replayd
executablemacOS2.7 MBx86_64, arm64
System daemon — manages application lifecycle, process state, and inter-process communication
Manages application launch, termination, and process lifecycle events across the system. Queries and maintains process state information through RunningBoard integration, allowing other system components to track running applications. Handles restricted inter-process communication through XPC services and application group containers, with exceptions to access additional Mach services. Accesses encryption keys from the device key bag and manages keychain credentials and code signing certificates. Makes outgoing network connections and monitors network reachability to support system functionality. Sends telemetry data through 16 telemetry points. Interacts with the window server for display control and manages application-level permissions and container access restrictions.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 2.7 MB
- UUID
- F16C1BA1-2F57-39B1-91E3-506932F3C41F
- Analyzed
- 2026-04-09T10:01:33Z
- CDHash
- e97d0030bef01f035d00480e7afa877bb6607a40564583162be79d3f5a775f13
Capabilities
KeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagNetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationStoragePrivate storage area access
com.apple.private.security.storage.AppDataContainers[object Object]StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-writeHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitIpcRestricted application group access
com.apple.private.security.restricted-application-groupsIpcShared application group container access
com.apple.security.application-groupsIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-namecom.apple.telephonyutilities.callservicesdaemon.callstatecontrollercom.apple.telephonyutilities.callservicesdaemon.callcapabilitiescom.apple.telephonyutilities.callservicesdaemon.callprovidermanagercom.apple.ReplayKitAngel.machcom.apple.biome.PublicStreamAccessServicecom.apple.controlcenter.remoteservicecom.apple.iconservicescom.apple.rtcreportingdcom.apple.usernotifications.usernotificationservicecom.apple.usernotifications.listenercom.apple.backboardd.virtualframebuffercom.apple.airplay.endpoint.xpccom.apple.mediaexperience.endpoint.xpccom.apple.coremedia.endpoint.xpccom.apple.systemstatus.publisher
SecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesSystemWindow server (display control)
/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/SkyLightFrameworks52
IOKitSystemStatusCoreAudiolibbsm.0.dylibTCCSoftLinkingMetalPerformanceShadersUniformTypeIdentifiersPortraitMetalMetalKitVisionCMCaptureRunningBoardServicesAppKitIconServicesVideoToolboxImageIOSecurityPlugInKitSkyLightCoreServicesManagedClientAssertionServicesFoundationAVFoundationMediaToolboxScreenCaptureKitBackBoardServicesCoreGraphicsAudioToolboxBiomeStreamsCoreVideoCacheDeleteFrontBoardServicesSystemConfigurationIOSurfaceMobileKeyBagPhotosQuartzCoreRTCReportingUserNotificationsUserNotificationsUICoreMedialibCTGreenTeaLogger.dyliblibMobileGestalt.dylibCallKitlibobjc.A.dyliblibSystem.B.dylibAVFAudioCoreFoundationCoreText
Entitlements59
com.apple.security.exception.mach-lookup.global-name
com.apple.telephonyutilities.callservicesdaemon.callstatecontrollercom.apple.telephonyutilities.callservicesdaemon.callcapabilitiescom.apple.telephonyutilities.callservicesdaemon.callprovidermanagercom.apple.ReplayKitAngel.machcom.apple.biome.PublicStreamAccessServicecom.apple.controlcenter.remoteservicecom.apple.iconservicescom.apple.rtcreportingdcom.apple.usernotifications.usernotificationservicecom.apple.usernotifications.listenercom.apple.backboardd.virtualframebuffercom.apple.airplay.endpoint.xpccom.apple.mediaexperience.endpoint.xpccom.apple.coremedia.endpoint.xpccom.apple.systemstatus.publisher
Interesting Strings
Bundle IDs(228)
File Paths(62)
telemetry(16)
Network Surfaceentitled
Networking Frameworks
Endpoints(9)
DNA Capability Vector
Location
0
Keychain
1
Network
2
Storage
2
Hardware
1
IPC
4
Analytics
0
Security
1
System
2
Behavioral Profile
URL Endpoints
6
Telemetry Strings
16
File Paths
62
Bundle IDs
228
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 3249 functions identified
Functions(3249)
0x100002268sub_100002268
0x100002350sub_100002350
0x100002790sub_100002790
0x10000279csub_10000279c
0x100002a34sub_100002a34
0x100002ad8sub_100002ad8
0x100002b44+[ReplayKitTestUtility hasCameraDevice]
0x100002b90+[ReplayKitTestUtility getCameraDeviceUniqueID]
0x100002ba8+[ReplayKitTestUtility getCameraDeviceUniqueIDWithType:]
0x100002f60+[ReplayKitTestUtility hasMicDevice]
0x100002fac+[ReplayKitTestUtility getMicDeviceUniqueID]
0x100003018+[ReplayKitTestUtility getCameraBackgrounReplacementURL]
0x1000030e4+[ReplayKitTestUtility performCommand:withArguments:withDuration:]
0x100003240sub_100003240
0x100003248sub_100003248
0x100003250sub_100003250
0x100003258+[ReplayKitTestUtility validFileUrlWithFileType:]
0x100003418+[ReplayKitTestUtility stringFromCGRect:]
0x10000341c+[ReplayKitTestUtility stringFromCGSize:]
0x100003420sub_100003420
Imports812 symbols from 45 dylibs
Exports1
_mh_execute_header0x0