562a8
$s8cryptexd12InventoryXPCC5queueACSo012OS_dispatch_D7_serialC_tKcfCTq0x7e7f8
$s8cryptexd12InventoryXPCC5queueACSo012OS_dispatch_D7_serialC_tKcfc0x562ec
$s8cryptexd12InventoryXPCC5startyyYaKF0x56a34
$s8cryptexd12InventoryXPCC5startyyYaKFTq0x7e800
$s8cryptexd12InventoryXPCC5startyyYaKFTu0x69880
$s8cryptexd12InventoryXPCC6server13CryptexServer0F0Cvg0x56298
$s8cryptexd12InventoryXPCC6server13CryptexServer0F0CvpMV0x69890
$s8cryptexd12InventoryXPCC6server13CryptexServer0F0CvpWvd0x8aeb0
$s8cryptexd12InventoryXPCCACycfC0x57728
$s8cryptexd12InventoryXPCCACycfc0x5775c
$s8cryptexd12InventoryXPCCMa0x56990
$s8cryptexd12InventoryXPCCMn0x7e7c4
$s8cryptexd12InventoryXPCCN0x8aa08
$s8cryptexd12InventoryXPCCfD0x577bc
OBJC_CLASS_$_CollationMap0x8a908
OBJC_CLASS_$_CryptexPathMap0x8a318
OBJC_CLASS_$_CryptexSession0x8a4d0
OBJC_CLASS_$_CryptexSessionList0x8a4a8
OBJC_CLASS_$_EventClient0x8a868
OBJC_CLASS_$_EventServer0x8a8b8
OBJC_CLASS_$_OS_codex0x8a638
OBJC_CLASS_$_OS_cryptex_base0x8a5e8
OBJC_CLASS_$_OS_daemon0x8a688
OBJC_CLASS_$_OS_proc0x8a6d8
OBJC_CLASS_$_OS_protex0x8a728
OBJC_CLASS_$_OS_quire0x8a778
OBJC_CLASS_$_OS_resource0x8a7c8
OBJC_CLASS_$_OS_view0x8a818
OBJC_CLASS_$_SandboxManager0x8a958
OBJC_CLASS_$_UpgradeClient0x8a408
OBJC_CLASS_$_UpgradeOperation0x8a3b8
OBJC_CLASS_$_UpgradeSequencer0x8a458
OBJC_CLASS_$_UpgradeTerminationAssertion0x8a368
OBJC_CLASS_$_UserSpec0x8a570
OBJC_CLASS_$_UserSpecManager0x8a598
OBJC_CLASS_$__TtC8cryptexd12InventoryXPC0x8aa08
OBJC_IVAR_$_CryptexSessionList.rw_lock0x8a2b0
OBJC_METACLASS_$_CollationMap0x8a930
OBJC_METACLASS_$_CryptexPathMap0x8a340
OBJC_METACLASS_$_CryptexSession0x8a4f8
OBJC_METACLASS_$_CryptexSessionList0x8a520
OBJC_METACLASS_$_EventClient0x8a890
OBJC_METACLASS_$_EventServer0x8a8e0
OBJC_METACLASS_$_OS_codex0x8a660
OBJC_METACLASS_$_OS_cryptex_base0x8a610
OBJC_METACLASS_$_OS_daemon0x8a6b0
OBJC_METACLASS_$_OS_proc0x8a700
OBJC_METACLASS_$_OS_protex0x8a750
OBJC_METACLASS_$_OS_quire0x8a7a0
OBJC_METACLASS_$_OS_resource0x8a7f0
OBJC_METACLASS_$_OS_view0x8a840
OBJC_METACLASS_$_SandboxManager0x8a980
OBJC_METACLASS_$_UpgradeClient0x8a430
OBJC_METACLASS_$_UpgradeOperation0x8a3e0
OBJC_METACLASS_$_UpgradeSequencer0x8a480
OBJC_METACLASS_$_UpgradeTerminationAssertion0x8a390
OBJC_METACLASS_$_UserSpec0x8a548
OBJC_METACLASS_$_UserSpecManager0x8a5c0
OBJC_METACLASS_$__TtC8cryptexd12InventoryXPC0x8aec8
_AMAuthInstallSetCryptex1ApParamsFromHost0xd280
__set___object_init_sym_codex_init0x85868
__set___subsystem_sym__codex_sub0x85860
__set___subsystem_sym__daemon_sub0x85858
__set___subsystem_sym__session_sub0x85850
_amfi_unload_trust_cache0x3ded0
_codex_alloc0x1bc5c
_codex_dealloc0x21464
_codex_sub0x84150
_cryptex_base_alloc0x1bb98
_daemon_alloc0x1bd20
_daemon_dealloc0xb8fc
_daemon_sub0x827d8
_dg0x8ae80
_find_error0xd1b4
_mh_execute_header0x0
_proc_alloc0x1bde4
_proc_dealloc0x1c200
_protex_alloc0x1bea8
_protex_dealloc0x19ed8
_quire_alloc0x1bf6c
_quire_dealloc0x3e5a8
_resource_alloc0x1c030
_resource_dealloc0x38e4c
_session_sub0x82788
_view_alloc0x1c0f4
_view_dealloc0xf260
acquireHead0x59188
addLinkAtHead0x59164
aks_open_bag_for_uid_at_path0xacac
amfi_check_dyld_policy_for_pid0x5f7f0
amfi_check_dyld_policy_self0x5f77c
amfi_load_trust_cache0x5f86c
amfi_unload_trust_cache0x5f8c8
codex_do_once_initialized0x21644
codex_sub_handle_xpc_request0x188a8
collation_get_id_for_user0x2fb74
collation_map_add0x3016c
collation_map_get_endpoint_for_user0x30224
collation_map_initialize_for_user0x30380
collation_map_lookup_cryptex_with_attributes0x30310
collation_map_remove0x301b8
collation_sub_new_client0x1bab0
createSandboxHandleFromFile0x3060c
cryptex_path_map_append0x7c58
cryptex_path_map_create0x7c4c
cryptex_xpc_connection_is_entitled0x3c368
cryptexdVersionNumber0x69148
cryptexdVersionString0x69110
developer_mode_get0x19e60
dyld_shared_region_increment0x1fba8
dyld_shared_region_read0x1fbf4
extractImage4Payload0x589c8
getLaunchdDomainForUser0x54e44
getODNode0x156dc
get_session_type_for_domain0x54e18
hdi_detach0x38ad0
img4_chip_instance_from_xpc0xd5c4
img4_chip_instance_to_xpc0xd324
launch_cryptex_terminate_with_timeout0x14a28
launchd_get_job_sandbox0x54f10
main0x3d4a4
module0UUID0x58b7c
module1EntryFlags0x58d78
module1EntryHashType0x58d70
module1UUID0x58c2c
module2EntryConstraintCategory0x58ed4
module2EntryFlags0x58ecc
module2EntryHashType0x58ec4
module2UUID0x58d80
moduleCapabilities0x58f74
moduleEntryConstraintCategory0x590fc
moduleEntryFlags0x59084
moduleEntryHashType0x59010
moduleUUID0x58edc
mount_sub_handle_request0x39494
path_is_parent0x14c64
protex_skip_staging0x1b268
queryModule0x58fb8
queryModule00x58bd4
queryModule10x58c88
queryModule20x58ddc
quire_set_watchdog_registered0x4697c
quire_watchdog_registered0x46970
searchChainForUUID0x59340
searchRuntimeForUUID0x593b0
session_list_foreach0x14220
sm_pending_service_destroy0x1ed84
sm_pending_services_cleanup0x1ef78
sm_service_on_unload0x1d2b4
sub_get_subsystem_from_msg0x3d33c
sub_remote_xpc_message_recv0x30c20
sysctl_upgrade_is_ongoing0x5179c
sysctl_upgrade_set0x51754
system_supports_restricted_exec_mode0x1fb34
trustCacheCheckRuntimeForUUID0x59194
trustCacheConstructInvalid0x59448
trustCacheExtractModule0x591f8
trustCacheGetCapabilities0x59288
trustCacheGetModule0x59310
trustCacheGetUUID0x592a0
trustCacheLoad0x597f4
trustCacheLoadModule0x59630
trustCacheLoadModuleRange0x594d0
trustCacheLoadRange0x59648
trustCacheUnload0x59818
upgrade_sub_abort0x3c464
upgrade_sub_lock_for_client0x1b2b4
upgrade_sub_trampoline_block_client0x53474
validateImage40x58574
validateModule0x58f08
validateModule00x58b84
validateModule10x58c34
validateModule20x58d88
watchdog_available0x89e4
watchdog_bootstrap_service_descriptions0xa2a0
watchdog_copy_service_description_labels0xa140
watchdog_create_service_descriptions0x8c60
watchdog_unbootstrap_service_descriptions0xa8b8