bluetoothd
executablemacOS22.3 MBx86_64, arm64
Wi-Fi daemon — manages wireless connectivity, authentication, and diagnostics
Operates Wi-Fi hardware through direct DriverKit and IOKit communication, handling interface control and regulatory domain settings. Authenticates to networks using stored credentials from the Secure Enclave and system keychain. Performs wireless scanning, association, roaming, and maintains network reachability state. Collects and submits wireless diagnostics and analytics to Apple via outgoing network connections. Communicates with system services through 59 XPC endpoints to expose Wi-Fi configuration and status to other processes, including preferences and location services.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 22.3 MB
- UUID
- 91B4DBE1-96C1-34DE-9BE7-AF423DFCB984
- Analyzed
- 2026-04-09T10:13:42Z
- CDHash
- c74e8ce2e416745af8355345d09cd6b9d4842dcab279bf583a00a174483de5b3
Capabilities
LocationAccess location as a system bundle (no user prompt)
com.apple.locationd.effective_bundle[object Object]LocationLocation services access
/System/Library/Frameworks/CoreLocation.framework/Versions/A/CoreLocationKeychainKeychain access group membership
keychain-access-groupsKeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagNetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationNetworkModern networking framework (NWConnection)
/System/Library/Frameworks/Network.framework/Versions/A/NetworkStoragePrivate storage area access
com.apple.private.security.storage.ExposureNotification[object Object]StoragePrivate storage area access
com.apple.private.security.storage.os_eligibility.readonly[object Object]StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-onlyStorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-writeStorageAddress book access
/System/Library/Frameworks/Contacts.framework/Versions/A/ContactsHardwareDirect DriverKit driver communication
com.apple.private.driverkit.driver-accessHardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-classHardwareBluetooth LE device access
/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetoothHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitHardwareWiFi regulatory domain management
/System/Library/PrivateFrameworks/RegulatoryDomain.framework/Versions/A/RegulatoryDomainHardwareWiFi interface control
/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLANIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-namecom.apple.sessionservicescom.apple.carkit.reconnectiontime.servicecom.apple.bluetoothaudiodcom.apple.icloud.findmydevicedcom.apple.symptom_diagnosticscom.apple.callkit.callcontrollerhostcom.apple.usernotifications.listenercom.apple.usernotifications.usernotificationservicecom.apple.commcenter.coretelephony.xpccom.apple.accessories.transport-servercom.apple.BTServer.cloudpairingcom.apple.accountsd.accountmanagercom.apple.distributed_notifications@1v3com.apple.server.bluetooth.le.pipe.xpccom.apple.server.bluetooth.le.att.xpccom.apple.server.bluetooth.classic.xpccom.apple.server.bluetooth.general.xpccom.apple.analyticsdcom.apple.awddcom.apple.icloud.searchpartyd.beaconmanagercom.apple.icloud.searchpartyd.finderstatemanagercom.apple.icloud.searchpartyd.advertisementcachecom.apple.osanalytics.osanalyticshelpercom.apple.routined.registrationcom.apple.dprivacydcom.apple.rapportcom.apple.SharingServicescom.apple.terminusdcom.apple.CompanionLinkcom.apple.networkserviceproxycom.apple.icloud.searchpartyd.ownersessioncom.apple.privacyaccountingdcom.apple.kvsdcom.apple.mobilerepairdcom.apple.SystemConfiguration.SCPreferences-write-accesscom.apple.searchparty.managedperipheralcom.apple.DeviceAccess.xpccom.apple.nfcd.hwmanagercom.apple.lsd.mapdbcom.apple.bluetoothuser.xpccom.apple.mobile.keybagd.UserManager.xpccom.apple.backboard.display.servicescom.apple.timed.xpccom.apple.matter.support.xpccom.apple.UXMAssertionServicecom.apple.appprotectiond.read
IpcApple identity/messaging services (iMessage)
/System/Library/PrivateFrameworks/IDS.framework/Versions/A/IDSIpcProtocol buffer serialization
/System/Library/PrivateFrameworks/ProtocolBuffer.framework/Versions/A/ProtocolBufferAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsAnalyticsSymptom/diagnostic reporting framework
/System/Library/PrivateFrameworks/SymptomDiagnosticReporter.framework/Versions/A/SymptomDiagnosticReporterAnalyticsWireless diagnostic reporting
/System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/WirelessDiagnosticsAnalyticsWireless diagnostic reporting
/System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/Libraries/libAWDProtobufBluetooth.dylibAnalyticsWireless diagnostic reporting
/System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/Libraries/libprotobuf.dylibSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks62
libFDR.dyliblibiconv.2.dyliblibsqlite3.dylibAppSupport(weak)BiomeStreams(weak)BluetoothServices(weak)CrashReporterSupport(weak)CoreAccessories(weak)CoreAnalytics(weak)CoreAudio(weak)CoreBluetooth(weak)CoreDuetContext(weak)CoreTime(weak)CoreUtils(weak)ExternalAccessory(weak)IOKit(weak)IDS(weak)MobileKeyBag(weak)Netrb(weak)OSAnalytics(weak)PowerLog(weak)ProtocolBuffer(weak)Rapport(weak)RegulatoryDomain(weak)RTBuddyCrashlogDecoder(weak)Security(weak)SPOwner(weak)SymptomDiagnosticReporter(weak)SystemConfiguration(weak)TCC(weak)VoiceTrigger(weak)WirelessCoexManager(weak)WirelessDiagnostics(weak)WPDaemon(weak)BiomeLibrary(weak)Network(weak)WirelessDiagnostics(weak)WirelessDiagnostics(weak)ManagedSettingsObjC(weak)Contacts(weak)CoreLocation(weak)CoreMotion(weak)CoreServices(weak)CoreTelephony(weak)CoreWLAN(weak)GeoServices(weak)MediaRemote(weak)MatterSupport(weak)RunningBoardServices(weak)TelephonyUtilities(weak)TimeSync(weak)AppleConvergedTransport.dylib(weak)libMobileGestalt.dylib(weak)libAccessibility.dylib(weak)MobileAsset(weak)HIDFoundationlibobjc.A.dyliblibc++.1.dyliblibSystem.B.dylibCoreFoundation(weak)SoftLinking
Entitlements155
com.apple.security.exception.mach-lookup.global-name
com.apple.sessionservicescom.apple.carkit.reconnectiontime.servicecom.apple.bluetoothaudiodcom.apple.icloud.findmydevicedcom.apple.symptom_diagnosticscom.apple.callkit.callcontrollerhostcom.apple.usernotifications.listenercom.apple.usernotifications.usernotificationservicecom.apple.commcenter.coretelephony.xpccom.apple.accessories.transport-servercom.apple.BTServer.cloudpairingcom.apple.accountsd.accountmanagercom.apple.distributed_notifications@1v3com.apple.server.bluetooth.le.pipe.xpccom.apple.server.bluetooth.le.att.xpccom.apple.server.bluetooth.classic.xpccom.apple.server.bluetooth.general.xpccom.apple.analyticsdcom.apple.awddcom.apple.icloud.searchpartyd.beaconmanagercom.apple.icloud.searchpartyd.finderstatemanagercom.apple.icloud.searchpartyd.advertisementcachecom.apple.osanalytics.osanalyticshelpercom.apple.routined.registrationcom.apple.dprivacydcom.apple.rapportcom.apple.SharingServicescom.apple.terminusdcom.apple.CompanionLinkcom.apple.networkserviceproxycom.apple.icloud.searchpartyd.ownersessioncom.apple.privacyaccountingdcom.apple.kvsdcom.apple.mobilerepairdcom.apple.SystemConfiguration.SCPreferences-write-accesscom.apple.searchparty.managedperipheralcom.apple.DeviceAccess.xpccom.apple.nfcd.hwmanagercom.apple.lsd.mapdbcom.apple.bluetoothuser.xpccom.apple.mobile.keybagd.UserManager.xpccom.apple.backboard.display.servicescom.apple.timed.xpccom.apple.matter.support.xpccom.apple.UXMAssertionServicecom.apple.appprotectiond.read
com.apple.timedtrue
Interesting Strings
Bundle IDs(686)
File Paths(183)
!/private/var/Managed Preferences/0j#/private/var/db/com.apple.countryd/%s/Library/Preferences/Bluetooth/%02X-%02X-%02X-%02X-%02X-%02X.key+/private/var/containers/Bundle/Application//AppleInternal/Library/BuildRoots/4~CAeZugDrhsJRexhf3yOVgN5QCSbr6hNWtAZSfXc/Library/Caches/com.apple.xbs/Sources/MobileBluetooth/Daemon/Server/XpcClassicConnection.mm
iokit_constants(32)
telemetry(333)
Network Surfaceentitled
Networking Frameworks
Endpoints(13)
Hostnamewww.apple.com
Hostnamewlan.debug.generate-mac
Hostnamemakes.name
Ipv619:51:36
Ipv60:8:16
Hostnamemacosx26.1.internal
Hostnamecrl.apple.com
DNA Capability Vector
Location
2
Keychain
4
Network
4
Storage
6
Hardware
7
IPC
4
Analytics
5
Security
3
System
1
Behavioral Profile
URL Endpoints
8
Telemetry Strings
333
File Paths
183
Bundle IDs
686
IOKit Constants
32
Library Functions
27
Structural HashesSHA-256
Static Libraries27 / 32051 functions identified
Identified Libraries
Functions(32051)
0x100002820sub_100002820
0x100002910sub_100002910
0x100002914sub_100002914
0x10000296csub_10000296c
0x1000029c4sub_1000029c4
0x100002b04sub_100002b04
0x100002bbcsub_100002bbc
0x100002cf8sub_100002cf8
0x100002f04sub_100002f04
0x100002f0csub_100002f0c
0x100002f5csub_100002f5c
0x100002f64sub_100002f64
0x100003148sub_100003148
0x10000332csub_10000332c
0x1000034c8sub_1000034c8
0x1000037bcsub_1000037bc
0x10000392csub_10000392c
0x100003aa8sub_100003aa8
0x100003c54sub_100003c54
0x100003dd4sub_100003dd4
Imports1317 symbols from 48 dylibs
Exports1
_mh_execute_header0x0