Listing macOS loaded kext paths
The default kextstat
command will display only the names of loaded kernel extensions. However, there are situations when you want to know where is the kernel extension file that contains the kext code. In other words, where in the filesystem is the kext bundle located?
Turns out kextstat
doesn't implement this kind of functionality. It's not that hard to implement it manually though (in C++). You can show paths of a kext bundle by using the KextManagerCopyLoadedKextInfo
function, like this:
#include <cstdio>
#include <IOKit/kext/KextManager.h>
CFStringRef bundleExePath = CFStringCreateWithCString(kCFAllocatorDefault, "OSBundleExecutablePath", kCFStringEncodingASCII);
void enumItems(const void* key, const void* value, void* context) {
CFStringRef keyStr = (CFStringRef) key;
const char* keyString = CFStringGetCStringPtr(keyStr, kCFStringEncodingUTF8);
CFDictionaryRef valueDict = (CFDictionaryRef) value;
CFStringRef path = (CFStringRef) CFDictionaryGetValue(valueDict, bundleExePath);
const char* pathString = "n/a";
if(path) {
pathString = CFStringGetCStringPtr(path, kCFStringEncodingUTF8);
}
printf("%s: %s\n", keyString, pathString);
}
int main() {
CFDictionaryRef kextInfo = KextManagerCopyLoadedKextInfo(nullptr, nullptr);
CFDictionaryApplyFunction(kextInfo, enumItems, nullptr);
return 0;
}
Please be aware that the code above shouldn't be used as production code. It doesn't properly check for valid values, also memory management in this example is nonexistant. For demonstration purposes however it works fine.
You can use this CMakeLists.txt
file to compile this code with CMake:
cmake_minimum_required(VERSION 3.0)
find_library(IOKIT IOKit)
find_library(CF CoreFoundation)
add_executable(modlist modlist.cpp)
target_compile_features(modlist PRIVATE cxx_range_for)
include_directories(${IOKIT} ${CF})
target_link_libraries(modlist ${IOKIT} ${CF})
Here's a sample output of the program:
$ ./modlist
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib: /System/Library/Extensions/AppleFSCompressionTypeZlib.kext/Contents/MacOS/AppleFSCompressionTypeZlib
com.apple.driver.AppleAHCIPort: /System/Library/Extensions/AppleAHCIPort.kext/Contents/MacOS/AppleAHCIPort
com.apple.iokit.IOAHCIBlockStorage: /System/Library/Extensions/IOAHCIFamily.kext/Contents/PlugIns/IOAHCIBlockStorage.kext/Contents/MacOS/IOAHCIBlockStorage
com.apple.iokit.IOUSBUserClient: /System/Library/Extensions/IOUSBFamily.kext/Contents/PlugIns/IOUSBUserClient.kext/Contents/MacOS/IOUSBUserClient
com.apple.driver.AppleSMBusController: /System/Library/Extensions/AppleSMBusController.kext/Contents/MacOS/AppleSMBusController
[...]
No need to install any thirdparty applications for $19,99 ;)