dirhelper
executablemacOS192.3 KBx86_64, arm64
Security agent — monitors and enforces system security policies
Enforces macOS security policies and compliance requirements through a system daemon with XPC service exposure for policy queries and updates. Accesses private storage areas to maintain security state and policy configurations. Communicates with 6 network endpoints, likely for policy distribution, threat intelligence, or compliance reporting. Integrates with system frameworks to monitor security-relevant events and apply restrictions based on active policies.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 192.3 KB
- UUID
- 99C73CD7-B122-35B6-8D7A-9E887C41FA2A
- Analyzed
- 2026-04-09T09:47:23Z
- CDHash
- 73fef20641a4d257b54c4adf3b7c419094697f38d2d09711a890996646dd8eda
Capabilities
Frameworks2
Entitlements4
Interesting Strings
Bundle IDs(20)
"com.apple.rootless.storage.folders(com.apple.private.security.storage.Trash/AppleInternal/Library/BuildRoots/4~CAjPugAqVoqCVMMML7E_L8EABGLBhRKFwvOb-Os/Library/Caches/com.apple.xbs/Binaries/libcoreservices_executables/install/TempContent/Objects/libcoreservices.build/dirhelper.build/DerivedSources//AppleInternal/Library/BuildRoots/4~CAjPugAqVoqCVMMML7E_L8EABGLBhRKFwvOb-Os/Library/Caches/com.apple.xbs/Binaries/libcoreservices_executables/install/TempContent/Objects/libcoreservices.build/dirhelper.build/DerivedSources/arm64e//AppleInternal/Library/BuildRoots/4~CAjPugAqVoqCVMMML7E_L8EABGLBhRKFwvOb-Os/Library/Caches/com.apple.xbs/Binaries/libcoreservices_executables/install/TempContent/Objects/libcoreservices.build/dirhelper.build/Objects-normal/arm64e/dirhelper-ca58114f565b7cf8cf8a76a0bc6a9bf0.o
File Paths(10)
/AppleInternal/Library/BuildRoots/4~CAjPugAqVoqCVMMML7E_L8EABGLBhRKFwvOb-Os/Library/Caches/com.apple.xbs/Binaries/libcoreservices_executables/install/TempContent/Objects/libcoreservices.build/dirhelper.build/DerivedSources//AppleInternal/Library/BuildRoots/4~CAjPugAqVoqCVMMML7E_L8EABGLBhRKFwvOb-Os/Library/Caches/com.apple.xbs/Binaries/libcoreservices_executables/install/TempContent/Objects/libcoreservices.build/dirhelper.build/DerivedSources/arm64e//AppleInternal/Library/BuildRoots/4~CAjPugAqVoqCVMMML7E_L8EABGLBhRKFwvOb-Os/Library/Caches/com.apple.xbs/Binaries/libcoreservices_executables/install/TempContent/Objects/libcoreservices.build/dirhelper.build/Objects-normal/arm64e/dirhelper-ca58114f565b7cf8cf8a76a0bc6a9bf0.o/AppleInternal/Library/BuildRoots/4~CAjPugAqVoqCVMMML7E_L8EABGLBhRKFwvOb-Os/Library/Caches/com.apple.xbs/Binaries/libcoreservices_executables/install/TempContent/Objects/libcoreservices.build/dirhelper.build/Objects-normal/arm64e/dirhelperServer.o/AppleInternal/Library/BuildRoots/4~CAjPugAqVoqCVMMML7E_L8EABGLBhRKFwvOb-Os/Library/Caches/com.apple.xbs/Binaries/libcoreservices_executables/install/TempContent/Objects/libcoreservices.build/dirhelper.build/Objects-normal/arm64e/dirhelper_vers.o
Network Surface
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
2
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
0
File Paths
10
Bundle IDs
20
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 37 functions identified
Functions(37)
0x100000660_append_relative_path_component
0x100000854is_app_sandboxed_with_audit_token
0x1000008ccvalidate_user_dir_suffix
0x10000098cmakeDirectoryWithUIDAndGID
0x100000f00_reset_idle_exit
0x100000fd0sub_100000fd0
0x100001044sub_100001044
0x100001100do___dirhelper_create_relative_with_error
0x100001604do___dirhelper_create_user_local
0x100001660create_user_local
0x100001cecdo___dirhelper_internal_server
0x100001d54_dirhelper_internal_server
0x1000024f8do___dirhelper_remove_test
0x100002604do___dirhelper_internal_server_test
0x1000026d0do___dirhelper_idle_exit
0x1000026ecmain
0x100002c20clean_directories
0x100003464sub_100003464
0x1000034a8sub_1000034a8
0x1000034c4mkdir_rootless
Imports98 symbols from 2 dylibs
Exports1
_mh_execute_header0x0