Parent page of this data file: https://divinity-in-action.com/articles/pegasusspyware/ipad1/otherdatafiles/ Other Data Files Which May Be Related to Pegasus Spyware Found on Irina Bright's Apple Devices. iPad 1. File name: LocalStorageFileProvider-2023-07-03-193855.ips Downloaded from: Apple Device > Settings > Privacy & Security > Analytics & Improvements > Analytics Data. {"app_name":"LocalStorageFileProvider","timestamp":"2023-07-03 19:38:55.00 +0300","app_version":"1.0","slice_uuid":"0db4eaf7-6153-3d5e-bb3a-52500685a7ea","build_version":"1","platform":2,"bundleID":"com.apple.FileProvider.LocalStorage","share_with_app_devs":1,"is_first_party":1,"bug_type":"309","os_version":"iPhone OS 16.5.1 (20F75)","roots_installed":0,"name":"LocalStorageFileProvider","incident_id":"A52C0657-8B3D-4B7A-BE92-98D9454E9D60"} { "uptime" : 2300, "procRole" : "Unspecified", "version" : 2, "userID" : 501, "deployVersion" : 210, "modelCode" : "iPad13,2", "coalitionID" : 511, "osVersion" : { "isEmbedded" : true, "train" : "iPhone OS 16.5.1", "releaseType" : "User", "build" : "20F75" }, "captureTime" : "2023-07-03 19:38:53.3690 +0300", "incident" : "A52C0657-8B3D-4B7A-BE92-98D9454E9D60", "pid" : 344, "cpuType" : "ARM-64", "roots_installed" : 0, "bug_type" : "309", "procLaunch" : "2023-07-03 18:51:20.3394 +0300", "procStartAbsTime" : 2185032527, "procExitAbsTime" : 55892546164, "procName" : "LocalStorageFileProvider", "procPath" : "\/System\/Library\/Frameworks\/FileProvider.framework\/PlugIns\/LocalStorageFileProvider.appex\/LocalStorageFileProvider", "bundleInfo" : {"CFBundleShortVersionString":"1.0","CFBundleVersion":"1","CFBundleIdentifier":"com.apple.FileProvider.LocalStorage"}, "parentProc" : "launchd", "parentPid" : 1, "coalitionName" : "com.apple.FileProvider.LocalStorage", "crashReporterKey" : "1c54b5f60308a75ebe170bf86077a8b8780e7ae9", "wasUnlockedSinceBoot" : 1, "isLocked" : 0, "throttleTimeout" : 10, "codeSigningID" : "com.apple.FileProvider.LocalStorage", "codeSigningTeamID" : "", "codeSigningFlags" : 570434305, "codeSigningValidationCategory" : 1, "codeSigningTrustLevel" : 0, "basebandVersion" : "4.02.01", "vmRegionInfo" : "0x18 is not in any region. Bytes before following region: 68719476712\n REGION TYPE START - END [ VSIZE] PRT\/MAX SHRMOD REGION DETAIL\n UNUSED SPACE AT START\n---> \n commpage (reserved) 1000000000-7000000000 [384.0G] ---\/--- SM=NUL ...(unallocated)", "exception" : {"codes":"0x0000000000000001, 0x0000000000000018","rawCodes":[1,24],"type":"EXC_BAD_ACCESS","signal":"SIGSEGV","subtype":"KERN_INVALID_ADDRESS at 0x0000000000000018"}, "termination" : {"flags":0,"code":11,"namespace":"SIGNAL","indicator":"Segmentation fault: 11","byProc":"exc handler","byPid":344}, "vmregioninfo" : "0x18 is not in any region. Bytes before following region: 68719476712\n REGION TYPE START - END [ VSIZE] PRT\/MAX SHRMOD REGION DETAIL\n UNUSED SPACE AT START\n---> \n commpage (reserved) 1000000000-7000000000 [384.0G] ---\/--- SM=NUL ...(unallocated)", "faultingThread" : 2, "threads" : [{"id":5667,"queue":"com.apple.main-thread","frames":[{"imageOffset":3204,"symbol":"mach_msg2_trap","symbolLocation":8,"imageIndex":4},{"imageOffset":80724,"symbol":"mach_msg2_internal","symbolLocation":80,"imageIndex":4},{"imageOffset":81452,"symbol":"mach_msg_overwrite","symbolLocation":540,"imageIndex":4},{"imageOffset":4552,"symbol":"mach_msg","symbolLocation":24,"imageIndex":4},{"imageOffset":495652,"symbol":"__CFRunLoopServiceMachPort","symbolLocation":160,"imageIndex":5},{"imageOffset":500304,"symbol":"__CFRunLoopRun","symbolLocation":1208,"imageIndex":5},{"imageOffset":521196,"symbol":"CFRunLoopRunSpecific","symbolLocation":612,"imageIndex":5},{"imageOffset":270292,"symbol":"-[NSRunLoop(NSRunLoop) runMode:beforeDate:]","symbolLocation":212,"imageIndex":6},{"imageOffset":269928,"symbol":"-[NSRunLoop(NSRunLoop) run]","symbolLocation":64,"imageIndex":6},{"imageOffset":108152,"symbol":"_xpc_objc_main","symbolLocation":496,"imageIndex":7},{"imageOffset":117028,"symbol":"xpc_main","symbolLocation":156,"imageIndex":7},{"imageOffset":563504,"symbol":"-[NSXPCListener resume]","symbolLocation":312,"imageIndex":6},{"imageOffset":106128,"imageIndex":8},{"imageOffset":26152,"imageIndex":8},{"imageOffset":22844,"imageIndex":8},{"imageOffset":140608,"symbol":"EXExtensionMain","symbolLocation":252,"imageIndex":9},{"imageOffset":843264,"symbol":"NSExtensionMain","symbolLocation":204,"imageIndex":6},{"imageOffset":89580,"symbol":"start","symbolLocation":2220,"imageIndex":10}]},{"id":33542,"frames":[{"imageOffset":2932,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":11}]},{"triggered":true,"id":33568,"threadState":{"x":[{"value":4316033488},{"value":4316033488},{"value":0},{"value":45879119296},{"value":112},{"value":45879119296},{"value":7},{"value":0},{"value":0},{"value":46979},{"value":743872},{"value":1548097},{"value":45878361920},{"value":6},{"value":45878345728},{"value":134219268},{"value":4314922996},{"value":4314922996},{"value":0},{"value":45880485872},{"value":45877632352},{"value":0},{"value":45878597264},{"value":45879740416},{"value":6165175008},{"value":684596301},{"value":6165175168},{"value":6165175072},{"value":6165175184}],"flavor":"ARM_THREAD_STATE64","lr":{"value":4423648643663181020},"cpsr":{"value":1610616832},"fp":{"value":6165177328},"sp":{"value":6165175008},"esr":{"value":2449473542,"description":"(Data Abort) byte read Translation fault"},"pc":{"value":4306416872,"matchesCrashFrame":1},"far":{"value":24}},"queue":"localstorage.fsevents-stream: ","frames":[{"imageOffset":177384,"imageIndex":0},{"imageOffset":168800,"imageIndex":0},{"imageOffset":167564,"imageIndex":0},{"imageOffset":166484,"imageIndex":0},{"imageOffset":130912,"symbol":"implementation_callback_rpc","symbolLocation":3284,"imageIndex":12},{"imageOffset":127200,"symbol":"_Xcallback_rpc","symbolLocation":220,"imageIndex":12},{"imageOffset":146852,"symbol":"FSEventsD2F_server","symbolLocation":68,"imageIndex":12},{"imageOffset":176888,"symbol":"receive_and_dispatch_rcv_msg","symbolLocation":332,"imageIndex":12},{"imageOffset":16044,"symbol":"_dispatch_client_callout","symbolLocation":20,"imageIndex":13},{"imageOffset":29488,"symbol":"_dispatch_continuation_pop","symbolLocation":504,"imageIndex":13},{"imageOffset":108808,"symbol":"_dispatch_source_invoke","symbolLocation":1588,"imageIndex":13},{"imageOffset":46092,"symbol":"_dispatch_lane_serial_drain","symbolLocation":372,"imageIndex":13},{"imageOffset":49368,"symbol":"_dispatch_lane_invoke","symbolLocation":436,"imageIndex":13},{"imageOffset":93404,"symbol":"_dispatch_workloop_worker_thread","symbolLocation":648,"imageIndex":13},{"imageOffset":3548,"symbol":"_pthread_wqthread","symbolLocation":288,"imageIndex":11},{"imageOffset":2940,"symbol":"start_wqthread","symbolLocation":8,"imageIndex":11}]},{"id":34002,"queue":"localstorage.fsevents-stream: ","frames":[{"imageOffset":4952,"symbol":"kevent_qos","symbolLocation":8,"imageIndex":4},{"imageOffset":159264,"symbol":"_dispatch_kq_poll","symbolLocation":172,"imageIndex":13},{"imageOffset":158168,"symbol":"_dispatch_kq_drain","symbolLocation":256,"imageIndex":13},{"imageOffset":156472,"symbol":"_dispatch_event_loop_poke","symbolLocation":156,"imageIndex":13},{"imageOffset":300016,"symbol":"resume_source","symbolLocation":52,"imageIndex":12},{"imageOffset":287160,"symbol":"FSEventStreamStart","symbolLocation":464,"imageIndex":12},{"imageOffset":173176,"imageIndex":0},{"imageOffset":165868,"imageIndex":0},{"imageOffset":8992,"symbol":"_dispatch_call_block_and_release","symbolLocation":32,"imageIndex":13},{"imageOffset":16044,"symbol":"_dispatch_client_callout","symbolLocation":20,"imageIndex":13},{"imageOffset":46388,"symbol":"_dispatch_lane_serial_drain","symbolLocation":668,"imageIndex":13},{"imageOffset":49368,"symbol":"_dispatch_lane_invoke","symbolLocation":436,"imageIndex":13},{"imageOffset":93404,"symbol":"_dispatch_workloop_worker_thread","symbolLocation":648,"imageIndex":13},{"imageOffset":3548,"symbol":"_pthread_wqthread","symbolLocation":288,"imageIndex":11},{"imageOffset":2940,"symbol":"start_wqthread","symbolLocation":8,"imageIndex":11}]},{"id":34105,"queue":"localstorage.fsevents-stream: ","frames":[{"imageOffset":943244,"symbol":"_RandomAccessCollectionBox.__deallocating_deinit","symbolLocation":0,"imageIndex":14},{"imageOffset":3921448,"symbol":"_swift_release_dealloc","symbolLocation":56,"imageIndex":14},{"imageOffset":3925068,"symbol":"bool swift::RefCounts>::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int)","symbolLocation":132,"imageIndex":14},{"imageOffset":866100,"symbol":"_print_unlocked(_:_:)","symbolLocation":2708,"imageIndex":14},{"imageOffset":170712,"imageIndex":0},{"imageOffset":174524,"imageIndex":0},{"imageOffset":165868,"imageIndex":0},{"imageOffset":8992,"symbol":"_dispatch_call_block_and_release","symbolLocation":32,"imageIndex":13},{"imageOffset":16044,"symbol":"_dispatch_client_callout","symbolLocation":20,"imageIndex":13},{"imageOffset":46388,"symbol":"_dispatch_lane_serial_drain","symbolLocation":668,"imageIndex":13},{"imageOffset":49368,"symbol":"_dispatch_lane_invoke","symbolLocation":436,"imageIndex":13},{"imageOffset":93404,"symbol":"_dispatch_workloop_worker_thread","symbolLocation":648,"imageIndex":13},{"imageOffset":3548,"symbol":"_pthread_wqthread","symbolLocation":288,"imageIndex":11},{"imageOffset":2940,"symbol":"start_wqthread","symbolLocation":8,"imageIndex":11}]},{"id":34163,"queue":"localstorage.fsevents-stream: ","frames":[{"imageOffset":3546416,"imageIndex":14},{"imageOffset":3921448,"symbol":"_swift_release_dealloc","symbolLocation":56,"imageIndex":14},{"imageOffset":3925068,"symbol":"bool swift::RefCounts>::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int)","symbolLocation":132,"imageIndex":14},{"imageOffset":866092,"symbol":"_print_unlocked(_:_:)","symbolLocation":2700,"imageIndex":14},{"imageOffset":170712,"imageIndex":0},{"imageOffset":174524,"imageIndex":0},{"imageOffset":165868,"imageIndex":0},{"imageOffset":8992,"symbol":"_dispatch_call_block_and_release","symbolLocation":32,"imageIndex":13},{"imageOffset":16044,"symbol":"_dispatch_client_callout","symbolLocation":20,"imageIndex":13},{"imageOffset":46388,"symbol":"_dispatch_lane_serial_drain","symbolLocation":668,"imageIndex":13},{"imageOffset":49368,"symbol":"_dispatch_lane_invoke","symbolLocation":436,"imageIndex":13},{"imageOffset":93404,"symbol":"_dispatch_workloop_worker_thread","symbolLocation":648,"imageIndex":13},{"imageOffset":3548,"symbol":"_pthread_wqthread","symbolLocation":288,"imageIndex":11},{"imageOffset":2940,"symbol":"start_wqthread","symbolLocation":8,"imageIndex":11}]},{"id":34355,"frames":[{"imageOffset":2932,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":11}]},{"id":34356,"frames":[{"imageOffset":2932,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":11}]},{"id":34363,"frames":[{"imageOffset":2932,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":11}]},{"id":34364,"queue":"localstorage.fsevents-stream: ","frames":[{"imageOffset":3204,"symbol":"mach_msg2_trap","symbolLocation":8,"imageIndex":4},{"imageOffset":80724,"symbol":"mach_msg2_internal","symbolLocation":80,"imageIndex":4},{"imageOffset":81452,"symbol":"mach_msg_overwrite","symbolLocation":540,"imageIndex":4},{"imageOffset":4552,"symbol":"mach_msg","symbolLocation":24,"imageIndex":4},{"imageOffset":321268,"symbol":"f2d_unregister_rpc","symbolLocation":128,"imageIndex":12},{"imageOffset":340060,"symbol":"dispose_f2d_private_port","symbolLocation":32,"imageIndex":12},{"imageOffset":365268,"symbol":"__create_f2d_private_port_source_block_invoke_2","symbolLocation":28,"imageIndex":12},{"imageOffset":8992,"symbol":"_dispatch_call_block_and_release","symbolLocation":32,"imageIndex":13},{"imageOffset":16044,"symbol":"_dispatch_client_callout","symbolLocation":20,"imageIndex":13},{"imageOffset":29488,"symbol":"_dispatch_continuation_pop","symbolLocation":504,"imageIndex":13},{"imageOffset":111388,"symbol":"_dispatch_source_cancel_callout","symbolLocation":204,"imageIndex":13},{"imageOffset":108396,"symbol":"_dispatch_source_invoke","symbolLocation":1176,"imageIndex":13},{"imageOffset":46092,"symbol":"_dispatch_lane_serial_drain","symbolLocation":372,"imageIndex":13},{"imageOffset":49368,"symbol":"_dispatch_lane_invoke","symbolLocation":436,"imageIndex":13},{"imageOffset":93404,"symbol":"_dispatch_workloop_worker_thread","symbolLocation":648,"imageIndex":13},{"imageOffset":3548,"symbol":"_pthread_wqthread","symbolLocation":288,"imageIndex":11},{"imageOffset":2940,"symbol":"start_wqthread","symbolLocation":8,"imageIndex":11}]}], "usedImages" : [ { "source" : "P", "arch" : "arm64e", "base" : 4306239488, "size" : 9469952, "uuid" : "0db4eaf7-6153-3d5e-bb3a-52500685a7ea", "path" : "\/System\/Library\/Frameworks\/FileProvider.framework\/PlugIns\/LocalStorageFileProvider.appex\/LocalStorageFileProvider", "name" : "LocalStorageFileProvider" }, { "source" : "P", "arch" : "arm64e", "base" : 4317265920, "size" : 32768, "uuid" : "0fef244f-9af9-3253-9ca5-d6d6906e29bf", "path" : "\/System\/Library\/Frameworks\/FileProvider.framework\/OverrideBundles\/FileProviderOverride.bundle\/FileProviderOverride", "name" : "FileProviderOverride" }, { "source" : "P", "arch" : "arm64e", "base" : 4317364224, "size" : 32768, "uuid" : "5cf284da-93d0-3f55-b1a3-ac1778f40911", "path" : "\/System\/Library\/Frameworks\/FileProvider.framework\/OverrideBundles\/CloudDocsFileProvider.bundle\/CloudDocsFileProvider", "name" : "CloudDocsFileProvider" }, { "source" : "P", "arch" : "arm64e", "base" : 4317478912, "size" : 49152, "uuid" : "695a8449-aae8-38b6-851c-ced0b1176f03", "path" : "\/private\/preboot\/Cryptexes\/OS\/usr\/lib\/libobjc-trampolines.dylib", "name" : "libobjc-trampolines.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 7761084416, "size" : 229368, "uuid" : "75da6452-934e-3f80-b181-d47074378e83", "path" : "\/usr\/lib\/system\/libsystem_kernel.dylib", "name" : "libsystem_kernel.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 6714355712, "size" : 4096000, "uuid" : "4230c122-42e8-383b-beec-ee7b61f8bb61", "path" : "\/System\/Library\/Frameworks\/CoreFoundation.framework\/CoreFoundation", "name" : "CoreFoundation" }, { "source" : "P", "arch" : "arm64e", "base" : 6617092096, "size" : 9297920, "uuid" : "6e76dc96-11af-3b2e-b71e-215f9cc6e822", "path" : "\/System\/Library\/Frameworks\/Foundation.framework\/Foundation", "name" : "Foundation" }, { "source" : "P", "arch" : "arm64e", "base" : 8311640064, "size" : 270336, "uuid" : "e999664a-4868-3766-8787-f501fde376e3", "path" : "\/usr\/lib\/system\/libxpc.dylib", "name" : "libxpc.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 7360077824, "size" : 225280, "uuid" : "c413ade8-6a93-31ee-bec2-ad6d65af900e", "path" : "\/System\/Library\/PrivateFrameworks\/PlugInKit.framework\/PlugInKit", "name" : "PlugInKit" }, { "source" : "P", "arch" : "arm64e", "base" : 6938914816, "size" : 409600, "uuid" : "136103c5-8263-31b5-9186-bc5091308291", "path" : "\/System\/Library\/Frameworks\/ExtensionFoundation.framework\/ExtensionFoundation", "name" : "ExtensionFoundation" }, { "source" : "P", "arch" : "arm64e", "base" : 7239897088, "size" : 547364, "uuid" : "6987370a-c385-3135-a27f-6731706bcbd8", "path" : "\/usr\/lib\/dyld", "name" : "dyld" }, { "source" : "P", "arch" : "arm64e", "base" : 8311365632, "size" : 49140, "uuid" : "56698309-210a-3137-97d4-14e4604b1117", "path" : "\/usr\/lib\/system\/libsystem_pthread.dylib", "name" : "libsystem_pthread.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 6712295424, "size" : 2060288, "uuid" : "2f0f67a3-8e17-3dd0-ab0a-51fca0ff6923", "path" : "\/System\/Library\/Frameworks\/CoreServices.framework\/CoreServices", "name" : "CoreServices" }, { "source" : "P", "arch" : "arm64e", "base" : 6836809728, "size" : 290816, "uuid" : "bb347f0e-f21c-3607-82e6-c8d750fdbf8c", "path" : "\/usr\/lib\/system\/libdispatch.dylib", "name" : "libdispatch.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 6611271680, "size" : 5607424, "uuid" : "a4bfc1b8-03ae-323b-a302-d8832f75642a", "path" : "\/usr\/lib\/swift\/libswiftCore.dylib", "name" : "libswiftCore.dylib" }, { "size" : 0, "source" : "A", "base" : 0, "uuid" : "00000000-0000-0000-0000-000000000000" } ], "sharedCache" : { "base" : 6597312512, "size" : 2963603456, "uuid" : "897cc0d1-bd62-3ba4-920e-435e58cd1292" }, "vmSummary" : "ReadOnly portion of Libraries: Total=628.9M resident=0K(0%) swapped_out_or_unallocated=628.9M(100%)\nWritable regions: Total=67.7M written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=67.7M(100%)\n\n VIRTUAL REGION \nREGION TYPE SIZE COUNT (non-coalesced) \n=========== ======= ======= \nActivity Tracing 256K 1 \nDispatch continuations 6144K 1 \nFoundation 16K 1 \nKernel Alloc Once 32K 1 \nMALLOC 55.2M 21 \nMALLOC guard page 64K 4 \nSTACK GUARD 160K 10 \nStack 5904K 10 \nVM_ALLOCATE 64K 4 \n__AUTH 966K 117 \n__AUTH_CONST 12.2M 378 \n__CTF 824 1 \n__DATA 3688K 375 \n__DATA_CONST 15.4M 384 \n__DATA_DIRTY 2586K 352 \n__FONT_DATA 2352 1 \n__INFO_FILTER 8 1 \n__LINKEDIT 312.3M 5 \n__OBJC_RO 79.3M 1 \n__OBJC_RW 2432K 1 \n__TEXT 316.6M 392 \ndyld private memory 272K 1 \nmapped file 35.7M 7 \nshared memory 48K 3 \n=========== ======= ======= \nTOTAL 848.9M 2072 \n", "legacyInfo" : { "threadTriggered" : { "queue" : "localstorage.fsevents-stream: " } }, "logWritingSignature" : "972acf5fb8f270541b3e195b2f92b1bb49a3e5ba", "trialInfo" : { "rollouts" : [ { "rolloutId" : "62c74108bcb0435c2153f963", "factorPackIds" : { "SIRI_TEXT_TO_SPEECH" : "64810e3fd0f2cd4ea9c0d6b9" }, "deploymentId" : 240000226 }, { "rolloutId" : "62c73fd17cce0d1b0bcb8a02", "factorPackIds" : { }, "deploymentId" : 240000119 } ], "experiments" : [ ] } }