handwritingd
executablemacOS440.7 KBx86_64, arm64
System daemon — manages application lifecycle and shared container access
Runs as a hardened system daemon with entitlements to manage application processes and control access to shared application group containers. Handles inter-process communication through multiple XPC services and Mach service exceptions. Accesses keychain and code signing facilities, and submits analytics data to Apple's unified telemetry system. The daemon maintains file path exceptions across multiple storage locations and references 98 distinct bundle identifiers, suggesting it coordinates behavior across multiple applications and system components.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 440.7 KB
- UUID
- 436DE2E5-A355-36EF-BC69-C4F40647C8CB
- Analyzed
- 2026-04-09T09:51:10Z
- CDHash
- d6f47f9735fe92f5eb926c97b07569350ad0dcf9e99a6f10fd2adc004baf5bfa
Capabilities
StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-only/private/var/MobileAsset/AssetsV2/locks/com.apple.UnifiedAssetFramework//private/var/MobileAsset/AssetsV2/com_apple_MobileAsset_UAF_Handwriting_Synthesis/purpose_auto//private/var/mobile/Library/com.apple.modelcatalog/sideload//private/var/MobileAsset/PreinstalledAssetsV2/InstallWithOs/com_apple_MobileAsset_UAF_Handwriting_Synthesis//System/Library/PreinstalledAssetsV2/RequiredByOs/com_apple_MobileAsset_UAF_Handwriting_Synthesis//private/var/MobileAsset/PreinstalledAssetsV2/InstallWithOs/com_apple_MobileAsset_UAF_FM_Overrides//System/Library/PreinstalledAssetsV2/RequiredByOs/com_apple_MobileAsset_UAF_FM_Overrides//private/var/run/MobileAssetStartupActivation.doneThisBoot/private/var/db/assetsubscriptiond/
StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-writeStorageException: access additional file paths
com.apple.security.exception.files.home-relative-path.read-onlyStorageException: access additional file paths
com.apple.security.exception.files.home-relative-path.read-writeIpcRestricted application group access
com.apple.private.security.restricted-application-groupsIpcShared application group container access
com.apple.security.application-groupsIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-nameAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks13
Entitlements22
com.apple.security.exception.files.absolute-path.read-only
/private/var/MobileAsset/AssetsV2/locks/com.apple.UnifiedAssetFramework//private/var/MobileAsset/AssetsV2/com_apple_MobileAsset_UAF_Handwriting_Synthesis/purpose_auto//private/var/mobile/Library/com.apple.modelcatalog/sideload//private/var/MobileAsset/PreinstalledAssetsV2/InstallWithOs/com_apple_MobileAsset_UAF_Handwriting_Synthesis//System/Library/PreinstalledAssetsV2/RequiredByOs/com_apple_MobileAsset_UAF_Handwriting_Synthesis//private/var/MobileAsset/PreinstalledAssetsV2/InstallWithOs/com_apple_MobileAsset_UAF_FM_Overrides//System/Library/PreinstalledAssetsV2/RequiredByOs/com_apple_MobileAsset_UAF_FM_Overrides//private/var/run/MobileAssetStartupActivation.doneThisBoot/private/var/db/assetsubscriptiond/
Interesting Strings
Bundle IDs(98)
File Paths(33)
telemetry(31)
Network Surface
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
4
Hardware
0
IPC
3
Analytics
1
Security
2
System
1
Behavioral Profile
URL Endpoints
5
Telemetry Strings
31
File Paths
33
Bundle IDs
98
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 321 functions identified
Functions(321)
0x1000011a0-[CHPKSettingsServer dealloc]
0x1000011f8+[CHPKSettingsServer initialize]
0x100001268+[CHPKSettingsServer setupDefaults]
0x100001290sub_100001290
0x100001294+[CHPKSettingsServer sharedSettingsServer]
0x1000012fcsub_1000012fc
0x10000133c-[CHPKSettingsServer init]
0x1000013f0-[CHPKSettingsServer resumeConnectionIfIdle]
0x10000145c-[CHPKSettingsServer listener:shouldAcceptNewConnection:]
0x100001504-[CHPKSettingsServer setGlobalPrefersPencilOnlyDrawing:]
0x10000156c-[CHPKSettingsServer openPencilSettings]
0x100001570-[CHPKSettingsServer setCurrentScribbleLanguageIdentifier:]
0x1000016a8-[CHPKSettingsServer setCurrentScribbleLanguageIdentifiers:]
0x10000195c-[CHPKSettingsServer setGlobalAutoRefineEnabled:]
0x1000019c4-[CHPKSettingsServer getGlobalAutoRefineEnabled]
0x100001a18-[CHPKSettingsServer setGlobalAutoRefineEnabled:withCompletion:]
0x100001ab0-[CHPKSettingsServer setGlobalProofreadingEnabled:withCompletion:]
0x100001b48-[CHPKSettingsServer getGlobalProofreadingEnabled]
0x100001b9c-[CHPKSettingsServer sessionDidBegin]
0x100001ba0-[CHPKSettingsServer sessionDidEnd]
Imports190 symbols from 11 dylibs
Exports1
_mh_execute_header0x0