amfid
executablemacOS430.7 KBx86_64, arm64
Authentication service — manages biometric and credential verification with analytics
Authenticates users through Touch ID, Face ID, password, and certificate-based mechanisms with Keychain integration. Exposes three XPC services for system components and applications to request authentication operations. Directly communicates with hardware drivers and IOKit user clients to access biometric sensors and perform cryptographic operations. Submits authentication telemetry and analytics data to Apple's unified analytics system. Maintains private storage for authentication state and configuration. Runs as a hardened runtime process with access to security frameworks for code signing validation and credential management.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 430.7 KB
- UUID
- 379D1DC3-2834-3C66-90A6-B25C70F116D7
- Analyzed
- 2026-04-08T06:24:31Z
- CDHash
- 0649a2dabf37a675ba9131bc40d6504bf9fcc22be5106ed39f0375297a17fd46
Capabilities
HardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-classHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySecurityTouch ID / Face ID / password auth
/System/Library/Frameworks/LocalAuthentication.framework/Versions/A/LocalAuthenticationFrameworks24
SecuritylibMobileGestalt.dylibAppleMobileFileIntegrityCoreFoundationLocalAuthenticationlibmis.dylib(weak)IOKitlibCoreEntitlements.dylibFoundationlibobjc.A.dyliblibc++.1.dyliblibSystem.B.dylibSwiftData(weak)CoreAnalyticslibswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftDispatch.dylib(weak)libswiftIOKit.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftObservation.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswiftos.dylib
Entitlements7
Interesting Strings
Bundle IDs(35)
File Paths(16)
/Library/Preferences/com.apple.security.libraryvalidation.plist/System/Library/DeveloperModeLaunchDaemons/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
telemetry(17)
Network Surface
Networking Frameworks
Endpoints(8)
API Usage
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
1
Hardware
2
IPC
0
Analytics
1
Security
3
System
0
Behavioral Profile
URL Endpoints
5
Telemetry Strings
17
File Paths
16
Bundle IDs
35
IOKit Constants
0
Library Functions
5
Structural HashesSHA-256
Static Libraries5 / 491 functions identified
Identified Libraries
Functions(491)
0x1000017a0sub_1000017a0
0x1000017a4sub_1000017a4
0x10000184csub_10000184c
0x1000019a0sub_1000019a0
0x100001a30sub_100001a30
0x100001db4sub_100001db4
0x100001decsub_100001dec
0x100001e54sub_100001e54
0x100002250sub_100002250
0x100002270sub_100002270
0x10000227csub_10000227c
0x100002324sub_100002324
0x10000240csub_10000240c
0x1000026f0sub_1000026f0
0x100002790sub_100002790
0x1000027d0sub_1000027d0
0x10000287csub_10000287c
0x100002a80sub_100002a80
0x100002c34sub_100002c34
0x100003110sub_100003110
Imports436 symbols from 16 dylibs
Exports2
_ZNSt3__119piecewise_constructE0x1a83e
_mh_execute_header0x0