# RTBuddy ## Identification [[System Management Controller|SMC]] coordinates low-level power/thermal functions; [[Apple System Coprocessor|ASC]] and IOP terminology describe coprocessor/interprocessor architecture; RTBuddy/endpoint/service labels are Apple internal-service names. WildPackets is a network-analysis brand lineage; [[Kismet|Kismet]] is wireless network detection/monitoring software. `Certifi page 1` is a cross-reference whose destination is missing. **Collection-level observational context:** Bryant McGill states that the separate RT Buddy/Pegasus identification arose when relevant activity or resources appeared in logs together with [[CrashCapture|CrashCapture]] or [[Heimdallr|Heimdallr]], particularly through documented resources visible in those logs. He further states that Pegasus heuristic matches alone mean nothing as proof and that “Pegasus” is a clumsy cover for something else that will be detailed later. This observation must not silently collapse every Apple RTBuddy service label into Pegasus. ## Notebook evidence - [[Scanned_20260730-1659#PDF page 41 — Apple SMC/RTBuddy services, WildPackets, and Kismet|PDF page 41: Apple SMC/RTBuddy services, WildPackets, and Kismet]] — SMC denotes Apple’s System Management Controller domain; ASC/IOP/RTBuddy labels point toward coprocessor and inter-processor service architecture. WildPackets and Kismet are network-analysis/wireless-discovery references. The page therefore bridges internal device control planes and external radio observation. Because Apple’s private class names vary by platform and release, the component identities remain strong technical inference rather than fully verified public fact. ## Relationships and overlays The source places this record in an evidence cluster with [[Apple System Coprocessor|Apple System Coprocessor]] · [[Kismet|Kismet]] · [[System Management Controller|System Management Controller]] · [[WildPackets|WildPackets]] · [[Wireless Network Discovery|Wireless Network Discovery]]. The occurrence contributes to the notebook's larger model of [[Identity Continuity|identity continuity]], [[Device Sovereignty|device sovereignty]], and [[Continuity Architecture|continuity architecture]]. ## Evidentiary status and open leads Identify the Apple platform/build and “Certifi page 1”; determine whether WildPackets/Kismet were tools, signatures, or discovered strings. ## Source - [[Scanned_20260730-1659|Scanned_20260730-1659]] ## RT Buddy / Pegasus observed-log context **Owner-supplied observation:** Bryant McGill states that the RT Buddy/Pegasus identification arose when the relevant activity or resources appeared in logs together with [[CrashCapture|CrashCapture]] or [[Heimdallr|Heimdallr]], particularly through documented resources visible in those logs. The preserved logs are the cited observational basis. This records what was observed; it does not by itself establish that every Apple RTBuddy service reference is Pegasus, nor does page or log proximity alone prove infection, control, authorship, or attribution. ## Pegasus heuristic caution **Owner-supplied interpretation:** Bryant McGill states that finding Pegasus heuristics, standing alone, means nothing as proof of the underlying system or attribution. In his interpretation, “Pegasus” is a very clumsy cover for something else, which later documents in this archive will detail. Until those materials are incorporated, heuristic matches must not be treated as proof of Pegasus infection, NSO Group attribution, or final identification of the underlying mechanism. ## Scanned_20260730-1946 overlay The exact strings “RT.BUDDY 1 V.2” (PDF page 5) and “RTBUDDY V.2” (PDF page 8) are preserved in the new source. [[Remote Buddy]] is independently identifiable as a legitimate macOS remote-control product, while [[ROOTBUDDY2]] remains unidentified. Their intended relationship to the notebook's RT Buddy terminology is unresolved: they may be separate products or labels, a contrast, versioning, wordplay, conflation, or a private taxonomy. The three records are cross-referenced but are neither merged nor asserted to be unrelated. Owner-supplied identification continues to rest on documented resources observed in logs with [[CrashCapture]] or [[Heimdallr]]. The page alone does not independently prove Pegasus, and heuristic matches alone mean nothing as proof of infection, NSO Group attribution, control, authorship, or the underlying mechanism.