{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{},"data_xrefs":{"by_data":{"4294983680":[4294968888]},"by_function":{"4294968888":[{"data_va":4294983680,"insn_va":4294968896,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968900,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968888":"sub_100000638"}},"capabilities":[{"category":"Keychain","description":"Keychain access group membership","source":"keychain-access-groups","value":{"StringArray":["com.apple.LaunchServices.TrustedSignature","com.apple.LaunchServices.DeviceIdentifier","com.apple.LaunchServices.secrets"]}},{"category":"Storage","description":"Private storage area access","source":"com.apple.private.security.storage.os_eligibility.readonly","value":{"Bool":true}}],"code_signature":{"code_directory":{"cdhash":"53cb4f81114ef83f3b240b8982cf305c8909f618a715ccce7d5187ac22a0c215","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.lsd","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"a45f644a95f429c5b161bca2d5aec4f633bb24d35775cd6c348ceff1d9e1cc05","frameworkhash":"b6147fea4994db41bcb3114e51272fe3e91ccd7eb57abf7fd479be55302a28d4","imphash":"51c10f182746fb55c654e97faac4c1e3051bc3c91bc9b3a3fdfe6e9756fb2ff7","sha256_text":"788f1512f26f87f558ccda89030f23036527961be061f31e047ad5b93b8aafe2","symbolhash":"51c10f182746fb55c654e97faac4c1e3051bc3c91bc9b3a3fdfe6e9756fb2ff7"},"sets":{"apis_called":[],"bundle_ids":[" com.apple.LaunchServices.secrets"," com.apple.security.system-groups0A","\"com.apple.ondemandd.LaunchServices","\"com.apple.private.coreservices.lsd","$systemgroup.com.apple.lsd.iconscache","%com.apple.private.apfs.get-graft-info","'com.apple.usermanagerd.persona.observer","(com.apple.runningboard.launch_extensions",")com.apple.LaunchServices.DeviceIdentifier",")com.apple.LaunchServices.TrustedSignature","*com.apple.private.mobileinstall.allowedSPI0","+com.apple.launchservices.clearadvertisingid","+com.apple.private.security.daemon-container","+com.apple.security.enterprise-volume-access",",com.apple.private.amfi.can-check-trust-cache",",com.apple.private.vfs.allow-low-space-writes",".com.apple.private.coreservices.canopenactivity","/com.apple.private.coreservices.canmaplsdatabase","/com.apple.private.kernel.set-package-extensions","0com.apple.private.MobileContainerManager.allowed","1com.apple.private.coreservices.canforcedatabasegc","2com.apple.private.coreservices.canresetserverstore","6com.apple.lsapplicationproxy.deviceidentifierforvendor","6com.apple.rootless.storage.com.apple.LaunchServices.dv",":com.apple.private.launchservices.cansetapplicationstrusted",":com.apple.private.security.storage.os_eligibility.readonly","<key>com.apple.coreservices.lsd</key>","<key>com.apple.launchservices.clearadvertisingid</key>","<key>com.apple.lsapplicationproxy.deviceidentifierforvendor</key>","<key>com.apple.ondemandd.LaunchServices</key>","<key>com.apple.private.MobileContainerManager.allowed</key>","<key>com.apple.private.amfi.can-check-trust-cache</key>","<key>com.apple.private.apfs.get-graft-info</key>","<key>com.apple.private.coreservices.canforcedatabasegc</key>","<key>com.apple.private.coreservices.canmaplsdatabase</key>","<key>com.apple.private.coreservices.canopenactivity</key>","<key>com.apple.private.coreservices.canresetserverstore</key>","<key>com.apple.private.coreservices.lsd</key>","<key>com.apple.private.dmd.policy</key>","<key>com.apple.private.kernel.set-package-extensions</key>","<key>com.apple.private.launchservices.cansetapplicationstrusted</key>","<key>com.apple.private.mobileinstall.allowedSPI</key>","<key>com.apple.private.nullfs_allow</key>","<key>com.apple.private.security.daemon-container</key>","<key>com.apple.private.security.storage.os_eligibility.readonly</key>","<key>com.apple.private.tcc.allow</key>","<key>com.apple.private.vfs.allow-low-space-writes</key>","<key>com.apple.rootless.storage.com.apple.LaunchServices.dv</key>","<key>com.apple.runningboard.launch_extensions</key>","<key>com.apple.security.enterprise-volume-access</key>","<key>com.apple.security.system-groups</key>","<key>com.apple.usermanagerd.persona.observer</key>","<string>com.apple.LaunchServices.DeviceIdentifier</string>","<string>com.apple.LaunchServices.TrustedSignature</string>","<string>com.apple.LaunchServices.secrets</string>","<string>systemgroup.com.apple.lsd.iconscache</string>","<string>systemgroup.com.apple.lsd</string>","com.apple.coreservices.lsd","com.apple.lsd","com.apple.private.dmd.policy","com.apple.private.nullfs_allow","com.apple.private.tcc.allow0!","systemgroup.com.apple.lsd0,"],"cpp_classes":[],"entitlements":["com.apple.coreservices.lsd","com.apple.launchservices.clearadvertisingid","com.apple.lsapplicationproxy.deviceidentifierforvendor","com.apple.ondemandd.LaunchServices","com.apple.private.MobileContainerManager.allowed","com.apple.private.amfi.can-check-trust-cache","com.apple.private.apfs.get-graft-info","com.apple.private.coreservices.canforcedatabasegc","com.apple.private.coreservices.canmaplsdatabase","com.apple.private.coreservices.canopenactivity","com.apple.private.coreservices.canresetserverstore","com.apple.private.coreservices.lsd","com.apple.private.dmd.policy","com.apple.private.kernel.set-package-extensions","com.apple.private.launchservices.cansetapplicationstrusted","com.apple.private.mobileinstall.allowedSPI","com.apple.private.nullfs_allow","com.apple.private.security.daemon-container","com.apple.private.security.storage.os_eligibility.readonly","com.apple.private.tcc.allow","com.apple.private.vfs.allow-low-space-writes","com.apple.rootless.storage.com.apple.LaunchServices.dv","com.apple.runningboard.launch_extensions","com.apple.security.enterprise-volume-access","com.apple.security.system-groups","com.apple.usermanagerd.persona.observer","fairplay-client","keychain-access-groups"],"frameworks":["CoreServices","libBootCacheLib.dylib","Foundation","libobjc.A.dylib","libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":["com.apple.coreservices.lsd","com.apple.lsd"]},"vector":{"bundle_ids":63,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":1,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":1,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":28,"file_paths":2,"frameworks_private":0,"frameworks_total":5,"iokit_constants":0,"library_functions":0,"nlist_functions":1,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":7,"size_log2":16.689125,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.000037855843,"url_endpoints":4,"xpc_provides":2}},"dwarf_metadata":null,"entitlements":{"entries":{"com.apple.coreservices.lsd":{"Bool":true},"com.apple.launchservices.clearadvertisingid":{"Bool":true},"com.apple.lsapplicationproxy.deviceidentifierforvendor":{"Bool":true},"com.apple.ondemandd.LaunchServices":{"Bool":true},"com.apple.private.MobileContainerManager.allowed":{"Bool":true},"com.apple.private.amfi.can-check-trust-cache":{"Bool":true},"com.apple.private.apfs.get-graft-info":{"Bool":true},"com.apple.private.coreservices.canforcedatabasegc":{"Bool":true},"com.apple.private.coreservices.canmaplsdatabase":{"Bool":true},"com.apple.private.coreservices.canopenactivity":{"Bool":true},"com.apple.private.coreservices.canresetserverstore":{"Bool":true},"com.apple.private.coreservices.lsd":{"Bool":true},"com.apple.private.dmd.policy":{"Bool":true},"com.apple.private.kernel.set-package-extensions":{"Bool":true},"com.apple.private.launchservices.cansetapplicationstrusted":{"Bool":true},"com.apple.private.mobileinstall.allowedSPI":{"StringArray":["InstallForDataMigrator","InstallLocalProvisioned","EnumerateInstalledAppsForLaunchServices","CopyInstalledAppsForLaunchServices","CopyDiskUsageForLaunchServices","UninstallForLaunchServices","InstallForLaunchServices","RebuildMapsForLaunchServices","CopyContainerizedAppInfoForLaunchServices","CopyAppInfoForLaunchServicesWithWrapperURL"]},"com.apple.private.nullfs_allow":{"Bool":true},"com.apple.private.security.daemon-container":{"Bool":true},"com.apple.private.security.storage.os_eligibility.readonly":{"Bool":true},"com.apple.private.tcc.allow":{"StringArray":["kTCCServiceSystemPolicyAllFiles"]},"com.apple.private.vfs.allow-low-space-writes":{"Bool":true},"com.apple.rootless.storage.com.apple.LaunchServices.dv":{"Bool":true},"com.apple.runningboard.launch_extensions":{"Bool":true},"com.apple.security.enterprise-volume-access":{"Bool":true},"com.apple.security.system-groups":{"StringArray":["systemgroup.com.apple.lsd.iconscache","systemgroup.com.apple.lsd"]},"com.apple.usermanagerd.persona.observer":{"Bool":true},"fairplay-client":{"String":"<integer>2033844765</integer>"},"keychain-access-groups":{"StringArray":["com.apple.LaunchServices.TrustedSignature","com.apple.LaunchServices.DeviceIdentifier","com.apple.LaunchServices.secrets"]}},"raw_plist":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n\t<key>com.apple.coreservices.lsd</key>\n\t<true/>\n\t<key>com.apple.launchservices.clearadvertisingid</key>\n\t<true/>\n\t<key>com.apple.lsapplicationproxy.deviceidentifierforvendor</key>\n\t<true/>\n\t<key>com.apple.ondemandd.LaunchServices</key>\n\t<true/>\n\t<key>com.apple.private.MobileContainerManager.allowed</key>\n\t<true/>\n\t<key>com.apple.private.amfi.can-check-trust-cache</key>\n\t<true/>\n\t<key>com.apple.private.apfs.get-graft-info</key>\n\t<true/>\n\t<key>com.apple.private.coreservices.canforcedatabasegc</key>\n\t<true/>\n\t<key>com.apple.private.coreservices.canmaplsdatabase</key>\n\t<true/>\n\t<key>com.apple.private.coreservices.canopenactivity</key>\n\t<true/>\n\t<key>com.apple.private.coreservices.canresetserverstore</key>\n\t<true/>\n\t<key>com.apple.private.coreservices.lsd</key>\n\t<true/>\n\t<key>com.apple.private.dmd.policy</key>\n\t<true/>\n\t<key>com.apple.private.kernel.set-package-extensions</key>\n\t<true/>\n\t<key>com.apple.private.launchservices.cansetapplicationstrusted</key>\n\t<true/>\n\t<key>com.apple.private.mobileinstall.allowedSPI</key>\n\t<array>\n\t\t<string>InstallForDataMigrator</string>\n\t\t<string>InstallLocalProvisioned</string>\n\t\t<string>EnumerateInstalledAppsForLaunchServices</string>\n\t\t<string>CopyInstalledAppsForLaunchServices</string>\n\t\t<string>CopyDiskUsageForLaunchServices</string>\n\t\t<string>UninstallForLaunchServices</string>\n\t\t<string>InstallForLaunchServices</string>\n\t\t<string>RebuildMapsForLaunchServices</string>\n\t\t<string>CopyContainerizedAppInfoForLaunchServices</string>\n\t\t<string>CopyAppInfoForLaunchServicesWithWrapperURL</string>\n\t</array>\n\t<key>com.apple.private.nullfs_allow</key>\n\t<true/>\n\t<key>com.apple.private.security.daemon-container</key>\n\t<true/>\n\t<key>com.apple.private.security.storage.os_eligibility.readonly</key>\n\t<true/>\n\t<key>com.apple.private.tcc.allow</key>\n\t<array>\n\t\t<string>kTCCServiceSystemPolicyAllFiles</string>\n\t</array>\n\t<key>com.apple.private.vfs.allow-low-space-writes</key>\n\t<true/>\n\t<key>com.apple.rootless.storage.com.apple.LaunchServices.dv</key>\n\t<true/>\n\t<key>com.apple.runningboard.launch_extensions</key>\n\t<true/>\n\t<key>com.apple.security.enterprise-volume-access</key>\n\t<true/>\n\t<key>com.apple.security.system-groups</key>\n\t<array>\n\t\t<string>systemgroup.com.apple.lsd.iconscache</string>\n\t\t<string>systemgroup.com.apple.lsd</string>\n\t</array>\n\t<key>com.apple.usermanagerd.persona.observer</key>\n\t<true/>\n\t<key>fairplay-client</key>\n\t<integer>2033844765</integer>\n\t<key>keychain-access-groups</key>\n\t<array>\n\t\t<string>com.apple.LaunchServices.TrustedSignature</string>\n\t\t<string>com.apple.LaunchServices.DeviceIdentifier</string>\n\t\t<string>com.apple.LaunchServices.secrets</string>\n\t</array>\n</dict>\n</plist>\n"},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-09T09:54:38Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"53cb4f81114ef83f3b240b8982cf305c8909f618a715ccce7d5187ac22a0c215","file_modified":"2026-04-09T09:54:38Z","file_size":105664,"is_arm64e":true,"min_os":"11.0.0","name":"lsd","platform":"macOS","sdk":"26.1.0","sha256":"4db6991ca6bb146979996c8c39e6c15a1fe3fd5c4f5fd105b55c1c36fa4c951e","sha256_slice":"a3c1c6b8fea916e850721687145a1135f9809aee406bd779737fe0c236aa7074","source_version":"1444.1.4.200.0","team_id":null,"uuid":"5552C4BB-FBA5-3955-AE16-486AEC54257D"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices"},{"is_private":false,"is_weak":true,"name":"/usr/lib/libBootCacheLib.dylib"},{"is_private":false,"is_weak":false,"name":"/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libobjc.A.dylib"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":1,"imports":[{"address":0,"dylib":"/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices","is_lazy":false,"is_weak":false,"name":"_LSServerMain"}],"interesting_strings":{"bundle_ids":[" com.apple.LaunchServices.secrets"," com.apple.security.system-groups0A","\"com.apple.ondemandd.LaunchServices","\"com.apple.private.coreservices.lsd","$systemgroup.com.apple.lsd.iconscache","%com.apple.private.apfs.get-graft-info","'com.apple.usermanagerd.persona.observer","(com.apple.runningboard.launch_extensions",")com.apple.LaunchServices.DeviceIdentifier",")com.apple.LaunchServices.TrustedSignature","*com.apple.private.mobileinstall.allowedSPI0","+com.apple.launchservices.clearadvertisingid","+com.apple.private.security.daemon-container","+com.apple.security.enterprise-volume-access",",com.apple.private.amfi.can-check-trust-cache",",com.apple.private.vfs.allow-low-space-writes",".com.apple.private.coreservices.canopenactivity","/com.apple.private.coreservices.canmaplsdatabase","/com.apple.private.kernel.set-package-extensions","0com.apple.private.MobileContainerManager.allowed","1com.apple.private.coreservices.canforcedatabasegc","2com.apple.private.coreservices.canresetserverstore","6com.apple.lsapplicationproxy.deviceidentifierforvendor","6com.apple.rootless.storage.com.apple.LaunchServices.dv",":com.apple.private.launchservices.cansetapplicationstrusted",":com.apple.private.security.storage.os_eligibility.readonly","<key>com.apple.coreservices.lsd</key>","<key>com.apple.launchservices.clearadvertisingid</key>","<key>com.apple.lsapplicationproxy.deviceidentifierforvendor</key>","<key>com.apple.ondemandd.LaunchServices</key>","<key>com.apple.private.MobileContainerManager.allowed</key>","<key>com.apple.private.amfi.can-check-trust-cache</key>","<key>com.apple.private.apfs.get-graft-info</key>","<key>com.apple.private.coreservices.canforcedatabasegc</key>","<key>com.apple.private.coreservices.canmaplsdatabase</key>","<key>com.apple.private.coreservices.canopenactivity</key>","<key>com.apple.private.coreservices.canresetserverstore</key>","<key>com.apple.private.coreservices.lsd</key>","<key>com.apple.private.dmd.policy</key>","<key>com.apple.private.kernel.set-package-extensions</key>","<key>com.apple.private.launchservices.cansetapplicationstrusted</key>","<key>com.apple.private.mobileinstall.allowedSPI</key>","<key>com.apple.private.nullfs_allow</key>","<key>com.apple.private.security.daemon-container</key>","<key>com.apple.private.security.storage.os_eligibility.readonly</key>","<key>com.apple.private.tcc.allow</key>","<key>com.apple.private.vfs.allow-low-space-writes</key>","<key>com.apple.rootless.storage.com.apple.LaunchServices.dv</key>","<key>com.apple.runningboard.launch_extensions</key>","<key>com.apple.security.enterprise-volume-access</key>","<key>com.apple.security.system-groups</key>","<key>com.apple.usermanagerd.persona.observer</key>","<string>com.apple.LaunchServices.DeviceIdentifier</string>","<string>com.apple.LaunchServices.TrustedSignature</string>","<string>com.apple.LaunchServices.secrets</string>","<string>systemgroup.com.apple.lsd.iconscache</string>","<string>systemgroup.com.apple.lsd</string>","com.apple.coreservices.lsd","com.apple.lsd","com.apple.private.dmd.policy","com.apple.private.nullfs_allow","com.apple.private.tcc.allow0!","systemgroup.com.apple.lsd0,"],"file_paths":["/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices","/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":1,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"}],"has_network_entitlement":false,"network_frameworks":["Foundation"]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1592,"protection":"r-x","segment":"__TEXT","size":4},{"name":"__auth_stubs","offset":1596,"protection":"r-x","segment":"__TEXT","size":16},{"name":"__const","offset":1616,"protection":"r-x","segment":"__TEXT","size":56},{"name":"__info_plist","offset":1672,"protection":"r-x","segment":"__TEXT","size":241},{"name":"__unwind_info","offset":1916,"protection":"r-x","segment":"__TEXT","size":88},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":8},{"name":"__objc_imageinfo","offset":16392,"protection":"rw-","segment":"__DATA_CONST","size":8}],"summary":"Accesses the system keychain to read and manage stored credentials and secrets through keychain access group membership. Operates within a private storage area for configuration or cached data. Exposes two XPC services for inter-process communication with other system components. Communicates with six network endpoints and references multiple bundle identifiers, suggesting coordination with other macOS services or remote infrastructure. The entitlements and framework usage indicate this is a privileged system component handling sensitive credential operations.","swift_metadata":null,"title":"System utility — manages keychain credentials and private storage access","total_strings":235,"xpc_services":["com.apple.coreservices.lsd","com.apple.lsd"]}