[DoctorNick]

little snitch has the ability to MITM and display the contents of transfers. I'd suggest you use it and amend the post with details.

[oneplane]

Not for urlsessions with pinned keys, especially not on AMFI binaries you can't patch if you're not in development mode.

[DoctorNick]

well, sounds like he has his work cut out for him then.

[oneplane]

If he can't do something like "strings /System/Library/PrivateFrameworks/MediaAnalysis.framework/Versions/A/mediaanalysisd" I don't think any actual investigation of the binary or traffic is the first step of learning for him to take...