Secure Indicator Light
More actions
SIL is a new mechanism introduced in iOS 17 to draw security indicators on screen, such as the orange dot when the microphone is in use. Supposedly it stands for Secure Indicator Light[1]. The rendering is done by an Exclave applet, talking directly to the display controller. This isolates it from userspace and even the kernel.
It seems to be enabled on all devices that use exclaves (M4 and A18).
In iOS 17 it was only used for the camera and microphone indicators. In iOS 18 it was expanded to also manage the FaceID scanning animation, and the format for indicator images was changed.
Indicators
 | This section is missing information about the image format in iOS 17. |
In iOS 18.x, images used for indicators are present in both the RootFS volume (PrivateFrameworks/SILManager.framework) and in the ExclaveOS volume (Frameworks/SILManagerComponent.framework).
Indicators are bitmap animations. Some have multiple "indicators" in the same set of files: cam_mic has both camera and microphone indicators. Some have a complex state machine for different stages of the animation: FaceID has animations during the face scan and after a successful authentication, and transitions between the two states.
Each indicator group has three files:
- <name>.bin has all the image data for that indicator group.
- <name>.plist describes the indicator(s) in the group, where to find each animation frame in the .bin, and the state graph.
- <name>_constraints.plist seems to describe where on screen the indicator can be shown.
The cam_mic set of files has multiple indicators:
- MicrophoneAccessibility: Orange square, displayed when the microphone is in use and the "differentiate without color" accessibility setting is enabled.
- Microphone: Orange circle, displayed when microphone is in use.
- Camera: Blue circle, displayed when camera is in use.
The FaceID and Lock set of files have a single indicator with multiple "states".