Decode. Analyze. Understand.
Decode. Analyze. Understand.
Key finding Tapping the screen while it is off leaves three backboardd entries within half a millisecond: a digitizer event with Touching=1, “received tapToWake” and “contact 0 presence: touching”. Together they show physical contact with the screen, before any unlock…
Key finding On iOS 26 beta 1, CoreTelephony logs isAirplaneMode = 1 when airplane mode goes on and isAirplaneMode = 0 when it goes off. In my test on an iPhone 12, Bluetooth Low Energy scanning continued the whole time,…
Key finding On iOS 26 beta the core Face ID entry, PearlCamFrameReceived, is the same as on iOS 18. What changed is the context around it: the face-to-camera distance in millimetres, an explicit “Face in view” from SpringBoard, and which…
Key finding On an iPhone 6 with iOS 12.5.7, Touch ID leaves kernel entries for finger on and finger off. The Home button press is logged as “Home Button Was Pressed”, and a passcode unlock appears under softwareupdateservicesd as “Device…
Key finding When a cable is connected, powerexperienced logs “plugin state changed to 1”. A RestrictedPerfMode entry in the same millisecond shows pluggedIn 1 and display 1, with every session flag at 0 (CarPlay, Siri, audio, NFC). That combination points…
Key finding Each press of a volume button is logged twice. First backboardd writes a HID event (VolumeIncrement, usage 0xE9, downEvent:1), then about nine milliseconds later SpringBoard writes rawVolumeIncreasePress or rawVolumeDecreasePress. These entries show that someone physically pressed the button…
Key finding Opening a native app from the home screen leaves a fixed three-step pattern in SpringBoard within four milliseconds. The three entries are “Allowing tap for icon view”, “Launching application” with the bundle ID, and “transition source: HomeScreen”. The…
Key finding A tap on the Phone icon produces three SpringBoard entries within three milliseconds. First the tap is allowed for com.apple.mobilephone, then the icon tap is registered (the icon itself is redacted), and then a transition request from HomeScreen…
Key finding Every change in screen orientation is logged by backboardd under com.apple.locationd.Motion:Orientation, with the old and the new state, for example FaceUp to Portrait. With the screen off, fewer transitions were logged in my tests. The entries show that…
Key finding A single kernel entry, PearlCamFrameReceived from AppleH13CameraInterface, records that the TrueDepth camera detected a face and whether the user was looking at the screen (hasAttention=1). It shows presence and attention at that microsecond. On its own it does…