wifianalyticsd
executablemacOS2.5 MBx86_64, arm64
Wi-Fi daemon — manages wireless connectivity, authentication, and diagnostics
Drives Wi-Fi hardware through direct CoreWiFi and 802.11 driver interfaces, handling network scanning, association, and roaming. Performs Wi-Fi authentication using stored credentials from the system keychain and device key bag. Manages Wi-Fi configuration, network reachability monitoring, and power/performance reporting via IOKit. Submits extensive Wi-Fi diagnostics and analytics to Apple through multiple reporting pipelines. Exposes four XPC services for system configuration clients and other processes to query and control wireless settings. Runs as a background system daemon with hardened runtime protection.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 2.5 MB
- UUID
- 7634C644-9B1A-31C5-AE71-23CCCC358723
- Analyzed
- 2026-04-07T15:37:58Z
- CDHash
- 4bb2ccd17f427ff9ccf5c1baaac13fb494b248e1ff0c3e967608e2eb825b8f4f
Capabilities
KeychainKeychain access group membership
keychain-access-groupsKeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagNetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationNetworkModern networking framework (NWConnection)
/System/Library/Frameworks/Network.framework/Versions/A/NetworkStorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-onlyStorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-write/private/var/tmp//private/var/log/com.apple.wifi.analytics//private/var/log/com.apple.wifi.analytics/ch.out/private/var/log/com.apple.wifi.analytics/usage.out/private/var/log/com.apple.wifi.analytics/unavail.out/private/var/root/Library/com.apple.wifianalyticsd//private/var/root/Library/com.apple.wifianalyticsd/.wa//private/var/root/Library/com.apple.wifianalyticsd/.wa/t.out
HardwareDirect DriverKit driver communication
com.apple.private.driverkit.driver-accessHardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-classHardwareLow-level 802.11 driver interface
/System/Library/PrivateFrameworks/IO80211.framework/Versions/A/IO80211HardwareWiFi configuration (private)
/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFiHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitHardwareIOKit power/performance reporting
/usr/lib/libIOReport.dylibIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-nameAnalyticsWiFi-specific analytics pipeline
/System/Library/PrivateFrameworks/WiFiAnalytics.framework/Versions/A/WiFiAnalyticsAnalyticsSymptom/diagnostic reporting framework
/System/Library/PrivateFrameworks/Symptoms.framework/Versions/A/Frameworks/ManagedEvent.framework/Versions/A/ManagedEventAnalyticsSymptom/diagnostic reporting framework
/System/Library/PrivateFrameworks/SymptomDiagnosticReporter.framework/Versions/A/SymptomDiagnosticReporterAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsAnalyticsWireless diagnostic reporting
/System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/WirelessDiagnosticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemBackground task scheduling
/System/Library/PrivateFrameworks/BackgroundSystemTasks.framework/Versions/A/BackgroundSystemTasksFrameworks34
WiFiAnalytics(weak)IO80211libMobileGestalt.dylibMobileKeyBagCoreML(weak)Symptoms(weak)SymptomDiagnosticReporterCoreWiFiSoftLinkingIOKitCrashReporterSupportGeoServicesCoreAnalyticsWirelessDiagnosticslibIOReport.dylibSystemConfigurationFoundationlibobjc.A.dyliblibc++.1.dyliblibSystem.B.dylibCoreDataCoreFoundationNetworkSecurityBackgroundSystemTaskslibsqlite3.dyliblibswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftDispatch.dyliblibswiftIOKit.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswiftos.dylib
Entitlements26
com.apple.security.exception.files.absolute-path.read-write
/private/var/tmp//private/var/log/com.apple.wifi.analytics//private/var/log/com.apple.wifi.analytics/ch.out/private/var/log/com.apple.wifi.analytics/usage.out/private/var/log/com.apple.wifi.analytics/unavail.out/private/var/root/Library/com.apple.wifianalyticsd//private/var/root/Library/com.apple.wifianalyticsd/.wa//private/var/root/Library/com.apple.wifianalyticsd/.wa/t.out
Interesting Strings
Bundle IDs(132)
File Paths(49)
iokit_constants(4)
telemetry(379)
URLs & Endpoints(11)
$http://crl.apple.com/codesigning.crl0%http://www.apple.com/appleca/root.crl0%{public}s::%d:DNS Resolution (captive.apple.com): COMPLETED (status:Fail)%{public}s::%d:DNS Resolution (captive.apple.com): COMPLETED (status:Success) IPAddresses:(%@)%{public}s::%d:DNS Resolution (captive.apple.com): COMPLETED (status:Timeout)
Network Surfaceentitled
Networking Frameworks
Endpoints(12)
Ipv601:42:08
Hostnamecaptive.apple.com
Ipv601:42:04
Ipv60:8:16
Hostnamewww.apple.com
Hostnamecrl.apple.com
DNA Capability Vector
Location
0
Keychain
3
Network
4
Storage
2
Hardware
7
IPC
1
Analytics
6
Security
3
System
1
Behavioral Profile
URL Endpoints
11
Telemetry Strings
379
File Paths
49
Bundle IDs
132
IOKit Constants
4
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1564 functions identified
Functions(1564)
0x100001c30sub_100001c30
0x100001c38sub_100001c38
0x100001c48sub_100001c48
0x100001c50sub_100001c50
0x100001c5csub_100001c5c
0x100001cc8sub_100001cc8
0x100001cecsub_100001cec
0x100001f28sub_100001f28
0x1000020acsub_1000020ac
0x1000020f8sub_1000020f8
0x10000210csub_10000210c
0x100002158sub_100002158
0x1000021b4sub_1000021b4
0x1000021c4sub_1000021c4
0x100002208sub_100002208
0x10000223csub_10000223c
0x100002250sub_100002250
0x100002264sub_100002264
0x1000022b0sub_1000022b0
0x100002328sub_100002328
Imports482 symbols from 28 dylibs
Exports1
_mh_execute_header0x0