Decode. Analyze. Understand.
Decode. Analyze. Understand.
Key finding On macOS 26.6.2 the keybag transition gives away the unlock method: “locked -> inBioUnlock” after Touch ID, “locked -> unlocked” after a password. A rejected finger leaves sensor activity and NO-MATCH but no state change. A password unlock…
Key finding On iOS 26.6 the dialed number appears unredacted in kPhoneNumber under CommCenter:call.provider. kUuid links call setup to hang-up, so a number without a matching teardown is an attempt, not a connected call. ContactSearchManager entries reconstruct the typing, but…
Revised edition, 2 August 2026. The original version of this post was published on 27 March 2026 and described the CarPlay handshake on iOS 18. Since then the iLEAPP CarPlay module reported that the vehicle-UUID entries described here did not…
Key finding An Emergency SOS started on an Apple Watch (watchOS 26.2) can be followed across both devices. The watch logs “Button long-held” and, 2.9 seconds later, an emergency location assertion. The paired iPhone then logs sosTriggeredOnPairedDevice and enters emergency…
Key finding On watchOS 26.2 the Carousel process logs a Digital Crown press as “Crown down” and a side button press as “Button held”. If the press continues, “Button long-held” follows about 600 milliseconds later, which is the strongest sign…
Key finding Every key press on the iOS on-screen keyboard is logged by UIKit under KeyboardTouch as touch down, touch up or touch dragged, inside the process of the active app, for example MobileMail. That tells you when someone typed…
Key finding On a MacBook Pro M4 with macOS 15.6.1, a Touch ID unlock leaves a chain from the sensor (setFingerOnState: FingerON) through powerd and coreauthd to “Device is unlocked/active”, about 95 milliseconds later. A search for “TouchID” is enough…
Key finding A sysdiagnose started from the AssistiveTouch menu is logged by assistivetouchd. On iOS 18.2.1 the entry reads “Generating sysdiagnose”, on iOS 12.5.7 “Generating sysdiagnose from AssistiveTouch menu”. That separates it from a sysdiagnose triggered with the hardware buttons,…
Key finding Tapping the screen while it is off leaves three backboardd entries within half a millisecond: a digitizer event with Touching=1, “received tapToWake” and “contact 0 presence: touching”. Together they show physical contact with the screen, before any unlock…
Key finding On iOS 26 beta 1, CoreTelephony logs isAirplaneMode = 1 when airplane mode goes on and isAirplaneMode = 0 when it goes off. In my test on an iPhone 12, Bluetooth Low Energy scanning continued the whole time,…