coreduetd
executablemacOS443.7 KBx86_64, arm64
System analytics daemon — collects device telemetry and manages intelligent suggestions
Gathers usage data and device analytics for Apple's infrastructure, with access to location information as a system bundle without user prompts. Communicates with paired Apple devices and manages contact/people suggestions and usage predictions. Accesses hardware drivers directly through IOKit and stores collected data in private storage areas. Transmits telemetry and analytics to multiple network endpoints, and exposes functionality through an XPC service for system integration.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 443.7 KB
- UUID
- 095E8A75-FC7B-31A1-8B32-FB58EBF5E075
- Analyzed
- 2026-04-09T09:45:50Z
- CDHash
- 50d61cfdab0f4fac0a28fce8b3e6895b7244505767dbf43d107e28142f3a4c0b
Capabilities
LocationAccess location as a system bundle (no user prompt)
com.apple.locationd.effective_bundle[object Object]StoragePrivate storage area access
com.apple.private.security.storage.proactivepredictions[object Object]HardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-classHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitAnalyticsContact/people suggestion engine
/System/Library/PrivateFrameworks/PeopleSuggester.framework/Versions/A/PeopleSuggesterAnalyticsUsage prediction and tracking
/System/Library/PrivateFrameworks/CoreDuet.framework/Versions/A/CoreDuetFrameworks15
Entitlements57
Interesting Strings
Bundle IDs(171)
File Paths(34)
%@C.db%@C.db-shm%@C.db-wal/AppleInternal/Library/BuildRoots/4~B_wrugCuIyLUVV0Ixwt3Pk2u_4Pgy3jlcZv-Fm8/Library/Caches/com.apple.xbs/Sources/CoreDuet/CoreDuetDaemon/CoreDuetDaemon/CDD.m/AppleInternal/Library/BuildRoots/4~B_wrugCuIyLUVV0Ixwt3Pk2u_4Pgy3jlcZv-Fm8/Library/Caches/com.apple.xbs/Sources/CoreDuet/CoreDuetDaemon/CoreDuetDaemon/Knowledge/CDKnowledgeDaemon.m:613
telemetry(7)
!com.apple.symptom_analytics.query#com.apple.symptom_analytics.refresh<key>com.apple.symptom_analytics.query</key><key>com.apple.symptom_analytics.refresh</key>LifespanLimitDeleted=%{signpost.telemetry:number1,public}lu TotalLimitDeleted=%{signpost.telemetry:number2,public}lu UserDoesNotExistDeleted=%{signpost.telemetry:number3,public}lu
Network Surface
Networking Frameworks
Endpoints(8)
DNA Capability Vector
Location
1
Keychain
0
Network
0
Storage
1
Hardware
3
IPC
0
Analytics
2
Security
0
System
0
Behavioral Profile
URL Endpoints
7
Telemetry Strings
7
File Paths
34
Bundle IDs
171
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 444 functions identified
Functions(444)
0x100001328+[CDServiceManager sharedInstance]
0x10000136csub_10000136c
0x1000013ac-[CDServiceManager init]
0x100001620-[CDServiceManager setupServices]
0x10000167csub_10000167c
0x1000016f8-[CDServiceManager knowledgeDaemon]
0x100001700-[CDServiceManager peopleDaemon]
0x100001708-[CDServiceManager spotlightRecorder]
0x100001710-[CDServiceManager dataMigrator]
0x100001718-[CDServiceManager .cxx_destruct]
0x100001774-[CDKnowledgeDaemonConnection unauthorizedClientError]
0x100001858-[CDKnowledgeDaemonConnection saveObjects:reply:]
0x100001928-[CDKnowledgeDaemonConnection deleteObjects:reply:]
0x1000019f8-[CDKnowledgeDaemonConnection executeQuery:reply:]
0x100001bdc-[CDKnowledgeDaemonConnection deleteAllEventsInEventStreamNamed:reply:]
0x100001cac-[CDKnowledgeDaemonConnection deleteAllEventsMatchingPredicate:reply:]
0x100001d7c-[CDKnowledgeDaemonConnection synchronizeWithReply:]
0x100001e30-[CDKnowledgeDaemonConnection synchronizeWithUrgency:client:reply:]
0x100001f10-[CDKnowledgeDaemonConnection deleteRemoteState:]
0x100001fc4-[CDKnowledgeDaemonConnection sourceDeviceIdentityWithReply:]
Imports210 symbols from 10 dylibs
Exports1
_mh_execute_header0x0