https://anadoxin.org/blog

Listing macOS loaded kext paths

Wed, 21 September 2016 :: #macos :: #kext

The default kextstat command will display only the names of loaded kernel extensions. However, there are situations when you want to know where is the kernel extension file that contains the kext code. In other words, where in the filesystem is the kext bundle located?

Turns out kextstat doesn't implement this kind of functionality. It's not that hard to implement it manually though (in C++). You can show paths of a kext bundle by using the KextManagerCopyLoadedKextInfo function, like this:

#include <cstdio>
#include <IOKit/kext/KextManager.h>

CFStringRef bundleExePath = CFStringCreateWithCString(kCFAllocatorDefault, "OSBundleExecutablePath", kCFStringEncodingASCII);

void enumItems(const void* key, const void* value, void* context) {
    CFStringRef keyStr = (CFStringRef) key;
    const char* keyString = CFStringGetCStringPtr(keyStr, kCFStringEncodingUTF8);

    CFDictionaryRef valueDict = (CFDictionaryRef) value;
    CFStringRef path = (CFStringRef) CFDictionaryGetValue(valueDict, bundleExePath);
    const char* pathString = "n/a";
    if(path) {
        pathString = CFStringGetCStringPtr(path, kCFStringEncodingUTF8);
    }


    printf("%s: %s\n", keyString, pathString);
}

int main() {
    CFDictionaryRef kextInfo = KextManagerCopyLoadedKextInfo(nullptr, nullptr);
    CFDictionaryApplyFunction(kextInfo, enumItems, nullptr);
    return 0;
}

Please be aware that the code above shouldn't be used as production code. It doesn't properly check for valid values, also memory management in this example is nonexistant. For demonstration purposes however it works fine.

You can use this CMakeLists.txt file to compile this code with CMake:

cmake_minimum_required(VERSION 3.0)
find_library(IOKIT IOKit)
find_library(CF CoreFoundation)
add_executable(modlist modlist.cpp)
target_compile_features(modlist PRIVATE cxx_range_for)
include_directories(${IOKIT} ${CF})
target_link_libraries(modlist ${IOKIT} ${CF})

Here's a sample output of the program:

$ ./modlist
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib: /System/Library/Extensions/AppleFSCompressionTypeZlib.kext/Contents/MacOS/AppleFSCompressionTypeZlib
com.apple.driver.AppleAHCIPort: /System/Library/Extensions/AppleAHCIPort.kext/Contents/MacOS/AppleAHCIPort
com.apple.iokit.IOAHCIBlockStorage: /System/Library/Extensions/IOAHCIFamily.kext/Contents/PlugIns/IOAHCIBlockStorage.kext/Contents/MacOS/IOAHCIBlockStorage
com.apple.iokit.IOUSBUserClient: /System/Library/Extensions/IOUSBFamily.kext/Contents/PlugIns/IOUSBUserClient.kext/Contents/MacOS/IOUSBUserClient
com.apple.driver.AppleSMBusController: /System/Library/Extensions/AppleSMBusController.kext/Contents/MacOS/AppleSMBusController
[...]

No need to install any thirdparty applications for $19,99 ;)