linkd

executablemacOS3.5 MBx86_64, arm64

System daemon — manages process lifecycle and reports analytics to Apple

Monitors and manages process state through RunningBoard, enforcing lifecycle transitions and resource constraints. Accesses system location data and Keychain credentials for authenticated operations. Submits diagnostics and performance metrics to Apple's unified analytics infrastructure via 10 network endpoints. Exposes 7 XPC services for inter-process communication with system clients. Handles code signing verification and certificate management through the Security framework.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 3.5 MB
UUID: 00747001-0A91-3ADF-A76B-EB0BEA6FAD95
Analyzed: 2026-04-09T09:53:37Z
CDHash: 52dba955006f913d565583add68c4ee54cd683c7beac826f125c15d9dd721c97

Capabilities

LocationAccess location as a system bundle (no user prompt)

com.apple.locationd.effective_bundle [object Object]

IpcQuery process state from RunningBoard

com.apple.runningboard.process-state [object Object]

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SystemProcess lifecycle management

/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServices

Frameworks46

Intents LinkServices Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation CoreServices RelevanceKit Security AppIntentSchemas AppSupport AssistantServices BiomeLibrary BiomeStorage BiomeStreams CascadeSets CoreAnalytics IntelligencePlatformLibrary LinkMetadata RunningBoardServices libsqlite3.dylib libswiftAccelerate.dylib(weak)libswiftCore.dylib libswiftCoreAudio.dylib(weak)libswiftCoreFoundation.dylib(weak)libswiftCoreImage.dylib(weak)libswiftCoreLocation.dylib(weak)libswiftCoreMIDI.dylib(weak)libswiftDispatch.dylib libswiftIOKit.dylib(weak)libswiftIntents.dylib(weak)libswiftMetal.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dylib libswiftQuartzCore.dylib(weak)libswiftRegexBuilder.dylib libswiftSynchronization.dylib libswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_Concurrency.dylib libswift_DarwinFoundation1.dylib libswift_DarwinFoundation3.dylib libswift_StringProcessing.dylib libswiftos.dylib libswiftsimd.dylib(weak)

Entitlements31

App.Intents.Transcript <dict>

App.Shortcut.Entity <dict>

App.Shortcut.Phrase <dict>

AppIntentsTranscript <dict>

AppShortcuts <dict>

com.apple.application-identifier com.apple.linkd

com.apple.chronoservicestrue

com.apple.frontboard.launchapplicationstrue

com.apple.linkd.registrytrue

com.apple.locationd.effective_bundletrue

com.apple.locationd.usage_oracletrue

com.apple.private.MobileContainerManager.allowedtrue

com.apple.private.appintents.extension-hosttrue

com.apple.private.appleevents.allowed.aevt.quittrue

com.apple.private.appleevents.allowed.lnec.lneitrue

com.apple.private.appleevents.allowedtosend <dict>

com.apple.private.biome.read-onlytrue

com.apple.private.biome.read-writetrue

com.apple.private.chrono-extension-hosttrue

com.apple.private.coreservices.canmaplsdatabasetrue

com.apple.private.intelligenceplatform.client-identifier com.apple.linkd

com.apple.private.intelligenceplatform.use-cases <dict>

com.apple.private.mailservice.deliverytrue

com.apple.private.security.daemon-containertrue

com.apple.private.tcc.allow

kTCCServiceAppleEvents kTCCServiceSystemPolicyDesktopFolder kTCCServiceSystemPolicyDocumentsFolder kTCCServiceSystemPolicyDownloadsFolder

com.apple.runningboard.launchprocesstrue

com.apple.runningboard.process-statetrue

com.apple.security.automation.apple-eventstrue

mode read-write

Interesting Strings

Bundle IDs(79)

com.apple.application-identifier com.apple.locationd.usage_oracle !com.apple.private.biome.read-only "com.apple.private.biome.read-write $com.apple.locationd.effective_bundle

File Paths(19)

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/Intents.framework/Versions/A/Intents /System/Library/Frameworks/RelevanceKit.framework/Versions/A/RelevanceKit

telemetry(7)

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics Diagnostics DiagnosticsError _$ss10SetAlgebraP19symmetricDifferenceyxxnFTq _$ss10SetAlgebraP23formSymmetricDifferenceyyxnFTq

URLs & Endpoints(6)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>com.apple.common

Network Surface

Networking Frameworks

CoreFoundation Foundation libswiftCoreFoundation.dylib libswift_DarwinFoundation1.dylib libswift_DarwinFoundation3.dylib

Endpoints(10)

HostnameLinkProgrammaticInterface-300.1.13.1

Hostnamearm64e-apple-macos.private.swiftinterface

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

1

Keychain

0

Network

0

Storage

0

Hardware

0

IPC

1

Analytics

1

Security

1

System

1

Behavioral Profile

URL Endpoints

6

Telemetry Strings

7

File Paths

19

Bundle IDs

79

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codebdc9bebc889cc22323abc4fea88a8c855c516cd96ae5a6a14cfe945428459c9a

Imports6294bd55b6a45cea65cdac36d0d39243b328631b638074bfca27f1fd5ed52a6f

Frameworks220397902c85dc69bad977491a6fd66dd8594ee04c2f952a704aad53a74fc776

Classes161df8029eaf6753986f7ac343ad91d452157f64a731f7153237c37b4dfaed79

Entitlements780810897d626339e57e002bcc5c82399438e7096fbd9bec15baf99e744e3f60

Symbols924600d6e4de9a97db99cb3f3cd7862dd702ee69769fd0dd43c8e915dfe0c98a

Static Libraries0 / 7285 functions identified

Functions(7285)

0x100001f78sub_100001f78

0x100001fd8sub_100001fd8

0x100001fecsub_100001fec

0x100001ff0sub_100001ff0

0x100001ffcsub_100001ffc

0x10000201csub_10000201c

0x100002048sub_100002048

0x10000205csub_10000205c

0x10000214csub_10000214c

0x1000021a4sub_1000021a4

0x100002240sub_100002240

0x1000022dcsub_1000022dc

0x100002378sub_100002378

0x100002660sub_100002660

0x1000028f4sub_1000028f4

0x100002a00sub_100002a00

0x100002be8sub_100002be8

0x100003094sub_100003094

0x1000030e8sub_1000030e8

0x100003104sub_100003104

Imports1327 symbols from 31 dylibs

libswiftCore.dylib598 Foundation167 LinkMetadata153 LinkServices78 libsqlite3.dylib64

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

findmylocateagent

GamePolicyAgent