Help needed identifying commands for remote access

Community Apple Developers
Paulfowler11071983
Paulfowler11071983 OP
Created 3w
Replies 6
Boosts 0
Views 158
Participants 1

Hey everyone, I’m new to here and have very basic Knowledge so was hoping one of you geniuses could help me. I have had my devices hacked into remotely and monitored remotely for a number of weeks now. I have done all the security measures including erasing, new phone, sim, Vpns etc and still have the issue of my phone network being accessed. I believe code has been added to my phone or apps but I just don’t know what it looks like. I was hoping someone could take a look at some code for me and help me work it out as it has been driving me nuts. im not sure if I can post this on here so apologies if I offend anyone by doing so but I would be ever so grateful of some help. Thank you. Paul

Replies  6
Boosts  0
Views  158
Participants  1
Paulfowler11071983
Paulfowler11071983 OP
3w

{"app_name":"BackgroundShortcutRunner","timestamp":"2025-08-15 17:49:40.00 +1000","app_version":"7.0","slice_uuid":"DAB8C7ED-E848-3D53-BDF3-CE9809DE4D53","build_version":"3612.0.2.1","bundleID":"com.apple.WorkflowKit.BackgroundShortcutRunner","duration_ms":"882533","share_with_app_devs":0,"is_first_party":0,"bug_type":"145","os_version":"iPhone OS 18.6.1 (22G90)","roots_installed":0,"name":"BackgroundShortcutRunner","incident_id":"3F24B677-0C9B-4556-AF18-02EDAB046108"} Date/Time: 2025-08-15 17:34:56.315 +1000 End time: 2025-08-15 17:49:38.848 +1000 OS Version: iPhone OS 18.6.1 (Build 22G90) Architecture: arm64e Report Version: 60 Incident Identifier: 3F24B677-0C9B-4556-AF18-02EDAB046108

Data Source: Microstackshots Shared Cache: C4C231A4-B057-324E-9152-B464B595F130 slid base address 0x19a404000, slide 0x1a404000

Command: BackgroundShortcutRunner Path: /System/Library/PrivateFrameworks/WorkflowKit.framework/XPCServices/BackgroundShortcutRunner.xpc/BackgroundShortcutRunner Identifier: com.apple.WorkflowKit.BackgroundShortcutRunner Version: 7.0 (3612.0.2.1) Resource Coalition: 273 On Behalf Of: 1 sample UNKNOWN [171] (1 sample originated by UNKNOWN [171]) Architecture: arm64 PID: 935

Event: disk writes Action taken: none Writes: 1073.74 MB of file backed memory dirtied over 883 seconds (1216.66 KB per second average), exceeding limit of 12.43 KB per second over 86400 seconds Writes limit: 1073.74 MB Limit duration: 86400s Writes caused: 1073.74 MB Writes duration: 883s Duration: 882.53s Duration Sampled: 0.00s (event starts 882.52s before samples) Steps: 1 (10.49 MB/step)

Hardware model: iPhone13,2 Active cpus: 6 Memory size: 3.60 GB HW page size: 16384 VM page size: 16384

Models: UNKNOWN

OS Cryptex File Extents: 2538

0
Paulfowler11071983
Paulfowler11071983 OP
3w

Heaviest stack for the target process: 1 ??? (libswift_Concurrency.dylib + 414272) [0x1a89ed240] 1 ??? (BackgroundShortcutRunner + 58424) [0x10481e438] 1 ??? (BackgroundShortcutRunner + 406408) [0x104873388] 1 ??? (BackgroundShortcutRunner + 66124) [0x10482024c] 1 ??? (BackgroundShortcutRunner + 58424) [0x10481e438] 1 ??? (BackgroundShortcutRunner + 66124) [0x10482024c] 1 ??? (BackgroundShortcutRunner + 66124) [0x10482024c] 1 ??? (BackgroundShortcutRunner + 58424) [0x10481e438] 1 ??? (BackgroundShortcutRunner + 144464) [0x104833450] 1 ??? (BackgroundShortcutRunner + 106100) [0x104829e74] 1 ??? (ToolKit + 528132) [0x278d02f04] 1 ??? (libswiftDispatch.dylib + 7268) [0x1a6606c64] 1 ??? (libswiftDispatch.dylib + 5624) [0x1a66065f8] 1 ??? (libswiftDispatch.dylib + 5176) [0x1a6606438] 1 ??? (libswiftDispatch.dylib + 7676) [0x1a6606dfc] 1 ??? (libswiftDispatch.dylib + 7512) [0x1a6606d58] 1 ??? (libdispatch.dylib + 71464) [0x1a4f36728] 1 ??? (libdispatch.dylib + 112004) [0x1a4f40584] 1 ??? (libswiftDispatch.dylib + 7308) [0x1a6606c8c] 1 ??? (libswiftDispatch.dylib + 7728) [0x1a6606e30] 1 ??? (libswiftDispatch.dylib + 7972) [0x1a6606f24] 1 ??? (libswiftDispatch.dylib + 8124) [0x1a6606fbc] 1 ??? (libswiftDispatch.dylib + 7768) [0x1a6606e58] 1 ??? (ToolKit + 529324) [0x278d033ac] 1 ??? (ToolKit + 528224) [0x278d02f60] 1 ??? (GRDBInternal + 805376) [0x2675a3a00] 1 ??? (GRDBInternal + 5584) [0x2674e05d0] 1 ??? (libswiftDispatch.dylib + 7268) [0x1a6606c64] 1 ??? (libswiftDispatch.dylib + 5624) [0x1a66065f8] 1 ??? (libswiftDispatch.dylib + 5176) [0x1a6606438] 1 ??? (libswiftDispatch.dylib + 7676) [0x1a6606dfc] 1 ??? (libswiftDispatch.dylib + 7512) [0x1a6606d58] 1 ??? (libdispatch.dylib + 71464) [0x1a4f36728] 1 ??? (libdispatch.dylib + 112004) [0x1a4f40584] 1 ??? (libswiftDispatch.dylib + 7308) [0x1a6606c8c] 1 ??? (libswiftDispatch.dylib + 7728) [0x1a6606e30] 1 ??? (libswiftDispatch.dylib + 7972) [0x1a6606f24] 1 ??? (libswiftDispatch.dylib + 8124) [0x1a6606fbc] 1 ??? (libswiftDispatch.dylib + 7768) [0x1a6606e58] 1 ??? (GRDBInternal + 9948) [0x2674e16dc] 1 ??? (GRDBInternal + 9764) [0x2674e1624] 1 ??? (ToolKit + 528580) [0x278d030c4] 1 ??? (libsqlite3.dylib + 521032) [0x1cb4b0348] 1 ??? (libsqlite3.dylib + 1067048) [0x1cb535828] 1 ??? (libsqlite3.dylib + 382056) [0x1cb48e468] 1 ??? (libsqlite3.dylib + 309376) [0x1cb47c880] 1 ??? (libsystem_kernel.dylib + 27292) [0x1eddfba9c]

Powerstats for: BackgroundShortcutRunner [935] UUID: DAB8C7ED-E848-3D53-BDF3-CE9809DE4D53 Path: /System/Library/PrivateFrameworks/WorkflowKit.framework/XPCServices/BackgroundShortcutRunner.xpc/BackgroundShortcutRunner Identifier: com.apple.WorkflowKit.BackgroundShortcutRunner Version: 7.0 (3612.0.2.1) Resource Coalition: 1 sample 273 On Behalf Of: 1 sample UNKNOWN [171] (1 sample originated by UNKNOWN [171]) Architecture: arm64 Footprint: 5104 KB Start time: 2025-08-15 17:49:38.838 +1000 End time: 2025-08-15 17:49:38.838 +1000 Num samples: 1 (100%) Num threads: 1 Primary state: 1 samples Non-Frontmost App, Non-Suppressed, Kernel mode, Effective Thread QoS User Initiated, Requested Thread QoS User Initiated, Override Thread QoS Unspecified, e-core User Activity: 0 samples Idle, 1 samples Active Power Source: 0 samples on Battery, 1 samples on AC 1 ??? (libswift_Concurrency.dylib + 414272) [0x1a89ed240] 1 ??? (BackgroundShortcutRunner + 58424) [0x10481e438] 1 ??? (BackgroundShortcutRunner + 406408) [0x104873388] 1 ??? (BackgroundShortcutRunner + 66124) [0x10482024c] 1 ??? (BackgroundShortcutRunner + 58424) [0x10481e438] 1 ??? (BackgroundShortcutRunner + 66124) [0x10482024c] 1 ??? (BackgroundShortcutRunner + 66124) [0x10482024c] 1 ??? (BackgroundShortcutRunner + 58424) [0x10481e438] 1 ??? (BackgroundShortcutRunner + 144464) [0x104833450] 1 ??? (BackgroundShortcutRunner + 106100) [0x104829e74] 1 ??? (ToolKit + 528132) [0x278d02f04] 1 ??? (libswiftDispatch.dylib + 7268) [0x1a6606c64] 1 ??? (libswiftDispatch.dylib + 5624) [0x1a66065f8] 1 ??? (libswiftDispatch.dylib + 5176) [0x1a6606438] 1 ??? (libswiftDispatch.dylib + 7676) [0x1a6606dfc] 1 ??? (libswiftDispatch.dylib + 7512) [0x1a6606d58] 1 ??? (libdispatch.dylib + 71464) [0x1a4f36728] 1 ??? (libdispatch.dylib + 112004) [0x1a4f40584] 1 ??? (libswiftDispatch.dylib + 7308) [0x1a6606c8c] 1 ??? (libswiftDispatch.dylib + 7728) [0x1a6606e30] 1 ??? (libswiftDispatch.dylib + 7972) [0x1a6606f24] 1 ??? (libswiftDispatch.dylib + 8124) [0x1a6606fbc] 1 ??? (libswiftDispatch.dylib + 7768) [0x1a6606e58] 1 ??? (ToolKit + 529324) [0x278d033ac] 1 ??? (ToolKit + 528224) [0x278d02f60] 1 ??? (GRDBInternal + 805376) [0x2675a3a00] 1 ??? (GRDBInternal + 5584) [0x2674e05d0] 1 ??? (libswiftDispatch.dylib + 7268) [0x1a6606c64] 1 ??? (libswiftDispatch.dylib + 5624) [0x1a66065f8] 1 ??? (libswiftDispatch.dylib + 5176) [0x1a6606438] 1 ??? (libswiftDispatch.dylib + 7676) [0x1a6606dfc] 1 ??? (libswiftDispatch.dylib + 7512) [0x1a6606d58] 1 ??? (libdispatch.dylib + 71464) [0x1a4f36728] 1 ???

0
Paulfowler11071983
Paulfowler11071983 OP
3w

libdispatch.dylib + 112004) [0x1a4f40584] 1 ??? (libswiftDispatch.dylib + 7308) [0x1a6606c8c] 1 ??? (libswiftDispatch.dylib + 7728) [0x1a6606e30] 1 ??? (libswiftDispatch.dylib + 7972) [0x1a6606f24] 1 ??? (libswiftDispatch.dylib + 8124) [0x1a6606fbc] 1 ??? (libswiftDispatch.dylib + 7768) [0x1a6606e58] 1 ??? (GRDBInternal + 9948) [0x2674e16dc] 1 ??? (GRDBInternal + 9764) [0x2674e1624] 1 ??? (ToolKit + 528580) [0x278d030c4] 1 ??? (libsqlite3.dylib + 521032) [0x1cb4b0348] 1 ??? (libsqlite3.dylib + 1067048) [0x1cb535828] 1 ??? (libsqlite3.dylib + 382056) [0x1cb48e468] 1 ??? (libsqlite3.dylib + 309376) [0x1cb47c880] 1 ??? (libsystem_kernel.dylib + 27292) [0x1eddfba9c] 1 <on behalf of UNKNOWN [171] (originated by UNKNOWN [171])>

Binary Images: 0x104810000 - ??? com.apple.WorkflowKit.BackgroundShortcutRunner 7.0 (3612.0.2.1) <DAB8C7ED-E848-3D53-BDF3-CE9809DE4D53> /System/Library/PrivateFrameworks/WorkflowKit.framework/XPCServices/BackgroundShortcutRunner.xpc/BackgroundShortcutRunner 0x1a4f25000 - 0x1a4f6ab3f libdispatch.dylib <B62778F7-5827-3A7B-A96D-A24F7BE95416> /usr/lib/system/libdispatch.dylib 0x1a6605000 - 0x1a661b560 libswiftDispatch.dylib <28BABAED-25CA-3448-BE8A-30AFF6324646> /usr/lib/swift/libswiftDispatch.dylib 0x1a8988000 - 0x1a8a07fff libswift_Concurrency.dylib <7D7AD359-D240-391B-8E01-A01153D84033> /usr/lib/swift/libswift_Concurrency.dylib 0x1cb431000 - 0x1cb5b1683 libsqlite3.dylib <12F6BE8D-088A-385D-AA07-2827085C51DA> /usr/lib/libsqlite3.dylib 0x1eddf5000 - 0x1ede2eebf libsystem_kernel.dylib <A9A7ECBD-24DD-37E6-BB23-ECBFD9A87E33> /usr/lib/system/libsystem_kernel.dylib 0x2674df000 - 0x2676710ea GRDBInternal <47EEB1A2-4142-321F-BA01-BFA634118479> /System/Library/PrivateFrameworks/GRDBInternal.framework/GRDBInternal 0x278c82000 - 0x27906d35f ToolKit <7B79326B-AEDD-3B7B-98FF-79F12FB14CAC> /System/Library/

0
Paulfowler11071983
Paulfowler11071983 OP
3w

As I say my knowledge is very limited and was hoping one of you may be able to help. Thank you

0
Paulfowler11071983
Paulfowler11071983 OP
3w

Or maybe it is this I just don’t know.

}, "freeze_skip_reason:" : "disabled", "pid" : 80, "cpuTime" : 0.14849699999999999, "name" : "driverkitd", "lifetimeMax" : 189 }, { "uuid" : "da941e56-8c25-3a4d-9086-fb09030a8023", "states" : [ "daemon", "idle" ], "csFlags" : 570434305, "purgeable" : 0, "age" : 3961199700, "fds" : 25, "coalition" : 44, "csTrustLevel" : 9, "rpages" : 86, "priority" : 0, "mem_regions" : 49, "physicalPages" : { "internal" : [ 3, 71 ] }, "freeze_skip_reason:" : "disabled", "pid" : 291, "cpuTime" : 0.018530000000000001, "name" : "WiFiCloudAssetsXPCService", "lifetimeMax" : 87 }, { "uuid" : "21d23146-9fad-3f61-b88a-3574c5a6161d", "states" : [ "daemon", "idle" ], "csFlags" : 570434305, "purgeable" : 0, "age" : 4833608018, "fds" : 25, "coalition" : 318, "csTrustLevel" : 9, "rpages" : 101, "priority" : 0, "mem_regions" : 48, "physicalPages" : { "internal" : [ 5, 84 ] }, "freeze_skip_reason:" : "disabled", "pid" : 249, "cpuTime" : 0.026048999999999999, "name" : "UserFontManager", "lifetimeMax" : 102 }, { "uuid" : "ac832072-074d-397e-b0af-ba493c1f0d04", "states" : [ "daemon", "idle" ], "csFlags" : 570499841, "purgeable" : 0, "age" : 3900392631, "fds" : 25, "coalition" : 507, "csTrustLevel" : 9, "rpages" : 212, "priority" : 0, "mem_regions" : 61, "physicalPages" : { "internal" : [ 162, 36 ] },

0
Paulfowler11071983
Paulfowler11071983 OP
3w

Or this

{"bug_type":"313","timestamp":"2025-08-15 22:05:29.00 +1000","os_version":"iPhone OS 18.6.1 (22G90)","roots_installed":0,"incident_id":"146EA160-16C8-434C-BB08-7054EA54EB17"} {"agent":"parsecd&#x2F;1 (iPhone13,2; iPhone OS 18.6.1 22G90) spotlight&#x2F;1","session_start":1755259529,"country_code":"AU","user_guid":"0FEE1F6F-E565-4A84-9612-965818F2D07E"}

0
Help needed identifying commands for remote access
First post date Last post date
 
 
Q