kmutil
executablemacOS4.1 MBx86_64, arm64
System authentication and security manager — handles biometric auth, keychain access, and code signing
Manages authentication operations including Touch ID, Face ID, and password verification through the Security framework. Interfaces with the Secure Enclave for cryptographic key storage and hardware-backed security operations. Reads and writes NVRAM system variables for persistent configuration. Submits telemetry and analytics data to Apple endpoints. Provides XPC services for other system processes to request authentication and access keychain certificates and code signing operations. Communicates directly with hardware drivers and manages process lifecycle for security-sensitive tasks.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 4.1 MB
- UUID
- 76B3AC70-8BFA-37EC-9695-23DFE8118880
- Analyzed
- 2026-04-09T09:30:07Z
- CDHash
- 20bef550e0a3ba8cc8eb5ad0d830944d0b7c200f2584648b60886100689a5a2a
Capabilities
KeychainHardware key storage (Secure Enclave)
/System/Library/PrivateFrameworks/AppleKeyStore.framework/Versions/A/AppleKeyStoreStorageRead and write system NVRAM variables
com.apple.private.iokit.system-nvram-allow[object Object]HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityTouch ID / Face ID / password auth
/System/Library/Frameworks/LocalAuthentication.framework/Versions/A/LocalAuthenticationSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks41
ArgumentParserInternalKernelManagementAppleKeyStoreDiskImages2libxcselect.dylib(weak)libamsupport.dylib(weak)libcompression.dylib(weak)apfs_boot_mount(weak)CoreServicesDiskManagementlibbootpolicy.dylib(weak)libauthinstall.dylib(weak)SystemPolicy(weak)libSystem.B.dyliblibKernelCollectionBuilder.dyliblibimage4.dylibFoundationlibobjc.A.dylibCoreFoundationDiskArbitrationIOKitLocalAuthenticationSecurityAPFSCollectionsInternalCoreAnalyticsRunningBoardServiceslibc++.1.dyliblibswiftCompression.dylib(weak)libswiftCore.dyliblibswiftCoreFoundation.dyliblibswiftDarwin.dyliblibswiftDispatch.dyliblibswiftIOKit.dyliblibswiftObjectiveC.dyliblibswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_Concurrency.dyliblibswift_DarwinFoundation1.dyliblibswift_DarwinFoundation2.dyliblibswiftos.dylib
Entitlements14
Interesting Strings
Bundle IDs(58)
File Paths(48)
/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/ACMLib/ACMLib.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibCall.c/AppleInternal/usr/local/misc/com.apple.kernelmanagement.familynames.plist/Library/Apple/System/Library/Extensions/AppleKextExcludeList.kext/Library/Extensions
telemetry(16)
Network Surface
Networking Frameworks
Endpoints(25)
Ipv4100.6.2.6
Ipv4100.6.1.13
Ipv4100.6.1.18
Hostnamefield.1.2.840.113635.100.6.2.6
Hostnamefield.1.2.840.113635.100.6.1.13
Hostnamefield.1.2.840.113635.100.6.1.18
Ipv4100.6.1.9
Ipv4100.6.1.12
Ipv4100.6.2.1
Ipv4100.6.1.25
Hostnamefield.1.2.840.113635.100.6.1.9
Hostnamefield.1.2.840.113635.100.6.1.9.1
Hostnamefield.1.2.840.113635.100.6.1.12
Hostnamefield.1.2.840.113635.100.6.2.1
Hostnamearmv8.1m.main
Hostnamev8.1m.main
Ipv60:8:16
Hostnamewww.apple.com
Hostnamecrl.apple.com
DNA Capability Vector
Location
0
Keychain
1
Network
0
Storage
1
Hardware
1
IPC
0
Analytics
1
Security
2
System
1
Behavioral Profile
URL Endpoints
4
Telemetry Strings
16
File Paths
48
Bundle IDs
58
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 10028 functions identified
Functions(10028)
0x100001ec8sub_100001ec8
0x100001fd0sub_100001fd0
0x100002008sub_100002008
0x10000212csub_10000212c
0x100002174sub_100002174
0x10000219csub_10000219c
0x1000021d0sub_1000021d0
0x1000022f4sub_1000022f4
0x100002314sub_100002314
0x100002438sub_100002438
0x100002588sub_100002588
0x1000026acsub_1000026ac
0x100002808sub_100002808
0x10000292csub_10000292c
0x100002a50sub_100002a50
0x100002b74sub_100002b74
0x100002c98sub_100002c98
0x100002dbcsub_100002dbc
0x100002ee0sub_100002ee0
0x100003184sub_100003184
Imports1269 symbols from 38 dylibs
Exports1
_mh_execute_header0x0