Decode. Analyze. Understand.
Decode. Analyze. Understand.
Key finding On macOS 26.6.2 the keybag transition gives away the unlock method: “locked -> inBioUnlock” after Touch ID, “locked -> unlocked” after a password. A rejected finger leaves sensor activity and NO-MATCH but no state change. A password unlock…
Key finding On watchOS 26.2 the Carousel process logs a Digital Crown press as “Crown down” and a side button press as “Button held”. If the press continues, “Button long-held” follows about 600 milliseconds later, which is the strongest sign…
Key finding Each press of a volume button is logged twice. First backboardd writes a HID event (VolumeIncrement, usage 0xE9, downEvent:1), then about nine milliseconds later SpringBoard writes rawVolumeIncreasePress or rawVolumeDecreasePress. These entries show that someone physically pressed the button…