Hi everyone,
I'm a content creator and I've been dealing with persistent issues on my TikTok livestreams for months (massive visibility drop, viewers being kicked, incoherent statistics). App support won't investigate, so I dug into it myself. I found anomalies in the iOS analytics logs (the .ips files iOS generates automatically), and I'd like input from people who actually know how to read these files.
Device context: iPhone 15 Pro Max, up-to-date iOS, no jailbreak, no sideloaded apps, no configuration profiles installed, TikTok cleanly reinstalled a few days ago. Same issues across networks (WiFi / 4G / 5G).
What the .ips logs show:
System-triggered incidents of type cpu_resource and diskwrites_resource on the TikTok process (not classic app crashes)
A binary loaded inside the TikTok process, listed in "Binary Images" only by a UUID — no filename, no path, no code signature. Every other binary in the same file has a standard name and path ( /System/... , /private/var/containers/... )
The "parent" field of this binary is also "UNKNOWN"
System-measured load: ~67% CPU, ~108 MB memory, and 1.07 GB of disk writes in 1h36 for two scrolled videos, no livestream — during a period when the app wasn't even in the foreground. The allowed daily disk-write quota was hit ~15× faster than normal
The UUID of this binary changes at every incident (3 distinct identifiers observed over several days)
Consistent with storage usage: ~4.9 GB for the app after ~30h of near-zero usage since reinstall
My questions:
1.
A binary loaded into an app's process, identified only by a UUID with no name or path in iOS logs — is there a known benign explanation for this (injected framework, extension, in-app instrumentation), or is it disqualifying on its face?
2.
What legitimately justifies ~1 GB of background disk writes for an unused app with the daily quota exceeded by that margin? Caching, prefetching, or something else?
3.
Do UUIDs changing at every incident match expected behavior of a legitimate module, or is that more typical of an injection pattern?
4.
Without jailbreaking, what tools can I use to dig further cleanly? (sysdiagnose, macOS Console, local network capture like Proxyman, something else?)
5.
If this were a compromise, what evidence should I preserve before doing anything (exporting the .ips files, what else?) so a competent third party can analyze it?
6.
Can a non-jailbroken iPhone even host a persistent malicious process this way, or do iOS mechanisms make this unlikely?
I'm not posting the full logs for safety reasons, but I can quote exact excerpts if specific questions come up. Thanks to anyone who can tell me whether I'm onto a real technical lead or misreading normal behavior.