{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294968752":[{"is_tail_call":false,"symbol":"os_log_create","target_va":4294969296},{"is_tail_call":false,"symbol":"_qtn_proc_alloc","target_va":4294969200},{"is_tail_call":false,"symbol":"_qtn_proc_set_identifier","target_va":4294969264},{"is_tail_call":false,"symbol":"_qtn_proc_set_flags","target_va":4294969248},{"is_tail_call":false,"symbol":"_qtn_proc_apply_to_self","target_va":4294969216},{"is_tail_call":true,"symbol":"_qtn_proc_free","target_va":4294969232},{"is_tail_call":false,"symbol":"os_log_type_enabled","target_va":4294969312}],"4294968968":[{"is_tail_call":false,"symbol":"sub_1000005b0","target_va":4294968752},{"is_tail_call":true,"symbol":"__CFXPreferencesDaemon_main","target_va":4294969168}],"4294969032":[{"is_tail_call":false,"symbol":"_os_log_fault_impl","target_va":4294969184}],"4294969100":[{"is_tail_call":false,"symbol":"_os_log_fault_impl","target_va":4294969184}]},"data_xrefs":{"by_data":{"4294967296":[4294969032,4294969100],"4294967328":[4294969032,4294969100],"4294967344":[4294968752],"4294969400":[4294968752],"4294969419":[4294968752],"4294969428":[4294968752],"4294969447":[4294969100],"4294969504":[4294969032]},"by_function":{"4294968752":[{"data_va":4294969400,"insn_va":4294968776,"kind":"CString","value":"com.apple.defaults"},{"data_va":4294969419,"insn_va":4294968784,"kind":"CString","value":"cfprefsd"},{"data_va":4294969428,"insn_va":4294968812,"kind":"CString","value":"com.apple.cfprefsd"},{"data_va":4294967344,"insn_va":4294968856,"kind":"Global","value":null},{"data_va":4294967344,"insn_va":4294968904,"kind":"Global","value":null}],"4294969032":[{"data_va":4294967296,"insn_va":4294969060,"kind":"Global","value":null},{"data_va":4294969504,"insn_va":4294969068,"kind":"Global","value":null},{"data_va":4294967328,"insn_va":4294969092,"kind":"Global","value":null}],"4294969100":[{"data_va":4294967296,"insn_va":4294969128,"kind":"Global","value":null},{"data_va":4294969447,"insn_va":4294969136,"kind":"Global","value":null},{"data_va":4294967328,"insn_va":4294969160,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968752":"sub_1000005b0","4294968968":"sub_100000688","4294969032":"sub_1000006c8","4294969100":"sub_10000070c"}},"capabilities":[{"category":"Storage","description":"Private storage area access","source":"com.apple.private.security.storage.CoreRoutine","value":{"Bool":true}},{"category":"Storage","description":"Private storage area access","source":"com.apple.private.security.storage.preferences","value":{"Bool":true}}],"code_signature":{"code_directory":{"cdhash":"84503fdc6e6815e85698dff6d8a2c394e9b378074419a75d4da0a44b5bff27c4","flag_names":["CS_RUNTIME"],"flags":65536,"hash_type":2,"identifier":"com.apple.cfprefsd","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"0ca18bb7a2f13eca1f449c8f4320492d1278db7e8c746fa7f89e08e257577ac6","frameworkhash":"c67405373de2aedafed1c66ee3d338c6f113e7cdab72e0928bb71e76c13b08ce","imphash":"4483f63c3956d2b7cf9ff653bd8875772d1d22af123878892d8980067c5fd4c5","sha256_text":"143a65055488b74aead8a6d3a759c8cb4d83bb61ee3b7b4275514e403a9357d0","symbolhash":"4483f63c3956d2b7cf9ff653bd8875772d1d22af123878892d8980067c5fd4c5"},"sets":{"apis_called":["__CFXPreferencesDaemon_main","_os_log_fault_impl","_qtn_proc_alloc","_qtn_proc_apply_to_self","_qtn_proc_free","_qtn_proc_set_flags","_qtn_proc_set_identifier","os_log_create","os_log_type_enabled","sub_1000005b0"],"bundle_ids":[" com.apple.security.system-groups0-","+com.apple.security.enterprise-volume-access","+systemgroup.com.apple.cfpreferences.managed0",",com.apple.private.vfs.allow-low-space-writes",".com.apple.private.security.storage.CoreRoutine",".com.apple.private.security.storage.preferences","0com.apple.private.xpc.launchd.ios-system-session","3com.apple.private.trust-ubiquity-kvstore-identifier","6com.apple.private.MobileContainerManager.otherIdLookup","<key>com.apple.private.MobileContainerManager.otherIdLookup</key>","<key>com.apple.private.security.storage.CoreRoutine</key>","<key>com.apple.private.security.storage.preferences</key>","<key>com.apple.private.trust-ubiquity-kvstore-identifier</key>","<key>com.apple.private.vfs.allow-low-space-writes</key>","<key>com.apple.private.xpc.launchd.ios-system-session</key>","<key>com.apple.security.enterprise-volume-access</key>","<key>com.apple.security.system-groups</key>","<string>systemgroup.com.apple.cfpreferences.managed</string>","@com.apple.defaults","com.apple.cfprefsd"],"cpp_classes":[],"entitlements":["com.apple.private.MobileContainerManager.otherIdLookup","com.apple.private.security.storage.CoreRoutine","com.apple.private.security.storage.preferences","com.apple.private.trust-ubiquity-kvstore-identifier","com.apple.private.vfs.allow-low-space-writes","com.apple.private.xpc.launchd.ios-system-session","com.apple.security.enterprise-volume-access","com.apple.security.system-groups","platform-application","seatbelt-profiles"],"frameworks":["CoreFoundation","libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":["com.apple.cfprefsd"]},"vector":{"bundle_ids":20,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":2,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":10,"file_paths":1,"frameworks_private":0,"frameworks_total":2,"iokit_constants":0,"library_functions":0,"nlist_functions":4,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":8,"size_log2":17.051039,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.003063509,"url_endpoints":4,"xpc_provides":1}},"dwarf_metadata":null,"entitlements":{"entries":{"com.apple.private.MobileContainerManager.otherIdLookup":{"Bool":true},"com.apple.private.security.storage.CoreRoutine":{"Bool":true},"com.apple.private.security.storage.preferences":{"Bool":true},"com.apple.private.trust-ubiquity-kvstore-identifier":{"Bool":true},"com.apple.private.vfs.allow-low-space-writes":{"Bool":true},"com.apple.private.xpc.launchd.ios-system-session":{"Bool":true},"com.apple.security.enterprise-volume-access":{"Bool":true},"com.apple.security.system-groups":{"StringArray":["systemgroup.com.apple.cfpreferences.managed"]},"platform-application":{"Bool":true},"seatbelt-profiles":{"StringArray":["cfprefsd"]}},"raw_plist":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n\t<key>com.apple.private.MobileContainerManager.otherIdLookup</key>\n\t<true/>\n\t<key>com.apple.private.security.storage.CoreRoutine</key>\n\t<true/>\n\t<key>com.apple.private.security.storage.preferences</key>\n\t<true/>\n\t<key>com.apple.private.trust-ubiquity-kvstore-identifier</key>\n\t<true/>\n\t<key>com.apple.private.vfs.allow-low-space-writes</key>\n\t<true/>\n\t<key>com.apple.private.xpc.launchd.ios-system-session</key>\n\t<true/>\n\t<key>com.apple.security.enterprise-volume-access</key>\n\t<true/>\n\t<key>com.apple.security.system-groups</key>\n\t<array>\n\t\t<string>systemgroup.com.apple.cfpreferences.managed</string>\n\t</array>\n\t<key>platform-application</key>\n\t<true/>\n\t<key>seatbelt-profiles</key>\n\t<array>\n\t\t<string>cfprefsd</string>\n\t</array>\n</dict>\n</plist>\n"},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-07T05:21:15Z","available_arches":["x86_64","x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"84503fdc6e6815e85698dff6d8a2c394e9b378074419a75d4da0a44b5bff27c4","file_modified":"2026-04-06T12:08:53Z","file_size":135792,"is_arm64e":true,"min_os":"26.1.0","name":"cfprefsd","platform":"macOS","sdk":"26.1.0","sha256":"bcb537d55f2b01898514448e715e4138014e2cc2b9874326bc91d0b18c6402a8","sha256_slice":"ad5879df606fa7776e31f5c008adb2ae44014687a7c0090404fdec6bdaf54f5f","source_version":"4109.1.401.0.0","team_id":null,"uuid":"476318DB-7587-34E5-8D07-83A6B75082F8"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":4,"imports":[{"address":0,"dylib":"/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation","is_lazy":false,"is_weak":false,"name":"__CFXPreferencesDaemon_main"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_os_log_fault_impl"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_qtn_proc_alloc"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_qtn_proc_apply_to_self"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_qtn_proc_free"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_qtn_proc_set_flags"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_qtn_proc_set_identifier"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"exit"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"os_log_create"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"os_log_type_enabled"}],"interesting_strings":{"bundle_ids":[" com.apple.security.system-groups0-","+com.apple.security.enterprise-volume-access","+systemgroup.com.apple.cfpreferences.managed0",",com.apple.private.vfs.allow-low-space-writes",".com.apple.private.security.storage.CoreRoutine",".com.apple.private.security.storage.preferences","0com.apple.private.xpc.launchd.ios-system-session","3com.apple.private.trust-ubiquity-kvstore-identifier","6com.apple.private.MobileContainerManager.otherIdLookup","<key>com.apple.private.MobileContainerManager.otherIdLookup</key>","<key>com.apple.private.security.storage.CoreRoutine</key>","<key>com.apple.private.security.storage.preferences</key>","<key>com.apple.private.trust-ubiquity-kvstore-identifier</key>","<key>com.apple.private.vfs.allow-low-space-writes</key>","<key>com.apple.private.xpc.launchd.ios-system-session</key>","<key>com.apple.security.enterprise-volume-access</key>","<key>com.apple.security.system-groups</key>","<string>systemgroup.com.apple.cfpreferences.managed</string>","@com.apple.defaults","com.apple.cfprefsd"],"file_paths":["/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":4,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Hostname","value":"CoreFoundation-4109.1.401"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"}],"has_network_entitlement":false,"network_frameworks":["CoreFoundation"]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1456,"protection":"r-x","segment":"__TEXT","size":416},{"name":"__auth_stubs","offset":1872,"protection":"r-x","segment":"__TEXT","size":160},{"name":"__const","offset":2032,"protection":"r-x","segment":"__TEXT","size":72},{"name":"__cstring","offset":2104,"protection":"r-x","segment":"__TEXT","size":47},{"name":"__oslogstring","offset":2151,"protection":"r-x","segment":"__TEXT","size":139},{"name":"__unwind_info","offset":2292,"protection":"r-x","segment":"__TEXT","size":96},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":80},{"name":"__objc_imageinfo","offset":16464,"protection":"rw-","segment":"__DATA_CONST","size":8}],"summary":"This Apple-signed executable accesses private storage areas and exposes an XPC service for inter-process communication with other system components. It contacts multiple network endpoints and references 20 bundle identifiers, indicating integration with various macOS subsystems. The minimal function count and small binary size suggest a focused utility purpose, likely supporting background system operations or service coordination rather than user-facing functionality.","swift_metadata":null,"title":"Apple-signed system utility — accesses private storage and communicates via XPC","total_strings":163,"xpc_services":["com.apple.cfprefsd"]}