ANECompilerService

Before you comment to crucify me for looking in logs, please tell me if this compiler looks suspicious, I didn’t post the full log as it’s very very long.


This iPad was factory reset at the Apple Store a few weeks, no additional apps installed. My MacBook Pro and MacMini were both compromised and jailbroken.


I am wondering if this is a persistent ‘horsey’ type issue and my iPad and Macs are now back on the merry-go-round despite factory resets and new AppleID.


{"app_name":"ANECompilerService","timestamp":"2023-03-28 09:42:12.00 +1100","slice_uuid":"","build_version":"1","bundleID":"com.apple.ANECompilerService","duration_ms":"120064","share_with_app_devs":0,"is_first_party":0,"bug_type":"202","os_version":"iPhone OS 16.3.1 (20D67)","roots_installed":0,"name":"ANECompilerService","incident_id":""}
Date/Time:        2023-03-28 09:40:11.292 +1100
End time:         2023-03-28 09:42:11.356 +1100
OS Version:       iPhone OS 16.3.1 (Build 20D67)
Architecture:     arm64e
Report Version:   40
Incident Identifier: 

Data Source:      Microstackshots
Shared Cache:     
Shared Cache:     

Command:          ANECompilerService
Path:             /System/Library/PrivateFrameworks/AppleNeuralEngine.framework/XPCServices/ANECompilerService.xpc/ANECompilerService
Identifier:       com.apple.ANECompilerService
Version:          ??? (1)
Resource Coalition ID: 463
Architecture:     arm64e
Parent:           launchd [1]
PID:              1021

Event:            cpu usage
Action taken:     none
CPU:              90 seconds cpu time over 120 seconds (75% cpu average), exceeding limit of 50% cpu over 180 seconds
CPU limit:        90s
Limit duration:   180s
CPU used:         90s
CPU duration:     120s
Duration:         120.06s
Duration Sampled: 118.88s
Steps:            47

Hardware model:   iPad12,1
Active cpus:      6
HW page size:     16384
VM page size:     16384

Advisory levels:  Battery -> 3, User -> 3, ThermalPressure -> 0, Combined -> 3
Free disk space:  48.07 GB/59.59 GB, low space threshold 150 MB
Vnodes Available: 47.69% (4769/10000)

Preferred User Language: en-AU
Country Code:     AU
Keyboards:        en_AU QWERTY
OS Cryptex File Extents: 4

Heaviest stack for the target process:
  30  ??? (libsystem_pthread.dylib + 2968) [0x227d3cb98]
  30  ??? (libsystem_pthread.dylib + 3576) [0x227d3cdf8]
  30  ??? (libdispatch.dylib + 93712) [0x1e1a63e10]
  30  ??? (libdispatch.dylib + 49600) [0x1e1a591c0]
  30  ??? (libdispatch.dylib + 46360) [0x1e1a58518]
  30  ??? (libdispatch.dylib + 136524) [0x1e1a6e54c]
  30  ??? (libdispatch.dylib + 46360) [0x1e1a58518]
  30  ??? (libdispatch.dylib + 133168) [0x1e1a6d830]
  30  ??? (libdispatch.dylib + 16456) [0x1e1a51048]
  30  ??? (libxpc.dylib + 72652) [0x227d91bcc]
  30  ??? (libxpc.dylib + 71580) [0x227d9179c]
  30  ??? (Foundation + 6599156) [0x1d4e611f4]
  30  ??? (Foundation + 6600584) [0x1d4e61788]
  30  ??? (Foundation + 6594040) [0x1d4e5fdf8]
  30  ??? (Foundation + 711484) [0x1d48c3b3c]
  30  ??? (CoreFoundation + 133916) [0x1da450b1c]
  30  ??? (CoreFoundation + 476852) [0x1da4a46b4]
  30  ??? (ANECompilerService + 106728) [0x10006e0e8]
  30  ??? (libdispatch.dylib + 79220) [0x1e1a60574]
  30  ??? (libdispatch.dylib + 16264) [0x1e1a50f88]
  30  ??? (ANECompilerService + 108084) [0x10006e634]
  30  ??? (ANECompilerService + 104844) [0x10006d98c]
  30  ??? (ANECompilerService + 99644) [0x10006c53c]
  29  ??? (ANECompiler + 1597532) [0x239a1205c]
  29  ??? (ANECompiler + 1603732) [0x239a13894]
  17  ??? (ANECompiler + 3655344) [0x239c086b0]
  17  ??? (ANECompiler + 3154400) [0x239b8e1e0]
  15  ??? (ANECompiler + 3149656) [0x239b8cf58]
  9   ??? (ANECompiler + 3127684) [0x239b87984]
  9   ??? (ANECompiler + 3147156) [0x239b8c594]
  7   ??? (ANECompiler + 3113240) [0x239b84118]
  6   ??? (ANECompiler + 3111264) [0x239b83960]
  6   ??? (ANECompiler + 2186660) [0x239aa1da4]
  6   ??? (ANECompiler + 4384816) [0x239cba830]
  4   ??? (ANECompiler + 2201700) [0x239aa5864]
  3   ??? (ANECompiler + 4386556) [0x239cbaefc]
  1   ??? (ANECompiler + 4386228) [0x239cbadb4]



iPad, iPadOS 16

Posted on Apr 1, 2023 9:57 PM

Reply

Similar questions

36 replies

Sep 19, 2023 11:56 AM in response to gravityfed

Our computers and devices are currently under the control of an unknown attacker, so this information relates to my initial enquiry as to what ANECompilerService was for others seeking information. These are legitimate Apple services being misused. We are not enrolled in an Apple developer or beta program and the devices have always been kept updated and in lockdown mode since purchase.


ANECompilerService appears to be related to developer activities. It has been observed compiling unknown code both on macOS and iOS alongside kernel, triald, Trial, mediaanalysisd and PegasusKit in the forms of aned, _ANEServer, Espresso, ANECompiler, ANEServices, AppleH11ANEInterface and AppleNeuralEngine.


com.apple.aned


555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: dataVaultDirectory=/Library/Caches/com.apple.aned
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: buildSpecificModelStorageDirectory=<private>
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: modelAssetsCacheDirectory=<private>
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: inMemoryModelCacheDirectory=<private>
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: tempDirectory=<private>
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: cloneDirectory=<private>
555    0    aned: [com.apple.ane:aned] Ready to accept restricted and unrestricted XPC connections
555    0    aned: [com.apple.ane:aned] <private>: SecTaskCopyTeamIdentifier() returned teamIdentity=""
555    0    aned: [com.apple.ane:aned] <private>: SecTaskCopySigningIdentifier() returned csIdentity="<private>"
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Creating context XXXXXXXX04 eng=10008 dev=-1
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Creating plan XXXXXXXX20
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Creating plan XXXXXXXX20
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] espresso_plan_add_network plan=XXXXXXXX20 path=<private> cp=65568
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Loaded network: '<private>' pf=10008 cp=0
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] espresso_plan_add_network plan=XXXXXXXX20 path=<private> cp=65568 Completed
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Destroying plan XXXXXXXX20
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Destroying context XXXXXXXX04
557    0    ANECompilerService: (ANECompiler) ANEC Compiler Input used legacy key names 'NetworkPlistName' 'NetworkPlistPath' - please update to use 'NetworkSourceFileName' 'NetworkSourcePath'
...
557    0    ANECompilerService: [com.apple.ane:compiler] <private>: SUCCESS: model=<private> : output=<private> : lAttr=<private> : lErr=(nil)
555    0    aned: [com.apple.ane:aned] Compilation success: attr=<private>
555    0    aned: [com.apple.ane:aned] END: <private>: <private> : <private> : <private>



ANEStorageMaintainer is also developer related with an ANEVirtualClient:


com.apple.private.ANEStorageMaintainer


The main signs include iOS logs that have a Beta Indentifier number. This is found at the top of logs where apps installed are referenced.

Beta Identifier:  XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX


Additionally, there will be the mention of titles like "legacyInfo", "trialInfo", "rollouts", "rolloutId", "factorPackIds", "deploymentId". As well as "experiment" information towards the bottom of some logs with some of these titles: "treatmentId", "experimentId", "deploymentId".


On macOS you can capture logs in the Terminal.app (a good time is immediately after startup) using the command:

sudo log show --info --debug  --last 2m


Please don’t bother replying with negativity. Users have a right to enquire when they feel something is not right on their tech, those responses are unhelpful and frankly, tiresome.

ANECompilerService

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.