ZhuGeService in Activity monitor

[BootLoxes]

Can anyone check their activity monitor and see if they have this running? Preferably those with AS Macs with Monterey.

I just noticed it there.

 

[bogdanw]

It’s part of Big Sur too, in /System/Library/PrivateFrameworks/ZhuGeSupport.framework/Versions/A/XPCServices/ZhuGeService.xpc/Contents/MacOS/ZhuGeService
but it may be running only on Apple Silicon Macs and it’s related to some audio hardware.
https://discussions.apple.com/thread/253333260

 

[BootLoxes]

Yeah I saw that. I looked and mine was installed about 3 weeks ago. So I am not sure what triggered it. But other apple apps were updated at the exact date and time this was installed.

 

[georgiabecker]

First thing I thought of was a developer being cute, and capitalizing "z huge service" (think butchered European accent, "z" instead of "the") to look mildly Chinese. Mostly because I've seen quite a bit of cuteness in my time.

 

[f54da]

Very cute name. Quickly throwing it into disassembler, I can't really determine what exactly it does. Seems lots of things related to accessing hardware, there's an nvram flag `zhuge_debug`, lots of things related to key/value pairs and some stuff about integrity. Only found one other hit

https://www.reddit.com/r/MacOSBeta/comments/ppgp0h/_/hljar0t

Possibly somehow related to fairplay, hdcp, or content encryption?

There's also a bug report https://github.com/ExistentialAudio/BlackHole/discussions/627 which shows that ZHugeService is invoked from CoreRepairKit. marcan posted about corerepairkit in https://twitter.com/marcan42/status/1484155025266180097?lang=en

 

[f54da]

Darn, seems like apple no longer serves that specific disk image. You can follow https://www.theiphonewiki.com/wiki/RecoveryOS to obtain the recovery image and try poking in there if you like, but seems like apple removed most of the juicy strings.

It is quite interesting that this is essentially a local version of MRI though.

Edit: The intel ones seem to have the encrypted codes as Marcan mentioned, but I'm not good enough at purely static reversing on fully compiled C code to be able to figure out what the key is. I guess we mortals will have to be satisfied with that screencap of the ref codes, although that itself is pretty useful since it answers a question I had about things

{
    "category": "Battery",
    "key": 3747,
    "name": "Battery Combined Test",
    "permutations":
    [
        {
            "environment": 1,
            "parameters":
            {
                "doChargeCheck": true,
                "promptForPower Adapter": false
            },
            "predicates":
            [
                {
                    "type": "Battery"
                }
            ],
            "specifications":
            {
                "allowHigherWattage": true,
                "fastChargingDisableVoltage": 9000,
                "minWattage": 80
            }
        }
    ],
    "requiresRootAccess": true,
    "status":
    [
        {
            "code": -900,
            "refCode": "ADP001",
            "string": "Test cancelled."
        },
        {
            "code": -1001,
            "refCode": "ADP002",
            "string": "Unable to start test (1)."
        },
        {
            "code": -1000,
            "refCode": "ADP003",
            "string": "Unable to start test (0)."
        },
        {
            "code": -919,
            "refCode": "ADP013",
            "string": "Problem with specifications."
        },
        {
            "code": -918,
            "refCode": "ADP014",
            "string": "Problem with predicates."
        },
        {
            "code": -912,
            "refCode": "ADP015",
            "string": "Problem with parameters."
        },
        {
            "code": -17,
            "refCode": "PPT016",
            "string": "Battery discharging when should be charging."
        },
        {
            "code": -14,
            "refCode": "PPT014",
            "string": "Battery worn out with very Low charging ability found."
        },
        {
            "code": -12,
            "refCode": "PPT012",
            "string": "Battery worn out with low charging ability found."
        },
        {
            "code": -11,
            "refCode": "PPP008",
            "string": "Underpowered adapter found."
        },
        {
            "code": -10,
            "refCode": "PPP013",
            "string": "Problem getting adapter information."
        },
        {
            "code": -9,
            "refCode": "PPT014",
            "string": "SMC reading issue."
        },
        {
            "code": -16,
            "refCode": "PPP012",
            "string": "Underpowered adapter found. Need at least 96W; found 45W. "
        },
        {
            "code": -15,
            "refCode": "PPP011",
            "string": "Underpowered adapter found. Need at least 96W; found 60W."
        },
        {
            "code": -14,
            "refCode": "PPP010",
            "string": "Underpowered adapter found. Need at least 96W; found 85W. "
        },
        {
            "code": -6,
            "refCode": "PPP006",
            "string": "Underpowered adapter found. Need at least 85W; found 45W."
        },
        {
            "code": -5,
            "refCode": "PPP005",
            "string": "Underpowered adapter found. Need at least 85W; found 60W."
        },
        {
            "code": -4,
            "refCode": "PPP004",
            "string": "Underpowered adapter found. Need at least 60W; found 45W. "
        },
        {
            "code": -3,
            "refCode": "PPP007",
            "string": "Adapter not connected."
        },
        {
            "code": -1,
            "refCode": "",
            "string": "System warning."
        },
        {
            "code": 0,
            "refCode": "ADP000",
            "string": "Test passed."
        },
        {
            "code": 1,
            "string": "Test Failed."
        },
        {
            "code": 2,
            "refCode": "PPT003",
            "string": "Failed. Battery worn out."
        },
        {
            "code": 3,
            "refCode": "PPT001",
            "string": "No battery found."
        },
        {
            "code": 4,
            "refCode": "PPT009",
            "string": "Locked battery found."
        },
        {
            "code": 6,
            "refCode": "PPT004",
            "string": "Unsealed battery found."
        },
        {
            "code": 7,
            "refCode": "PPP003",
            "string": "Charge failure found; check adapter is known-good."
        },
        {
            "code": 8,
            "refCode": "PPT004",
            "string": "Chemical Capacity failure."
        },
        {
            "code": 9,
            "refCode": "PPT005",
            "string": "Power Disconnect Screw failure."
        },
        {
            "code": 10,
            "refCode": "PPT011",
            "string": "Overcapacity failure."
        },
        {
            "code": 11,
            "refCode": "PPT002",
            "string": "Below 80 failure."
        },
        {
            "code": 12,
            "refCode": "PPT010",
            "string": "Below 50 failure."
        },
        {
            "code": 18,
            "refCode": "PPT006",
            "string": "Battery Error Condition."
        }
    ],
    "usesRefCode": true
}

 

[CIA]

Brand new MacBook Pro from Apple had ZhuGeService running on it from first boot, so I think it's certainly an Apple thing. No clue what it does tho.