mobileassetd

executablemacOS226.8 KBx86_64, arm64

System keychain and Secure Enclave manager — manages encryption keys and credential storage

Manages access to the Secure Enclave and system keychain, handling sealed key storage (SIK) and device encryption keys. Reads and writes keychain items, manages keychain group membership, and controls access to the device key bag. Exposes 6 XPC services for other system components to request key operations and credential access. Interacts with NVRAM to persist system state and accesses private storage areas. Communicates with 11 network endpoints and manages 140 bundle identifiers, suggesting coordination with multiple system services and applications.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 226.8 KB
UUID: 37E42B7F-0774-3926-A866-FB8A1E228387
Analyzed: 2026-04-09T09:56:21Z
CDHash: f1487d17e203d17b98f850530dcda8889cc108550670361f7b3f3bdd30179ddd

Capabilities

KeychainAccess Secure Enclave sealed keys (SIK)

com.apple.keystore.sik.access [object Object]

KeychainRead and write system keychain items

com.apple.private.system-keychain [object Object]

KeychainKeychain access group membership

keychain-access-groups

com.apple.mobileassetd lockdown-identities apple

KeychainDevice key bag (encryption keys)

/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag

StorageRead and write system NVRAM variables

com.apple.private.iokit.system-nvram-allow [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.MobileAssetGenerativeModels [object Object]

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-write

/private/var/run/MobileAssetCritialDomainsUpdated.plist /private/var/run/MobileAssetStartupActivation.doneThisBoot /private/var/run/MobileAssetSuspendSystemOptionalForSoftwareUpdate.nonce /private/var/code_coverage//private/var/run/com.apple.mobileassetd-AutoAsset-DeviceBoot-UUID /private/var/run/bootSessionMA.txt

IpcException: access additional Mach services

com.apple.security.exception.mach-lookup.global-name

com.apple.mobileactivationd com.apple.spaceattributiond com.apple.softwareupdated com.apple.remoted com.apple.apsd com.apple.cache_delete com.apple.cache_delete.public com.apple.powerlog.plxpclogger.xpc com.apple.PerfPowerTelemetryClientRegistrationService

Frameworks7

SoftwareUpdateCoreSupport MobileKeyBag libMobileGestalt.dylib Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements63

AppleIntelligence.Reporting.AssetDeliveryLog.Availability <dict>

AppleIntelligence.Reporting.AssetDeliveryLog.MobileAsset <dict>

AppleIntelligence.Reporting.AssetDeliveryLog.ModelCatalog <dict>

AppleIntelligenceReporting.AssetDelivery <dict>

MobileAsset.LifeCycle.InstrumentationEvent <dict>

application-identifier com.apple.mobileassetd

com.apple.PerfPowerServices.data-donationtrue

com.apple.application-identifier com.apple.mobileassetd

com.apple.keystore.dsme_accesstrue

com.apple.keystore.lockassertiontrue

com.apple.keystore.sik.accesstrue

com.apple.mobileactivationd.device-identifierstrue

com.apple.mobileactivationd.spitrue

com.apple.private.CacheDelete

PURGE_ENTITLEMENT CLIENT_ENTITLEMENT PURGEABLE_ENTITLEMENT PURGE_SPECIAL_CASE_ENTITLEMENT

com.apple.private.IASInstallerAuthAgenttrue

com.apple.private.InstallCoordination.OSModuleOperationstrue

com.apple.private.InstallCoordination.allowedtrue

com.apple.private.MobileAsset.ManifestStorageServicetrue

com.apple.private.STRemoteExtractor.privilegedtrue

com.apple.private.SZExtractor.privilegedtrue

com.apple.private.allow-nsurlsession-proxytrue

com.apple.private.apfs.get-graft-infotrue

com.apple.private.aps-connection-initiate

com.apple.mobileassetd

com.apple.private.assets.accessible-asset-types

com.apple.MobileAsset.MobileAssetBrain

com.apple.private.diskimages.kext.user-client-accesstrue

com.apple.private.exclaves.conclave-hosttrue

com.apple.private.image4.nonce.propose.mobile-assettrue

com.apple.private.img4.nonce.cryptex1.assettrue

com.apple.private.img4.nonce.cryptex1.mobile-asset.code-installtrue

com.apple.private.img4.nonce.cryptex1.mobile-asset.code-loadtrue

com.apple.private.img4.nonce.pditrue

com.apple.private.intelligenceplatform.client-identifier com.apple.mobileasset

com.apple.private.intelligenceplatform.use-cases <dict>

com.apple.private.iokit.system-nvram-allowtrue

com.apple.private.kernel.override-cpumontrue

com.apple.private.mobileassetd.supports-update-volumetrue

com.apple.private.mobileassetd.use-download-dirtrue

com.apple.private.network.socket-delegatetrue

com.apple.private.networkextension.configurationtrue

com.apple.private.nsurlsession.impersonatetrue

com.apple.private.nsurlsession.set-discretionary-override-valuetrue

com.apple.private.nsurlsession.set-task-prioritytrue

com.apple.private.pmap.load-trust-cache

personalized.mobile-asset-brain personalized.mobile-asset-code

com.apple.private.security.AppleImage4.user-clienttrue

com.apple.private.security.bootpolicy.readonlytrue

com.apple.private.security.storage.MobileAssetGenerativeModelstrue

com.apple.private.softwareupdate.preferencestrue

com.apple.private.system-keychaintrue

com.apple.private.vfs.exclave-fs-registertrue

com.apple.private.vfs.graftdmgtrue

com.apple.rootless.storage.MobileAssettrue

com.apple.rootless.storage.MobileAssetDownloadtrue

com.apple.rootless.volume.Updatetrue

com.apple.runningboard.terminateprocesstrue

com.apple.security.attestation.accesstrue

com.apple.security.exception.files.absolute-path.read-write

/private/var/run/MobileAssetCritialDomainsUpdated.plist /private/var/run/MobileAssetStartupActivation.doneThisBoot /private/var/run/MobileAssetSuspendSystemOptionalForSoftwareUpdate.nonce /private/var/code_coverage//private/var/run/com.apple.mobileassetd-AutoAsset-DeviceBoot-UUID /private/var/run/bootSessionMA.txt

com.apple.security.exception.mach-lookup.global-name

com.apple.mobileactivationd com.apple.spaceattributiond com.apple.softwareupdated com.apple.remoted com.apple.apsd com.apple.cache_delete com.apple.cache_delete.public com.apple.powerlog.plxpclogger.xpc com.apple.PerfPowerTelemetryClientRegistrationService

com.apple.security.iokit-user-client-class

AppleImage4UserClient IOHDIXControllerUserClient AppleKeyStoreUserClient

com.apple.spaceattribution.privatetrue

keychain-access-groups

com.apple.mobileassetd lockdown-identities apple

mode read-write

seatbelt-profiles

Interesting Strings

Bundle IDs(140)

com.apple.application-identifier com.apple.keystore.lockassertion com.apple.private.img4.nonce.pdi com.apple.rootless.volume.Update !com.apple.private.system-keychain

File Paths(22)

"/private/var/run/bootSessionMA.txt0 /.nofollow/private/var/run/com.apple.mobileassetd-MobileAssetBrain /System/Library/AssetsV2/MobileAssetBrain /System/Library/CoreServices/RestoreVersion.plist /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(11)

HostnameMobileAsset-1837.41.1

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostname9AppleIntelligence.Reporting.AssetDeliveryLog.Availability

Hostname8AppleIntelligence.Reporting.AssetDeliveryLog.MobileAsset

Hostname9AppleIntelligence.Reporting.AssetDeliveryLog.ModelCatalog

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

4

Network

0

Storage

3

Hardware

0

IPC

1

Analytics

0

Security

0

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

0

File Paths

22

Bundle IDs

140

IOKit Constants

0

Library Functions

10

Structural HashesSHA-256

Code5223d24975d8f8fd53483ee04ea94a931f7b562255fc7bc940ec2736df316465

Importsec4371088d248dc3d46bdd7c7efff3bc00b8ace496c0bef48707881016d2b4e0

Frameworkse09e501224ec6f2a70d641a4c864cdd3456092a5ad4dc2253d37ecc1f3a18dae

Classesf9dcb4e42e163f6d45cc9de3b3ec68dd29cfe0a3d2eafd8981258b020ef43bb2

Entitlements7ca9222ccd9e9893a12432d98ae03f3ade5837ac151e466aba0bab44759d3807

Symbols3eba55515124766dacacd1d5f57b8b999b13b209d43c801152a959b5c21cb4a7

Static Libraries10 / 81 functions identified

Identified Libraries

FLAC 1.5.0 (1 fn)SDL2 2.32.10 (4 fn)X11 1.8.12 (1 fn)aom 3.13.1 (2 fn)boost_graph 1.89.0 (1 fn)harfbuzz-subset 12.3.0 (1 fn)

Functions(81)

0x100000dc0sub_100000dc0

0x100000e68sub_100000e68

0x100001120sub_100001120

0x1000014e0sub_1000014e0

0x100001510sub_100001510

0x1000017b0sub_1000017b0

0x1000019a4sub_1000019a4

0x1000019dcsub_1000019dc

0x100001a30sub_100001a30

0x100001a68sub_100001a68

0x100001aa0sub_100001aa0

0x100001bc0sub_100001bc0

0x100001c60sub_100001c60

0x100001c88sub_100001c88

0x100001c90sub_100001c90

0x100001cc0sub_100001cc0

0x100001cf0sub_100001cf0

0x100001f08sub_100001f08

0x100001f18sub_100001f18

0x100001f20sub_100001f20

Imports86 symbols from 6 dylibs

libSystem.B.dylib36 libobjc.A.dylib20 Foundation14 CoreFoundation11 SoftwareUpdateCoreSupport3

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

mobile_storage_proxy

uarpassetmanagerd

assetsubscriptiond