BTLEServerAgent
executablemacOS1.1 MBx86_64, arm64
Bluetooth device management — handles pairing, connection, and accessory communication
Manages Bluetooth Low Energy device discovery, pairing, and connection lifecycle. Accesses Keychain to store and retrieve device credentials and bonding information. Communicates with paired accessories through direct hardware/driver interfaces and IOKit user clients. Submits diagnostic telemetry and analytics to Apple regarding Bluetooth connection states, device types, and performance metrics. Exposes 18 XPC services for system components and user applications to query device status, initiate pairing, and manage connections.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1.1 MB
- UUID
- 02ED06DA-C6DF-39CC-90A1-CC28D435F729
- Analyzed
- 2026-04-07T05:21:14Z
- CDHash
- 46fbd6d71c2f94f3eddf2c34b3f9375e35ef7701c976a28a0eaf0290011e33de
Capabilities
StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-onlyStorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-writeStorageException: access additional file paths
com.apple.security.exception.files.home-relative-path.read-writeHardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-classHardwareBluetooth LE device access
/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetoothHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-namecom.apple.telephonyutilities.callservicesdaemon.callstatecontrollercom.apple.telephonyutilities.callservicesdaemon.callcapabilitiescom.apple.corespeech.corespeechd.activation.xpccom.apple.corespeech.corespeechservicescom.apple.corespeech.xpccom.apple.bulletinboard.observerconnectioncom.apple.coremedia.systemcontroller.xpccom.apple.server.bluetooth.le.att.xpccom.apple.server.bluetooth.le.pipe.xpccom.apple.accessories.transport-servercom.apple.SystemConfiguration.configdcom.apple.accessories.blepairingcom.apple.PowerManagement.controlcom.apple.CallHistorySyncHelpercom.apple.accessoryupdater.uarpcom.apple.donotdisturb.servicecom.apple.mediaremoted.xpccom.apple.voicemail.vmdcom.apple.privacyaccountingdcom.apple.ABDatabaseDoctorcom.apple.SBUserNotificationcom.apple.installerauthagentcom.apple.AppSSO.service-xpccom.apple.assistant.analyticscom.apple.siri.activationcom.apple.usymptomsdcom.apple.securitydcom.apple.trustdcom.apple.geodcom.apple.healthd.servercom.apple.appprotectiond.readcom.apple.AudioAccessoryServicescom.apple.devicesharing.guestusermodeservicecom.apple.heartratecoordinatord.blecollectionobserver
AnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks16
Entitlements56
com.apple.security.exception.mach-lookup.global-name
com.apple.telephonyutilities.callservicesdaemon.callstatecontrollercom.apple.telephonyutilities.callservicesdaemon.callcapabilitiescom.apple.corespeech.corespeechd.activation.xpccom.apple.corespeech.corespeechservicescom.apple.corespeech.xpccom.apple.bulletinboard.observerconnectioncom.apple.coremedia.systemcontroller.xpccom.apple.server.bluetooth.le.att.xpccom.apple.server.bluetooth.le.pipe.xpccom.apple.accessories.transport-servercom.apple.SystemConfiguration.configdcom.apple.accessories.blepairingcom.apple.PowerManagement.controlcom.apple.CallHistorySyncHelpercom.apple.accessoryupdater.uarpcom.apple.donotdisturb.servicecom.apple.mediaremoted.xpccom.apple.voicemail.vmdcom.apple.privacyaccountingdcom.apple.ABDatabaseDoctorcom.apple.SBUserNotificationcom.apple.installerauthagentcom.apple.AppSSO.service-xpccom.apple.assistant.analyticscom.apple.siri.activationcom.apple.usymptomsdcom.apple.securitydcom.apple.trustdcom.apple.geodcom.apple.healthd.servercom.apple.appprotectiond.readcom.apple.AudioAccessoryServicescom.apple.devicesharing.guestusermodeservicecom.apple.heartratecoordinatord.blecollectionobserver
Interesting Strings
Bundle IDs(211)
File Paths(32)
telemetry(9)
Network Surfaceentitled
Networking Frameworks
Endpoints(9)
API Usage
DNA Capability Vector
Location
0
Keychain
1
Network
1
Storage
4
Hardware
3
IPC
1
Analytics
2
Security
2
System
0
Behavioral Profile
URL Endpoints
5
Telemetry Strings
9
File Paths
32
Bundle IDs
211
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1511 functions identified
Functions(1511)
0x1000013d8sub_1000013d8
0x100001534+[HIDAppleSiriRemoteDevice getTouchHIDReportDescriptor]
0x1000015c0+[HIDAppleSiriRemoteDevice getButtonsHIDReportDescriptor:]
0x100001694+[HIDAppleSiriRemoteDevice getInertialHIDReportDescriptor]
0x100001720+[HIDAppleSiriRemoteDevice getInfraredHIDReportDescriptor]
0x1000017ac+[HIDAppleSiriRemoteDevice getAudioHIDReportDescriptor]
0x100001838+[HIDAppleSiriRemoteDevice getRadioHIDReportDescriptor]
0x1000018c4+[HIDAppleSiriRemoteDevice getDeviceManagementHIDReportDescriptor]
0x100001954+[HIDAppleSiriRemoteDevice getProximityHIDReportDescriptor]
0x1000019e0+[HIDAppleSiriRemoteDevice properties:locationIdOffset:hidDescriptor:extendedData:]
0x100001b10-[HIDAppleSiriRemoteDevice initWithProperties:reports:]
0x100002010sub_100002010
0x100002060-[HIDAppleSiriRemoteDevice dealloc]
0x1000020e4-[HIDAppleSiriRemoteDevice stop]
0x1000022f0sub_1000022f0
0x100002740sub_100002740
0x100002784sub_100002784
0x1000027c0-[HIDAppleSiriRemoteDevice start]
0x100002d60sub_100002d60
0x100002f7csub_100002f7c
Imports357 symbols from 14 dylibs
Exports1
_mh_execute_header0x0