7

Here's a list of the processes on iPhone, obtained with help of Activity Monitor in Xcode instruments.

Is the Unknown(0) process with 232 threads owned by root malware?

Activity Monitor screenshot

Improve this question
4
  • I’ve edited the side question on lists malware names out. We strongly prefer one question per question. It would be very appropriate and encouraged to ask a linked question that focuses on that topic.
    – bmike ♦
    Mar 9, 2021 at 11:12
  • 2
    I'd be more inclined to think they're OS internals with which Apple thinks we're too dumb to interact. (So yeah malware, as they're iOS). ;)
    – Adam Barnes
    Mar 9, 2021 at 16:13
  • @AdamBarnes why not put up a proper answer? Criticism is welcome - especially when it can be backed up with a reference or some argument. I did edit the comment so it’s not directed at any “you”.
    – bmike ♦
    Mar 10, 2021 at 0:58
  • I just wanted to make a little jokey joke and brighten up people's day a little.
    – Adam Barnes
    Mar 11, 2021 at 2:43

1 Answer 1

Reset to default
13

pid 0 is always kernel_task in xnu. Further corroborated by being owned by root and having a lot of threads. It’s a synthetic process structure that represents the kernel. It isn’t malware.

Improve this answer
6
  • 2
    Couldn't a rootkit impersonate the kernel?
    – fpjxmqjtaw
    Mar 9, 2021 at 16:55
  • 5
    @Sevron Yes, but there's nothing suspicious here about this process.
    – Vitruvie
    Mar 9, 2021 at 18:00
  • 1
    what would a suspicious process look like?
    – mjr
    Mar 9, 2021 at 20:22
  • 1
    Odd for something with a well-established identity to be labeled Unknown.
    – Nat
    Mar 10, 2021 at 2:08
  • 2
    +1 Also, considering that launchd is responsible for everything else except pid 0, and pid 0 is responsible for launchd, this implies that this is the kernel, which would load before any other task on virtually any multitasking OS design.
    – phyrfox
    Mar 10, 2021 at 3:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .