Somewhen around late versions of macOS Monterey, and certainly by the release of Ventura, macOS started to use cryptexes to load Safari and parts of the operating system including dyld caches, rather than installing them to the Data volume. Over a period of three months, cryptexes were also used to install Rapid Security Responses (RSRs) in an experiment that was quickly discontinued. What I hadn’t realised until recently was that they are also used to deliver much of the additional components required to support Apple Intelligence features in Apple silicon Macs. This article looks as how that works.
Cryptexes
These first appeared on Apple’s customised iPhone, its Security Research Device, which uses them to load a personalised trust cache and a disk image containing corresponding content. Without the cryptex, engineering those iPhones would have been extremely difficult. According to its entry in the File Formats Manual from five years ago (man cryptex), ‘A cryptex is a cryptographically-sealed archive which encapsulates a well-defined filesystem hierarchy. The host operating system recognizes the hierarchy of the cryptex and extends itself with the content of that hierarchy. The name cryptex is a portmanteau for “CRYPTographically-sealed EXtension”.’
In practice, a cryptex is a sealed disk image containing its own file system, mounted at a randomly chosen location within the root file system during the boot process. Prior to mounting the cryptex, macOS verifies it matches its seal, thus hasn’t been tampered with. Managing these cryptexes is the task of the cryptexd service with cryptexctl. Because cryptexes aren’t mounted in the usual way, they’re not visible in mount lists such as that produced by mount(8).
System cryptexes
Once kernel boot is well under way, APFS mounts containers and volumes in the current boot volume group, followed by others to be mounted at startup. When those are complete, it turns to mounting and grafting the three standard system cryptexes:
os.dmg, around 6 GB (macOS 15.5), containing system components such as dyld caches;
app.dmg, around 23 MB, containing Safari and supporting components;
os.clone.dmg, apparently a copy of os.dmg and the same size.
AI cryptex collection
About 5 seconds later, and over 14 seconds after APFS first started work, it checks and grafts a series of 23 cryptexes primarily involved with Apple Intelligence features. These are handled one at a time in succession, each reported in a sequence of log entries as follows (times in seconds after an arbitrary start).
First the Image4 file containing the cryptex is validated 9.434431 root_hash_execution_cb_mobile_asset:3066: image4_trust_evaluate: successfully validated the payload and the manifest
Then it’s grafted into the file system of the Data volume as a ‘PFK volume’. In this extract I omit the bulk of the cryptex’s name using […] for the sake of brevity. 9.434465 apfs_graft:695: disk3s5 Grafting on a PFK volume
9.434509 graft_dev_init:480: disk3 UC_[…]_Cryptex.dmg GRAFT (compiled @ Apr 22 2025 19:49:43)
9.434514 graft_dev_init:484: disk3 UC_[…]_Cryptex.dmg device_handle block size 4096 real block size 4096 block count 11264 features 0 internal VEK
9.434695 nx_mount:1308: UC_[…]_Cryptex.dmg initializing cache w/hash_size 512 and cache size 512
9.437484 nx_mount:1630: UC_[…]_Cryptex.dmg checkpoint search: largest xid 15, best xid 15 @ 7
9.437497 nx_mount:1657: UC_[…]_Cryptex.dmg stable checkpoint indices: desc 6 data 31
9.438117 er_state_obj_get_for_recovery:8420: UC_FM_LANGUAGE_INSTRUCT_3B_CONC No ER state object for volume RevivalB13M201388.UC_[…]_Cryptex - rolling is not happening, nothing to recover.
9.438124 apfs_log_op_with_proc:3263: UC_FM_LANGUAGE_INSTRUCT_3B_CONC grafting volume RevivalB13M201388.UC_[…]_Cryptex, requested by: mobileassetd (pid 457); parent: launchd (pid 1)
Note the volume name starts with Revival. Names of all other cryptex volumes in the AI collection start with the same code name, except for the PKI cryptex examined below, which uses Creedence instead. Perhaps these are a reference to Creedence Clearwater Revival?
The root hash of the cryptex file system is then authenticated 9.438156 graft_dev_blockmap_lut_switch_to_metadata_based_if_needed:1312: UC_FM_LANGUAGE_INSTRUCT_3B_CONC lut contains 26 extents, 3 of which contain metadata
9.438160 is_root_hash_authentication_required_osx:387: UC_FM_LANGUAGE_INSTRUCT_3B_CONC Release kext with internal build: 0, ARV disabled: 0, booting xid: 0
9.438164 is_root_hash_authentication_required_osx:418: UC_FM_LANGUAGE_INSTRUCT_3B_CONC strict graft, root hash authentication failure is required
9.438167 is_root_hash_authentication_required:557: UC_FM_LANGUAGE_INSTRUCT_3B_CONC Strict Graft, root hash authentication is required
9.438179 authenticate_root_hash:642: UC_FM_LANGUAGE_INSTRUCT_3B_CONC successfully validated on-disk root hash
9.438191 apfs_lookup_ge_jobj_id:5028: disk3s5 Found OBJID 0x66a1b8 type 3
The graft is then completed. 9.438195 apfs_graft:1045: disk3s5 Graft ino 6557986, jobj_id range 6725836+76
9.438396 apfs_graft:1138: disk3s5 successfully grafted ino 6557986 on dir 6725835, dev_name [UC_[…]_Cryptex.dmg]
Fortunately, these log entries provide the inode number for the location of the grafted cryptex, and that can be used in Mints to obtain its full path.
Among the AI cryptex collection is a secure public key infrastructure (PKI) trust store, located at /System/Library/AssetsV2/com_apple_MobileAsset_PKITrustStore/purpose_auto/[…].asset/AssetData/Restore/SECUREPKITRUSTSTOREASSETS_SECUREPKITRUSTSTORE_Cryptex.dmg
In the log, this is recorded as being 4.2 MB in size, and that is the same size as reported for the .dmg file by the Finder. Disk images are in APFS (Case-sensitive) format, and might be identical to their equivalents provided for iOS and iPadOS.
When mounted, that disk image becomes a volume named Creedence11M6270.SECUREPKITRUSTSTOREASSETS_SECUREPKITRUSTSTORE_Cryptex. That contains many property lists, certificate data, a SystemRootCertificates keychain, and two property lists that are grafted into /System/Library/CoreServices.
The names of all 23 cryptex disk images included in the macOS 15.5 AI cryptex collection are given in the Appendix. All are given as being compiled at Apr 22 2025 19:49:43, the same as the system cryptexes, implying that they were installed as part of the macOS 15.5 update. The whole sequence of processing the AI cryptexes took 0.78 seconds to complete, and the total size of disk images mounted in that period was 7.2 GB, which is similar to the reported size of additional files required to support AI.
Conclusions
Apple silicon Macs running macOS 15.5 with AI enabled load 23 additional cryptexes to support AI, totalling 7.2 GB.
Those AI cryptexes are grafted into the Data volume, in paths starting /System/Library/AssetsV2.
All except one have volume names starting with Revival
One cryptex is a secure PKI trust store, whose volume name starts with Creedence instead.
These cryptexes are installed and updated as part of macOS updates, although they could also be installed or updated separately, for example when AI is enabled.
If a Mac shows an unusual mounted volume with a name starting with Creedence or Revival, that’s almost certainly the respective disk image, which should normally be hidden and not visible in the Finder.
Appendix
Disk image names for the AI cryptex collection in macOS 15.5 (Apple silicon):
When England and Wales were drawn together in Group D of Euro 2025, many fans and pundits would have circled the fixture between the home nations as a key date in the competition.
However, after both sides lost their opening games in Switzerland, there is real fear the match will be a dead rubber.
If, on Wednesday, England lose to the Netherlands and Wales are beaten by France, both will be eliminated before their final game.
They are fighting for their Euro lives - and both know improved displays are required to avoid the worst-case scenario of a double elimination after two matches.
BBC Sport takes a look at the challenges facing both sides in their second games in Switzerland.
To play this video you need to enable JavaScript in your browser.
This video can not be played
Media caption,
We're our own biggest critics - Russo
England v Netherlands at Euro 2025
Venue: Stadion Letzigrund, Zurich Date: Wednesday 9 July, 17:00 BST
Coverage: Watch on BBC One, iPlayer and the BBC Sport website. Listen on BBC Radio 5 Live and BBC Sounds
Defending champions England face Euro 2017 winners the Netherlands and, following their 2-1 defeat by France on Saturday, they will be knocked out if they lose and France are not beaten by Wales.
The Netherlands have won two of their last three meetings with England - but the Lionesses have never lost back-to-back matches under Sarina Wiegman.
If teams finish on the same points after three matches, it will come down to head-to-head records to decide the two qualification spots.
"Ultimately we don't like losing but when a result like that happens you have to reflect and come together as a team," said England striker Alessia Russo.
"We have bounced back before. We know we weren't up to it against France. For our own standards, we want to be better. That sets the bar for us.
"We're our own biggest critics as players so we're all ready to get out there and have another good game."
Manager Wiegman, who won Euro 2017 as Netherlands boss, said England have "not talked about consequences" but admitted it was a must-win game.
"We lost [against France] and we play against a very good opponent again, but we're really good too," she told BBC Radio 5 Live.
"It's a final for us, we will do everything to win. Every game is must-win. We've experienced that before."
Wiegman was captain under Netherlands boss Andries Jonker for the national team and they have been friends for almost 30 years.
Asked how Wiegman will handle the pressure, Jonker said: "She is very experienced and she knows you cannot always win.
"She will not panic and her experience will help her. It is not a problem for her - but more for everyone around her.
"If you win, there is a party. If you don't win, then you have a problem. In football you have to play against each other and you want to win.
"It wouldn't make me more happy to win than against anyone else in football, if anything, I [would be] disappointed for Sarina. But I want to win."
Rhian Wilkinson has guided Wales to their first ever major tournament
France v Wales at Euro 2025
Venue: Arena St Gallen, St Gallen Date: Wednesday 9 July, 20:00 BST
Coverage: Listen on BBC Radio 5 Live and BBC Sounds and follow text updates on BBC Sport website
Manager Rhian Wilkinson has urged her side to "show Wales how proud we are to represent our country" when they face France.
Wales' 3-0 defeat by Netherlands means they must earn at least a point in St Gallen against a team they have never beaten before to avoid elimination from their first major tournament.
Having had less than ideal preparation for the daunting contest with France after their team bus was involved in a crash that saw their training session at Arena St Gallen cancelled, Wilkinson says her squad will focus on football with everyone on the bus thankfully uninjured.
"I think football is secondary and I think, yes, we are shaken," she told BBC Sport Wales. "We've practised for the unexpected, I think that's what we can call this.
"This is a fantastic opportunity, this is another good team, we've talked about that enough that these are three strong teams in our group, it's another opportunity for us to show up and to play to the best of our ability.
"Everyone's aware of what it means if we don't get a point, but equally it's about delivering as strong a performance as we possibly can to have another opportunity to show Wales how proud we are to represent our country."
Captain Angharad James feels confident that Wales, who are yet to win a match in all competitions in 2025, can produce an improved performance now that the emotional burden of playing an historic first major tournament match is behind them.
"Emotions were obviously high in the first game. We'd waited a very long time for that moment," she said.
"To run out of the tunnel and experience that was maybe an experience that a lot of us hadn't experienced before. Now we know what to expect, now we know what's in front of us."
Wales' aim of causing a massive shock against France has been boosted by the news that all 23 players are fit and available for selection after midfielder Ceri Holland reported for training after leaving the Netherlands match with cramp.
Watch: The BBC asks about the Trump administration's vision for Gaza
US President Donald Trump and Israeli Prime Minister Benjamin Netanyahu met on Tuesday evening for the second time in as many days to discuss the ongoing war in Gaza.
The meeting came after Trump's Middle East envoy Steve Witkoff suggested Israel and Hamas had one remaining issue to agree on for a 60-day ceasefire deal.
Netanyahu arrived at the White House shortly after 17:00 EST (21:00 GMT) on Tuesday for the meeting, which was not open to members of the press.
Earlier on Tuesday, Netanyahu met with vice-president JD Vance. He also met with Trump for several hours during a dinner at the White House on Monday.
It marks Netanyahu's third state visit to the US since Trump's second term.
The meeting of the two leaders lasted around two hours.
Netanyahu also met with the Republican House of Representative Speaker Mike Johnson.
After that meeting, the Israeli Prime Minister said he did not believe Israel's military campaign in Gaza was done, but that negotiators are "certainly working" on a ceasefire.
"We still have to finish the job in Gaza, release all our hostages, eliminate and destroy Hamas' military and government capabilities," Netanyahu said.
Witkoff later said that Israel and Hamas were closing the gap on issues that previously prevented them from reaching a deal, and that he hoped a temporary, 60-day ceasefire will be agreed on this week.
"We had four issues and now we're down to one", Witkoff said of the sticking points in negotiations.
He added that the draft deal would also include the release of 10 hostages who are alive, and the bodies of nine who are deceased.
Before the Israeli Prime Minister's meeting with Trump on Monday, a Qatari delegation arrived at the White House and spoke with officials for several hours, Axios reported, citing a source with knowledge of the talks.
Trump told reporters on Monday evening that ceasefire talks are "going very well". But Qatar, which has played a mediator role in negotiations, said on Tuesday morning that more time was needed for negotiations.
"I don't think that I can give any timeline at the moment, but I can say right now that we will need time for this," Qatar's foreign ministry spokesman Majed Al-Ansari said.
Before discussions resumed on Tuesday, a Palestinian source familiar with the talks told the BBC they have not made any headway.
The latest round of negotiations between Hamas and Israel began on Sunday.
The ongoing Gaza war began on 7 October 2023 when Hamas attacked Israel, killing 1,200 people and taking 251 hostages, according to Israeli figures. Israel's retaliatory offensive has killed at least 57,500 in Gaza according to the territory's Hamas-run health ministry.