7

Here's a list of the processes on iPhone, obtained with help of Activity Monitor in Xcode instruments.

Is the Unknown(0) process with 232 threads owned by root malware?

Activity Monitor screenshot

4
  • I’ve edited the side question on lists malware names out. We strongly prefer one question per question. It would be very appropriate and encouraged to ask a linked question that focuses on that topic.
    – bmike
    Commented Mar 9, 2021 at 11:12
  • 2
    I'd be more inclined to think they're OS internals with which Apple thinks we're too dumb to interact. (So yeah malware, as they're iOS). ;) Commented Mar 9, 2021 at 16:13
  • @AdamBarnes why not put up a proper answer? Criticism is welcome - especially when it can be backed up with a reference or some argument. I did edit the comment so it’s not directed at any “you”.
    – bmike
    Commented Mar 10, 2021 at 0:58
  • I just wanted to make a little jokey joke and brighten up people's day a little. Commented Mar 11, 2021 at 2:43

1 Answer 1

13

pid 0 is always kernel_task in xnu. Further corroborated by being owned by root and having a lot of threads. It’s a synthetic process structure that represents the kernel. It isn’t malware.

6
  • 2
    Couldn't a rootkit impersonate the kernel?
    – fpjxmqjtaw
    Commented Mar 9, 2021 at 16:55
  • 5
    @Sevron Yes, but there's nothing suspicious here about this process.
    – Vitruvie
    Commented Mar 9, 2021 at 18:00
  • 1
    what would a suspicious process look like?
    – mjr
    Commented Mar 9, 2021 at 20:22
  • 1
    Odd for something with a well-established identity to be labeled Unknown.
    – Nat
    Commented Mar 10, 2021 at 2:08
  • 2
    +1 Also, considering that launchd is responsible for everything else except pid 0, and pid 0 is responsible for launchd, this implies that this is the kernel, which would load before any other task on virtually any multitasking OS design.
    – phyrfox
    Commented Mar 10, 2021 at 3:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .