{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294969064":[{"is_tail_call":false,"symbol":"dprintf","target_va":4294969796},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812},{"is_tail_call":false,"symbol":"CoreCaptureStart","target_va":4294969668}],"4294969208":[{"is_tail_call":false,"symbol":"CoreCaptureStop","target_va":4294969684},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812},{"is_tail_call":false,"symbol":"glog_fd","target_va":4294969812}]},"data_xrefs":{"by_data":{"4294969208":[4294969064],"4294969860":[4294969064],"4294983680":[4294969208],"4294983792":[4294969208]},"by_function":{"4294969064":[{"data_va":4294969860,"insn_va":4294969084,"kind":"CString","value":"com.apple.corecaptured.main"},{"data_va":4294969208,"insn_va":4294969096,"kind":"Global","value":null}],"4294969208":[{"data_va":4294983792,"insn_va":4294969236,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969240,"kind":"Global","value":null},{"data_va":4294983792,"insn_va":4294969340,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969344,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294969064":"sub_1000006e8","4294969208":"sub_100000778"}},"capabilities":[{"category":"Hardware","description":"Direct DriverKit driver communication","source":"com.apple.private.driverkit.driver-access","value":{"StringArray":["com.apple.private.wifi.driverkit","com.apple.private.bluetooth.driverkit","com.apple.private.corecaptureclient.driverkit"]}},{"category":"Hardware","description":"Direct hardware/driver communication","source":"/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit","value":null},{"category":"Security","description":"Hardened runtime process","source":"com.apple.developer.hardened-process","value":{"Bool":true}}],"code_signature":{"code_directory":{"cdhash":"061211e5e9bd104867a0890829d5eaa28fcef964bc690756cdc95f4f52388fc7","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.corecaptured","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"29711893984a7d6ed9d52afb7a5845c59d8f953ef14c396fea8495872c9d881f","frameworkhash":"e4e1943d05820e8eaa460b34592153f8d24d8c12ff7d172f82ba067464ce08ec","imphash":"c261f8226bb98b00e66be278411899099e9304618c16932879f20055c6386100","sha256_text":"9d249754da8311f61efa7629c5439990991d914904732321aea21361aa3bddb8","symbolhash":"c261f8226bb98b00e66be278411899099e9304618c16932879f20055c6386100"},"sets":{"apis_called":["CoreCaptureStart","CoreCaptureStop","dprintf","glog_fd"],"bundle_ids":[" com.apple.corecapture.userclient"," com.apple.private.wifi.driverkit","$com.apple.developer.hardened-process","%com.apple.private.bluetooth.driverkit","(/private/var/tmp/com.apple.corecaptured/",")com.apple.private.driverkit.driver-access0x","*com.apple.security.iokit-user-client-class0g","+com.apple.corecaptured.remoteservice-access","-com.apple.private.corecaptureclient.driverkit0","/com.apple.osanalytics.otatasking-service-access","4com.apple.private.MobileGestalt.AllowedProtectedKeys0","<key>com.apple.corecapture.userclient</key>","<key>com.apple.corecaptured.remoteservice-access</key>","<key>com.apple.developer.hardened-process</key>","<key>com.apple.osanalytics.otatasking-service-access</key>","<key>com.apple.private.MobileGestalt.AllowedProtectedKeys</key>","<key>com.apple.private.driverkit.driver-access</key>","<key>com.apple.security.iokit-user-client-class</key>","<key>com.apple.security.temporary-exception.files.absolute-path.read-only</key>","<string>/private/var/tmp/com.apple.corecaptured/</string>","<string>com.apple.private.bluetooth.driverkit</string>","<string>com.apple.private.corecaptureclient.driverkit</string>","<string>com.apple.private.wifi.driverkit</string>","Dcom.apple.security.temporary-exception.files.absolute-path.read-only0T","com.apple.corecaptured","com.apple.corecaptured.main"],"cpp_classes":[],"entitlements":["com.apple.corecapture.userclient","com.apple.corecaptured.remoteservice-access","com.apple.developer.hardened-process","com.apple.osanalytics.otatasking-service-access","com.apple.private.MobileGestalt.AllowedProtectedKeys","com.apple.private.driverkit.driver-access","com.apple.security.iokit-user-client-class","com.apple.security.temporary-exception.files.absolute-path.read-only"],"frameworks":["CrashReporterSupport","CoreCaptureDaemon","IOKit","CoreFoundation","libc++.1.dylib","libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":["CrashReporterSupport","CoreCaptureDaemon"],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":["com.apple.corecaptured"]},"vector":{"bundle_ids":26,"cap_analytics":0,"cap_hardware":2,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":1,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":8,"file_paths":8,"frameworks_private":2,"frameworks_total":6,"iokit_constants":0,"library_functions":0,"nlist_functions":2,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":7,"size_log2":16.664003,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":2,"text_ratio":0.005816641,"url_endpoints":4,"xpc_provides":1}},"dwarf_metadata":null,"entitlements":{"entries":{"com.apple.corecapture.userclient":{"Bool":true},"com.apple.corecaptured.remoteservice-access":{"Bool":true},"com.apple.developer.hardened-process":{"Bool":true},"com.apple.osanalytics.otatasking-service-access":{"Bool":true},"com.apple.private.MobileGestalt.AllowedProtectedKeys":{"StringArray":["InverseDeviceID"]},"com.apple.private.driverkit.driver-access":{"StringArray":["com.apple.private.wifi.driverkit","com.apple.private.bluetooth.driverkit","com.apple.private.corecaptureclient.driverkit"]},"com.apple.security.iokit-user-client-class":{"StringArray":["IOReportUserClient","RootDomainUserClient","CCLogPipeUserClient","CCDataPipeUserClient","IOUserUserClient"]},"com.apple.security.temporary-exception.files.absolute-path.read-only":{"StringArray":["/private/var/Managed Preferences/mobile/","/private/var/tmp/com.apple.corecaptured/"]}},"raw_plist":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n\t<key>com.apple.corecapture.userclient</key>\n\t<true/>\n\t<key>com.apple.corecaptured.remoteservice-access</key>\n\t<true/>\n\t<key>com.apple.developer.hardened-process</key>\n\t<true/>\n\t<key>com.apple.osanalytics.otatasking-service-access</key>\n\t<true/>\n\t<key>com.apple.private.MobileGestalt.AllowedProtectedKeys</key>\n\t<array>\n\t\t<string>InverseDeviceID</string>\n\t</array>\n\t<key>com.apple.private.driverkit.driver-access</key>\n\t<array>\n\t\t<string>com.apple.private.wifi.driverkit</string>\n\t\t<string>com.apple.private.bluetooth.driverkit</string>\n\t\t<string>com.apple.private.corecaptureclient.driverkit</string>\n\t</array>\n\t<key>com.apple.security.iokit-user-client-class</key>\n\t<array>\n\t\t<string>IOReportUserClient</string>\n\t\t<string>RootDomainUserClient</string>\n\t\t<string>CCLogPipeUserClient</string>\n\t\t<string>CCDataPipeUserClient</string>\n\t\t<string>IOUserUserClient</string>\n\t</array>\n\t<key>com.apple.security.temporary-exception.files.absolute-path.read-only</key>\n\t<array>\n\t\t<string>/private/var/Managed Preferences/mobile/</string>\n\t\t<string>/private/var/tmp/com.apple.corecaptured/</string>\n\t</array>\n</dict>\n</plist>\n"},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-09T09:45:38Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"061211e5e9bd104867a0890829d5eaa28fcef964bc690756cdc95f4f52388fc7","file_modified":"2026-04-09T09:45:38Z","file_size":103840,"is_arm64e":true,"min_os":"26.1.0","name":"corecaptured","platform":"macOS","sdk":"26.1.0","sha256":"0b461614717a8e790385af7c166fc28159437ffb7b36dfb31e51fd09360b07ef","sha256_slice":"ff60ad24f7ad133980415a87549642dd7165e234538ea64ea63223b4392d8a87","source_version":"1305.7.0.0.0","team_id":null,"uuid":"4FDE4E54-9883-3972-93E9-EE7B9036218A"},"frameworks":[{"is_private":true,"is_weak":false,"name":"/System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport"},{"is_private":true,"is_weak":false,"name":"/System/Library/PrivateFrameworks/CoreCaptureDaemon.framework/Versions/A/CoreCaptureDaemon"},{"is_private":false,"is_weak":false,"name":"/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit"},{"is_private":false,"is_weak":false,"name":"/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libc++.1.dylib"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":2,"imports":[{"address":0,"dylib":"/System/Library/PrivateFrameworks/CoreCaptureDaemon.framework/Versions/A/CoreCaptureDaemon","is_lazy":false,"is_weak":false,"name":"CoreCaptureStart"},{"address":0,"dylib":"/System/Library/PrivateFrameworks/CoreCaptureDaemon.framework/Versions/A/CoreCaptureDaemon","is_lazy":false,"is_weak":false,"name":"CoreCaptureStop"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stack_chk_fail"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_os_log_impl"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"dispatch_main"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"dprintf"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"localtime_r"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"os_log_type_enabled"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"pthread_setname_np"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"signal"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strftime"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"time"},{"address":0,"dylib":"/System/Library/PrivateFrameworks/CoreCaptureDaemon.framework/Versions/A/CoreCaptureDaemon","is_lazy":false,"is_weak":false,"name":"coreCaptureOsLog"},{"address":0,"dylib":"/System/Library/PrivateFrameworks/CoreCaptureDaemon.framework/Versions/A/CoreCaptureDaemon","is_lazy":false,"is_weak":false,"name":"glog_fd"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stack_chk_guard"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_os_log_default"}],"interesting_strings":{"bundle_ids":[" com.apple.corecapture.userclient"," com.apple.private.wifi.driverkit","$com.apple.developer.hardened-process","%com.apple.private.bluetooth.driverkit","(/private/var/tmp/com.apple.corecaptured/",")com.apple.private.driverkit.driver-access0x","*com.apple.security.iokit-user-client-class0g","+com.apple.corecaptured.remoteservice-access","-com.apple.private.corecaptureclient.driverkit0","/com.apple.osanalytics.otatasking-service-access","4com.apple.private.MobileGestalt.AllowedProtectedKeys0","<key>com.apple.corecapture.userclient</key>","<key>com.apple.corecaptured.remoteservice-access</key>","<key>com.apple.developer.hardened-process</key>","<key>com.apple.osanalytics.otatasking-service-access</key>","<key>com.apple.private.MobileGestalt.AllowedProtectedKeys</key>","<key>com.apple.private.driverkit.driver-access</key>","<key>com.apple.security.iokit-user-client-class</key>","<key>com.apple.security.temporary-exception.files.absolute-path.read-only</key>","<string>/private/var/tmp/com.apple.corecaptured/</string>","<string>com.apple.private.bluetooth.driverkit</string>","<string>com.apple.private.corecaptureclient.driverkit</string>","<string>com.apple.private.wifi.driverkit</string>","Dcom.apple.security.temporary-exception.files.absolute-path.read-only0T","com.apple.corecaptured","com.apple.corecaptured.main"],"file_paths":["(/private/var/Managed Preferences/mobile/","(/private/var/tmp/com.apple.corecaptured/","/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation","/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit","/System/Library/PrivateFrameworks/CoreCaptureDaemon.framework/Versions/A/CoreCaptureDaemon","/System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport","<string>/private/var/Managed Preferences/mobile/</string>","<string>/private/var/tmp/com.apple.corecaptured/</string>"],"telemetry":["/com.apple.osanalytics.otatasking-service-access","<key>com.apple.osanalytics.otatasking-service-access</key>"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":2,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Hostname","value":"Dcom.apple.security.temporary-exception.files.absolute-path.read-only0T"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"}],"has_network_entitlement":false,"network_frameworks":["CoreFoundation"]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1768,"protection":"r-x","segment":"__TEXT","size":604},{"name":"__auth_stubs","offset":2372,"protection":"r-x","segment":"__TEXT","size":192},{"name":"__cstring","offset":2564,"protection":"r-x","segment":"__TEXT","size":61},{"name":"__oslogstring","offset":2625,"protection":"r-x","segment":"__TEXT","size":14},{"name":"__unwind_info","offset":2640,"protection":"r-x","segment":"__TEXT","size":96},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":96},{"name":"__got","offset":16480,"protection":"rw-","segment":"__DATA_CONST","size":32}],"summary":"Manages direct communication with DriverKit drivers and hardware subsystems through privileged kernel interfaces. Operates as a hardened runtime process with restricted execution environment. Exposes an XPC service for other system components to request hardware operations or driver communications. Handles telemetry reporting to Apple infrastructure and maintains references to multiple bundle identifiers, suggesting coordination across several system services. Includes security constraints that prevent unauthorized access to the driver communication layer.","swift_metadata":null,"title":"System driver communication daemon — facilitates direct hardware and driver interactions","total_strings":194,"xpc_services":["com.apple.corecaptured"]}