Parent page of this data file: https://divinity-in-action.com/articles/pegasusspyware/ipad1/otherdatafiles/ Other Data Files Which May Be Related to Pegasus Spyware Found on Irina Bright's Apple Devices. iPad 1. File name: LocalStorageFileProvider-2023-07-01-110457.ips Downloaded from: Apple Device > Settings > Privacy & Security > Analytics & Improvements > Analytics Data. {"app_name":"LocalStorageFileProvider","timestamp":"2023-07-01 11:04:57.00 +0300","app_version":"1.0","slice_uuid":"0db4eaf7-6153-3d5e-bb3a-52500685a7ea","build_version":"1","platform":2,"bundleID":"com.apple.FileProvider.LocalStorage","share_with_app_devs":1,"is_first_party":1,"bug_type":"309","os_version":"iPhone OS 16.5.1 (20F75)","roots_installed":0,"name":"LocalStorageFileProvider","incident_id":"2D86A024-5526-47F9-BF88-8A43BC78D4AD"} { "uptime" : 9600, "procRole" : "Unspecified", "version" : 2, "userID" : 501, "deployVersion" : 210, "modelCode" : "iPad13,2", "coalitionID" : 507, "osVersion" : { "isEmbedded" : true, "train" : "iPhone OS 16.5.1", "releaseType" : "User", "build" : "20F75" }, "captureTime" : "2023-07-01 11:04:55.9522 +0300", "incident" : "2D86A024-5526-47F9-BF88-8A43BC78D4AD", "pid" : 345, "cpuType" : "ARM-64", "roots_installed" : 0, "bug_type" : "309", "procLaunch" : "2023-07-01 08:00:22.8714 +0300", "procStartAbsTime" : 2320970558, "procExitAbsTime" : 231227870122, "procName" : "LocalStorageFileProvider", "procPath" : "\/System\/Library\/Frameworks\/FileProvider.framework\/PlugIns\/LocalStorageFileProvider.appex\/LocalStorageFileProvider", "bundleInfo" : {"CFBundleShortVersionString":"1.0","CFBundleVersion":"1","CFBundleIdentifier":"com.apple.FileProvider.LocalStorage"}, "parentProc" : "launchd", "parentPid" : 1, "coalitionName" : "com.apple.FileProvider.LocalStorage", "crashReporterKey" : "1c54b5f60308a75ebe170bf86077a8b8780e7ae9", "wasUnlockedSinceBoot" : 1, "isLocked" : 0, "throttleTimeout" : 10, "codeSigningID" : "com.apple.FileProvider.LocalStorage", "codeSigningTeamID" : "", "codeSigningFlags" : 570434305, "codeSigningValidationCategory" : 1, "codeSigningTrustLevel" : 0, "basebandVersion" : "4.02.01", "vmRegionInfo" : "0 is not in any region. Bytes before following region: 4366303232\n REGION TYPE START - END [ VSIZE] PRT\/MAX SHRMOD REGION DETAIL\n UNUSED SPACE AT START\n---> \n __TEXT 104408000-104d10000 [ 9248K] r-x\/r-x SM=COW ...eFileProvider", "exception" : {"codes":"0x0000000000000001, 0x0000000000000000","rawCodes":[1,0],"type":"EXC_BAD_ACCESS","signal":"SIGSEGV","subtype":"KERN_INVALID_ADDRESS at 0x0000000000000000"}, "termination" : {"flags":0,"code":11,"namespace":"SIGNAL","indicator":"Segmentation fault: 11","byProc":"exc handler","byPid":345}, "vmregioninfo" : "0 is not in any region. Bytes before following region: 4366303232\n REGION TYPE START - END [ VSIZE] PRT\/MAX SHRMOD REGION DETAIL\n UNUSED SPACE AT START\n---> \n __TEXT 104408000-104d10000 [ 9248K] r-x\/r-x SM=COW ...eFileProvider", "faultingThread" : 2, "threads" : [{"id":5714,"queue":"com.apple.main-thread","frames":[{"imageOffset":3204,"symbol":"mach_msg2_trap","symbolLocation":8,"imageIndex":4},{"imageOffset":80724,"symbol":"mach_msg2_internal","symbolLocation":80,"imageIndex":4},{"imageOffset":81452,"symbol":"mach_msg_overwrite","symbolLocation":540,"imageIndex":4},{"imageOffset":4552,"symbol":"mach_msg","symbolLocation":24,"imageIndex":4},{"imageOffset":495652,"symbol":"__CFRunLoopServiceMachPort","symbolLocation":160,"imageIndex":5},{"imageOffset":500304,"symbol":"__CFRunLoopRun","symbolLocation":1208,"imageIndex":5},{"imageOffset":521196,"symbol":"CFRunLoopRunSpecific","symbolLocation":612,"imageIndex":5},{"imageOffset":270292,"symbol":"-[NSRunLoop(NSRunLoop) runMode:beforeDate:]","symbolLocation":212,"imageIndex":6},{"imageOffset":269928,"symbol":"-[NSRunLoop(NSRunLoop) run]","symbolLocation":64,"imageIndex":6},{"imageOffset":108152,"symbol":"_xpc_objc_main","symbolLocation":496,"imageIndex":7},{"imageOffset":117028,"symbol":"xpc_main","symbolLocation":156,"imageIndex":7},{"imageOffset":563504,"symbol":"-[NSXPCListener resume]","symbolLocation":312,"imageIndex":6},{"imageOffset":106128,"imageIndex":8},{"imageOffset":26152,"imageIndex":8},{"imageOffset":22844,"imageIndex":8},{"imageOffset":140608,"symbol":"EXExtensionMain","symbolLocation":252,"imageIndex":9},{"imageOffset":843264,"symbol":"NSExtensionMain","symbolLocation":204,"imageIndex":6},{"imageOffset":89580,"symbol":"start","symbolLocation":2220,"imageIndex":10}]},{"id":156889,"frames":[{"imageOffset":2932,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":11}]},{"triggered":true,"id":158603,"threadState":{"x":[{"value":0},{"value":0},{"value":4294967296},{"value":0},{"value":0},{"value":0},{"value":18446744065119617024},{"value":2},{"value":18446744065119617024},{"value":52588709888},{"value":0},{"value":18446744065119617024},{"value":0},{"value":52630188400},{"value":104390391307629697,"symbolLocation":104390382720122881,"symbol":"OBJC_CLASS_$_NSURL"},{"value":8587506816,"symbolLocation":0,"symbol":"OBJC_CLASS_$_NSURL"},{"value":9958139380850778960,"symbolLocation":9958139373813760000,"symbol":"swift_release"},{"value":4375782336},{"value":0},{"value":52594745392},{"value":52594745408},{"value":7020126841},{"value":4124765649165745760},{"value":8587431936,"symbolLocation":256,"symbol":"StructLocks"},{"value":8536014848,"symbolLocation":0,"symbol":"OBJC_IVAR_$_Object.isa"},{"value":0},{"value":4384099584},{"value":52596768824},{"value":276}],"flavor":"ARM_THREAD_STATE64","lr":{"value":15570860367624053836},"cpsr":{"value":4096},"fp":{"value":6101133360},"sp":{"value":6101133344},"esr":{"value":2449473542,"description":"(Data Abort) byte read Translation fault"},"pc":{"value":7037031936,"matchesCrashFrame":1},"far":{"value":0}},"queue":"fpx-instance","frames":[{"imageOffset":3921408,"symbol":"_swift_release_dealloc","symbolLocation":16,"imageIndex":12},{"imageOffset":3925068,"symbol":"bool swift::RefCounts>::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int)","symbolLocation":132,"imageIndex":12},{"imageOffset":98060,"imageIndex":0},{"imageOffset":8356,"symbol":"object_cxxDestructFromClass(objc_object*, objc_class*)","symbolLocation":116,"imageIndex":13},{"imageOffset":28160,"symbol":"objc_destructInstance","symbolLocation":80,"imageIndex":13},{"imageOffset":66812,"symbol":"_objc_rootDealloc","symbolLocation":80,"imageIndex":13},{"imageOffset":536340,"symbol":"-[FPXEnumerator invalidateVendorEnumeration]","symbolLocation":120,"imageIndex":14},{"imageOffset":8992,"symbol":"_dispatch_call_block_and_release","symbolLocation":32,"imageIndex":15},{"imageOffset":16044,"symbol":"_dispatch_client_callout","symbolLocation":20,"imageIndex":15},{"imageOffset":54460,"symbol":"_dispatch_workloop_invoke","symbolLocation":2060,"imageIndex":15},{"imageOffset":93404,"symbol":"_dispatch_workloop_worker_thread","symbolLocation":648,"imageIndex":15},{"imageOffset":3548,"symbol":"_pthread_wqthread","symbolLocation":288,"imageIndex":11},{"imageOffset":2940,"symbol":"start_wqthread","symbolLocation":8,"imageIndex":11}]},{"id":158605,"frames":[{"imageOffset":2932,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":11}]},{"id":158814,"queue":"localstorage.fsevents-stream: ","frames":[{"imageOffset":3204,"symbol":"mach_msg2_trap","symbolLocation":8,"imageIndex":4},{"imageOffset":80724,"symbol":"mach_msg2_internal","symbolLocation":80,"imageIndex":4},{"imageOffset":81452,"symbol":"mach_msg_overwrite","symbolLocation":540,"imageIndex":4},{"imageOffset":4552,"symbol":"mach_msg","symbolLocation":24,"imageIndex":4},{"imageOffset":321268,"symbol":"f2d_unregister_rpc","symbolLocation":128,"imageIndex":16},{"imageOffset":340060,"symbol":"dispose_f2d_private_port","symbolLocation":32,"imageIndex":16},{"imageOffset":365268,"symbol":"__create_f2d_private_port_source_block_invoke_2","symbolLocation":28,"imageIndex":16},{"imageOffset":8992,"symbol":"_dispatch_call_block_and_release","symbolLocation":32,"imageIndex":15},{"imageOffset":16044,"symbol":"_dispatch_client_callout","symbolLocation":20,"imageIndex":15},{"imageOffset":29488,"symbol":"_dispatch_continuation_pop","symbolLocation":504,"imageIndex":15},{"imageOffset":111388,"symbol":"_dispatch_source_cancel_callout","symbolLocation":204,"imageIndex":15},{"imageOffset":108396,"symbol":"_dispatch_source_invoke","symbolLocation":1176,"imageIndex":15},{"imageOffset":46092,"symbol":"_dispatch_lane_serial_drain","symbolLocation":372,"imageIndex":15},{"imageOffset":49368,"symbol":"_dispatch_lane_invoke","symbolLocation":436,"imageIndex":15},{"imageOffset":93404,"symbol":"_dispatch_workloop_worker_thread","symbolLocation":648,"imageIndex":15},{"imageOffset":3548,"symbol":"_pthread_wqthread","symbolLocation":288,"imageIndex":11},{"imageOffset":2940,"symbol":"start_wqthread","symbolLocation":8,"imageIndex":11}]},{"id":158815,"frames":[{"imageOffset":2932,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":11}]}], "usedImages" : [ { "source" : "P", "arch" : "arm64e", "base" : 4366303232, "size" : 9469952, "uuid" : "0db4eaf7-6153-3d5e-bb3a-52500685a7ea", "path" : "\/System\/Library\/Frameworks\/FileProvider.framework\/PlugIns\/LocalStorageFileProvider.appex\/LocalStorageFileProvider", "name" : "LocalStorageFileProvider" }, { "source" : "P", "arch" : "arm64e", "base" : 4377329664, "size" : 32768, "uuid" : "0fef244f-9af9-3253-9ca5-d6d6906e29bf", "path" : "\/System\/Library\/Frameworks\/FileProvider.framework\/OverrideBundles\/FileProviderOverride.bundle\/FileProviderOverride", "name" : "FileProviderOverride" }, { "source" : "P", "arch" : "arm64e", "base" : 4377427968, "size" : 32768, "uuid" : "5cf284da-93d0-3f55-b1a3-ac1778f40911", "path" : "\/System\/Library\/Frameworks\/FileProvider.framework\/OverrideBundles\/CloudDocsFileProvider.bundle\/CloudDocsFileProvider", "name" : "CloudDocsFileProvider" }, { "source" : "P", "arch" : "arm64e", "base" : 4377542656, "size" : 49152, "uuid" : "695a8449-aae8-38b6-851c-ced0b1176f03", "path" : "\/private\/preboot\/Cryptexes\/OS\/usr\/lib\/libobjc-trampolines.dylib", "name" : "libobjc-trampolines.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 8182923264, "size" : 229368, "uuid" : "75da6452-934e-3f80-b181-d47074378e83", "path" : "\/usr\/lib\/system\/libsystem_kernel.dylib", "name" : "libsystem_kernel.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 7136194560, "size" : 4096000, "uuid" : "4230c122-42e8-383b-beec-ee7b61f8bb61", "path" : "\/System\/Library\/Frameworks\/CoreFoundation.framework\/CoreFoundation", "name" : "CoreFoundation" }, { "source" : "P", "arch" : "arm64e", "base" : 7038930944, "size" : 9297920, "uuid" : "6e76dc96-11af-3b2e-b71e-215f9cc6e822", "path" : "\/System\/Library\/Frameworks\/Foundation.framework\/Foundation", "name" : "Foundation" }, { "source" : "P", "arch" : "arm64e", "base" : 8733478912, "size" : 270336, "uuid" : "e999664a-4868-3766-8787-f501fde376e3", "path" : "\/usr\/lib\/system\/libxpc.dylib", "name" : "libxpc.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 7781916672, "size" : 225280, "uuid" : "c413ade8-6a93-31ee-bec2-ad6d65af900e", "path" : "\/System\/Library\/PrivateFrameworks\/PlugInKit.framework\/PlugInKit", "name" : "PlugInKit" }, { "source" : "P", "arch" : "arm64e", "base" : 7360753664, "size" : 409600, "uuid" : "136103c5-8263-31b5-9186-bc5091308291", "path" : "\/System\/Library\/Frameworks\/ExtensionFoundation.framework\/ExtensionFoundation", "name" : "ExtensionFoundation" }, { "source" : "P", "arch" : "arm64e", "base" : 7661735936, "size" : 547364, "uuid" : "6987370a-c385-3135-a27f-6731706bcbd8", "path" : "\/usr\/lib\/dyld", "name" : "dyld" }, { "source" : "P", "arch" : "arm64e", "base" : 8733204480, "size" : 49140, "uuid" : "56698309-210a-3137-97d4-14e4604b1117", "path" : "\/usr\/lib\/system\/libsystem_pthread.dylib", "name" : "libsystem_pthread.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 7033110528, "size" : 5607424, "uuid" : "a4bfc1b8-03ae-323b-a302-d8832f75642a", "path" : "\/usr\/lib\/swift\/libswiftCore.dylib", "name" : "libswiftCore.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 7019872256, "size" : 278432, "uuid" : "085a190c-6214-38ea-accb-428c3e8afa65", "path" : "\/usr\/lib\/libobjc.A.dylib", "name" : "libobjc.A.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 7589982208, "size" : 1568768, "uuid" : "46dbf784-9c59-3488-95c9-058f31a9d94a", "path" : "\/System\/Library\/Frameworks\/FileProvider.framework\/FileProvider", "name" : "FileProvider" }, { "source" : "P", "arch" : "arm64e", "base" : 7258648576, "size" : 290816, "uuid" : "bb347f0e-f21c-3607-82e6-c8d750fdbf8c", "path" : "\/usr\/lib\/system\/libdispatch.dylib", "name" : "libdispatch.dylib" }, { "source" : "P", "arch" : "arm64e", "base" : 7134134272, "size" : 2060288, "uuid" : "2f0f67a3-8e17-3dd0-ab0a-51fca0ff6923", "path" : "\/System\/Library\/Frameworks\/CoreServices.framework\/CoreServices", "name" : "CoreServices" } ], "sharedCache" : { "base" : 7019151360, "size" : 2963603456, "uuid" : "897cc0d1-bd62-3ba4-920e-435e58cd1292" }, "vmSummary" : "ReadOnly portion of Libraries: Total=628.9M resident=0K(0%) swapped_out_or_unallocated=628.9M(100%)\nWritable regions: Total=65.6M written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=65.6M(100%)\n\n VIRTUAL REGION \nREGION TYPE SIZE COUNT (non-coalesced) \n=========== ======= ======= \nActivity Tracing 256K 1 \nDispatch continuations 6144K 1 \nFoundation 16K 1 \nKernel Alloc Once 32K 1 \nMALLOC 55.3M 24 \nMALLOC guard page 64K 4 \nSTACK GUARD 96K 6 \nStack 3728K 6 \n__AUTH 966K 117 \n__AUTH_CONST 12.2M 378 \n__CTF 824 1 \n__DATA 3688K 374 \n__DATA_CONST 15.4M 384 \n__DATA_DIRTY 2586K 352 \n__FONT_DATA 2352 1 \n__INFO_FILTER 8 1 \n__LINKEDIT 312.3M 5 \n__OBJC_RO 79.3M 1 \n__OBJC_RW 2432K 1 \n__TEXT 316.6M 392 \ndyld private memory 272K 1 \nmapped file 36.2M 9 \nshared memory 48K 3 \n=========== ======= ======= \nTOTAL 847.2M 2064 \n", "legacyInfo" : { "threadTriggered" : { "queue" : "fpx-instance" } }, "logWritingSignature" : "2cddf5f664a4daece48d280f6cfcab3ab52fe66f", "trialInfo" : { "rollouts" : [ { "rolloutId" : "62c74108bcb0435c2153f963", "factorPackIds" : { "SIRI_TEXT_TO_SPEECH" : "64810e3fd0f2cd4ea9c0d6b9" }, "deploymentId" : 240000226 }, { "rolloutId" : "62c73fd17cce0d1b0bcb8a02", "factorPackIds" : { }, "deploymentId" : 240000119 } ], "experiments" : [ ] } }