online-auth-agent

JSON
executablemacOS903.8 KBx86_64, arm64

System keychain and cryptography manager — manages encryption keys and secure credential storage

Manages system-wide keychain operations, Secure Enclave key access, and cryptographic operations across macOS. Handles reading and writing of system keychain items, manages keychain access group memberships, and performs direct cryptographic operations. Communicates with iCloud for credential synchronization and submits analytics telemetry. Interfaces with 5 XPC services to provide credential and encryption services to other system processes and applications. Accesses hardware drivers directly for Secure Enclave operations and maintains a private storage area for sensitive data.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
903.8 KB
UUID
5F490C18-D26C-3E2C-A2FF-C90788F57B23
Analyzed
2026-04-09T09:58:31Z
CDHash
4892c01867ffb2cbbfed683b550faff4bda7a3d939eb1a32b531f5db65e98309

Interesting Strings

Network Surface

API Usage

DNA Capability Vector

Location
0
Keychain
3
Network
1
Storage
1
Hardware
1
IPC
1
Analytics
1
Security
2
System
1

Behavioral Profile

URL Endpoints
6
Telemetry Strings
9
File Paths
24
Bundle IDs
72
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 1301 functions identified

Functions(1301)

0x100001bc8-[SQLDB init]
0x100001be4-[SQLDB initWithDatabaseURL:asReadOnly:]
0x100001d20-[SQLDB initWithDatabaseURL:]
0x100001d28+[SQLDB databaseWithURL:]
0x100001e18-[SQLDB walURL]
0x100001f38-[SQLDB shmURL]
0x100002058-[SQLDB setupSchema]
0x1000020c8-[SQLDB setupPermissions]
0x1000021b8-[SQLDB dealloc]
0x100002208-[SQLDB executeQuery:withBind:withResults:]
0x1000022c4sub_1000022c4
0x1000022f4sub_1000022f4
0x100002304sub_100002304
0x10000230c-[SQLDB executeQuery:withBind:withCancellableResults:]
0x100002858-[SQLDB transaction:]
0x100002860-[SQLDB transaction:immediate:]
0x10000293c-[SQLDB checkpoint]
0x100002954-[SQLDB readSetting:]
0x100002ad8sub_100002ad8
0x100002ae8sub_100002ae8

Imports679 symbols from 24 dylibs

Exports21

$sSo12MISDBManagerC17online_auth_agentE22addMonotonicTimeOffset_6cdHashySi_10Foundation4DataVSgtKF0x25050
$sSo12MISDBManagerC17online_auth_agentE22addRTCResetCountOffset_6cdHashySi_10Foundation4DataVSgtKF0x251b4
$sSo8MISErrorV17online_auth_agentE9hexStringSSyF0x1f560
MISProvisioningProfileGetDeveloperCertificatesHashes0x68d0
MISProvisioningProfileGetEmbeddedDER0x699c
MISProvisioningProfileGetEntitlements0x6964
MISProvisioningProfileGetExpirationDate0x68b8
MISProvisioningProfileGetName0x68c4
MISProvisioningProfileGetTeamIdentifier0x665c
MISProvisioningProfileGetTeamName0x672c
MISProvisioningProfileGetUUID0x6958
MISProvisioningProfileHasPPQExemption0x6738
MISProvisioningProfileIsAppleInternalProfile0x65f4
MISProvisioningProfileIsForBetaDeployment0x69a8
MISProvisioningProfileIsForLocalProvisioning0x6808
MISProvisioningProfileProvisionsAllDevices0x6720
MISProvisioningProfileValidateSignature0x6998
MISXMLProvisioningProfileGetDeveloperCertificates0x6904
OBJC_CLASS_$_MISOnlineAuthEntry0x620d0
OBJC_METACLASS_$_MISOnlineAuthEntry0x620f8
_mh_execute_header0x0