Confused about kernel extensions

Question

Level 1

12 points

Confused about kernel extensions

I've learned two things about kernel extensions from Google searches:

1. Kernel extensions are stored in System/Library/Extensions

2. You can list all Apple extensions with the Terminal command kextstat and all third party extensions with the command kextstat | grep -v com.apple.

But something doesn't add up: the files listed by the kextstat command all begin with "com.apple". No files in System/Library/Extensions begin with "com.apple". In fact, none of the kernel extensions listed by the kextstat command seem to reside in System/Library/Extensions. So where are they?

2010 iMac 27"-OTHER, Mac OS X (10.6.8), 12 GB RAM, ATI Radeon HD 4670

Posted on Apr 30, 2012 6:29 AM

Reply

Answer 1

Apr 30, 2012 6:54 AM in response to Kris Hunt

The kextstat command displays the CFBundleIdentifier of the kernel extension.For example, kextstat shows me an entry with this name: com.apple.driver.XsanFilter (2.7.50) <41 11> I see I also have a file called AppleXsanFilter.kext in extensions. If I Get Info on this, then show package contents and look at the Info.plist file, Property List Editor shows me a line with that CF identifier information.

I also have a lot more kext files than shown in that kextstat command. I only know what I have learned in the last 10 minutes researching this but I suspect those are extensions that are available but have not loaded (maybe because they are for devices I don't have).

Reply

Answer 2

Apr 30, 2012 12:26 PM in response to Kris Hunt

Beyond Linmos explanation, kernel extentions can be found in /System/Library/Extensions/ and /Library/Extensions/

Reply

Answer 3

mitiar

Level 1

0 points

Nov 7, 2013 9:30 AM in response to Mark Jalbert

I have the following result with the terminal command kextstat

Index Refs Address Size Wired Name (Version) <Linked Against>

111 0 0xffffff7f80b71000 0x5000 0x5000 com.Cycling74.driver.Soundflower (1.6.6) <101 5 4 3>

126 0 0xffffff7f820f4000 0x3000 0x3000 com.bresink.driver.BRESINKx86Monitoring (9.0) <5 4 3>

I found the Soundflower driver in /System/Library/Extensions/

But ccould not find the other one BRESINKx86Monitoring anywhere .

where is it hidden?

Reply

Answer 4

Yeehat

Level 1

49 points

Nov 7, 2013 9:48 AM in response to mitiar

mitiar wrote:

But ccould not find the other one BRESINKx86Monitoring anywhere .

where is it hidden?

Check /Library/StartupItems.

http://www.bresink.com/osx/216202/Docs-en/faq.html (the last FAQ)

Even though other users report /System/Library/StartupItems

Reply

Answer 5

mitiar

Level 1

0 points

Nov 8, 2013 2:42 PM in response to Yeehat

thanks,

I found it in /System/Library/StartupItems. In Mavericks, mac air, 2012 model there is no /Library/StartupItems.

Reply

Answer 6

Nov 9, 2013 4:02 AM in response to mitiar

One question: why do you need to locate kernel extensions? They're installed along with the OS and third-party software that needs to access the OS kernel at some point. Messing with them can cause instability, and could even render your machine unusable.

I'm just sayin'...

Reply

Answer 7

mitiar

Level 1

0 points

Nov 10, 2013 9:25 AM in response to FrenchToast

I suspected thirdparty driver BRESINKx86Monitoring casused several kernel panic in my previous OSX 10.8. Though there has been no kernel panic with the newly installed Mavericks so far. But I no longer need the application "temperature monitor" which i think, needed to access the above mentioned extension. So, I got rid of both of them. I was not aware that it was installed along with OSX, and deleteing it can cause sytem instability.

Reply