online-auth-agent
executablemacOS903.8 KBx86_64, arm64
System keychain and cryptography manager — manages encryption keys and secure credential storage
Manages system-wide keychain operations, Secure Enclave key access, and cryptographic operations across macOS. Handles reading and writing of system keychain items, manages keychain access group memberships, and performs direct cryptographic operations. Communicates with iCloud for credential synchronization and submits analytics telemetry. Interfaces with 5 XPC services to provide credential and encryption services to other system processes and applications. Accesses hardware drivers directly for Secure Enclave operations and maintains a private storage area for sensitive data.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 903.8 KB
- UUID
- 5F490C18-D26C-3E2C-A2FF-C90788F57B23
- Analyzed
- 2026-04-09T09:58:31Z
- CDHash
- 4892c01867ffb2cbbfed683b550faff4bda7a3d939eb1a32b531f5db65e98309
Capabilities
StoragePrivate storage area access
com.apple.private.security.storage.MobileIdentityService[object Object]HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-nameAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySecurityCryptographic operations
/System/Library/Frameworks/CryptoKit.framework/Versions/A/CryptoKitSystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks33
ProfileValidatedAppIdentity(weak)DeviceIdentity(weak)CoreTimelibmis.dyliblibCoreEntitlements.dylibMobileAssetlibMobileGestalt.dylibCoreServiceslibsqlite3.dylibIOKitlibSystem.B.dylibFoundationSecuritylibobjc.A.dylibCloudKitCoreFoundationCryptoKitCoreAnalyticsInstalledContentLibraryMessageSecurityRunningBoardServiceslibswiftCompression.dyliblibswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftCoreLocation.dylib(weak)libswiftDispatch.dyliblibswiftIOKit.dylib(weak)libswiftObjectiveC.dyliblibswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_DarwinFoundation1.dyliblibswiftos.dylib
Entitlements24
Interesting Strings
Bundle IDs(72)
File Paths(24)
/System/Library/Frameworks/CloudKit.framework/Versions/A/CloudKit/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices/System/Library/Frameworks/CryptoKit.framework/Versions/A/CryptoKit/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
telemetry(9)
Network Surface
Networking Frameworks
Endpoints(11)
Hostnameppq.apple.com
Hostnameprofiles.name
Ipv4100.6.2.17
Ipv60:8:16
Hostnamewww.apple.com
Hostnamecrl.apple.com
API Usage
DNA Capability Vector
Location
0
Keychain
3
Network
1
Storage
1
Hardware
1
IPC
1
Analytics
1
Security
2
System
1
Behavioral Profile
URL Endpoints
6
Telemetry Strings
9
File Paths
24
Bundle IDs
72
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1301 functions identified
Functions(1301)
0x100001bc8-[SQLDB init]
0x100001be4-[SQLDB initWithDatabaseURL:asReadOnly:]
0x100001d20-[SQLDB initWithDatabaseURL:]
0x100001d28+[SQLDB databaseWithURL:]
0x100001e18-[SQLDB walURL]
0x100001f38-[SQLDB shmURL]
0x100002058-[SQLDB setupSchema]
0x1000020c8-[SQLDB setupPermissions]
0x1000021b8-[SQLDB dealloc]
0x100002208-[SQLDB executeQuery:withBind:withResults:]
0x1000022c4sub_1000022c4
0x1000022f4sub_1000022f4
0x100002304sub_100002304
0x10000230c-[SQLDB executeQuery:withBind:withCancellableResults:]
0x100002858-[SQLDB transaction:]
0x100002860-[SQLDB transaction:immediate:]
0x10000293c-[SQLDB checkpoint]
0x100002954-[SQLDB readSetting:]
0x100002ad8sub_100002ad8
0x100002ae8sub_100002ae8
Imports679 symbols from 24 dylibs
Exports21
$sSo12MISDBManagerC17online_auth_agentE22addMonotonicTimeOffset_6cdHashySi_10Foundation4DataVSgtKF0x25050
$sSo12MISDBManagerC17online_auth_agentE22addRTCResetCountOffset_6cdHashySi_10Foundation4DataVSgtKF0x251b4
$sSo8MISErrorV17online_auth_agentE9hexStringSSyF0x1f560
MISProvisioningProfileGetDeveloperCertificatesHashes0x68d0
MISProvisioningProfileGetEmbeddedDER0x699c
MISProvisioningProfileGetEntitlements0x6964
MISProvisioningProfileGetExpirationDate0x68b8
MISProvisioningProfileGetName0x68c4
MISProvisioningProfileGetTeamIdentifier0x665c
MISProvisioningProfileGetTeamName0x672c
MISProvisioningProfileGetUUID0x6958
MISProvisioningProfileHasPPQExemption0x6738
MISProvisioningProfileIsAppleInternalProfile0x65f4
MISProvisioningProfileIsForBetaDeployment0x69a8
MISProvisioningProfileIsForLocalProvisioning0x6808
MISProvisioningProfileProvisionsAllDevices0x6720
MISProvisioningProfileValidateSignature0x6998
MISXMLProvisioningProfileGetDeveloperCertificates0x6904
OBJC_CLASS_$_MISOnlineAuthEntry0x620d0
OBJC_METACLASS_$_MISOnlineAuthEntry0x620f8
_mh_execute_header0x0