footprint

JSON
executablemacOS567.0 KBx86_64, arm64

System hardware communication service — manages direct device driver interactions

Provides hardware-level communication and driver management for system components. Handles direct hardware and driver communication across multiple device types. Connects to 8 network endpoints and includes telemetry reporting to Apple. Uses 12 frameworks including 4 private Apple frameworks to interface with device drivers. Runs as an Apple-signed system service with 5 entitlements controlling access to protected hardware resources and system functions.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
567.0 KB
UUID
9FD8ACBA-1BDB-31A0-99C5-C922462463F1
Analyzed
2026-04-07T05:21:15Z
CDHash
cf96954407ac89b62fc7af64f4d34da475bddc5dd6b9b423287330de91488c47

Capabilities

Interesting Strings

Network Surface

Networking Frameworks

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
0
Hardware
1
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
5
Telemetry Strings
2
File Paths
8
Bundle IDs
17
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 436 functions identified

Functions(436)

0x100001158-[FPSystemMem gatherData:error:]
0x1000014ac+[FPMemgraphProcess processWithMemgraph:error:]
0x1000019a8-[FPMemgraphProcess _gatherPageSize]
0x1000019f4-[FPMemgraphProcess doOwnedAccountingAdjustments]
0x100001a50-[FPMemgraphProcess _populateMemoryRegionWithPageQueries:regionInfo:]
0x100001af4-[FPMemgraphProcess enumerateRegions:]
0x100001c38sub_100001c38
0x100001c48sub_100001c48
0x100001c50sub_100001c50
0x100002108sub_100002108
0x100002160sub_100002160
0x1000021a8-[FPMemgraphProcess _addSubrangesForRegion:purgeState:]
0x1000021ac-[FPMemgraphProcess _gatherImageData]
0x1000021b0-[FPMemgraphProcess _gatherLedgers]
0x100002294-[FPMemgraphProcess _gatherProcessState]
0x1000022d4-[FPMemgraphProcess _gatherOwnedVmObjects]
0x1000022dc-[FPMemgraphProcess _populateTask]
0x1000022e4-[FPMemgraphProcess _isAlive]
0x1000022ec-[FPMemgraphProcess breakDownPhysFootprint]
0x1000022fc-[FPMemgraphProcess _gatherIsTranslated]

Imports246 symbols from 12 dylibs

Exports1

_mh_execute_header0x0