How to Load & Unload Kernel Extensions in OS X

Jun 24, 2015 - 9 Comments

Terminal in OS X Kernel extensions, called kext for short, are modules of code that are loaded directly into the kernel space of OS X, able to run at a low-level to perform a variety of tasks. Most kexts are part of the core Mac OS X system software, typically hardware device drivers, but some third party apps will install a kext as well.

Sometimes, advanced Mac users and systems administrators may need to manually load or unload a kernel extension. Because kernel extensions are often critical components of OS X, this is only appropriate for users who have a specific reason to be modifying whether a kext is loaded or unloaded into the OS X kernel space. Inappropriate modification of kext behavior can render Mac hardware useless or inaccessible, and can also prevent OS X from functioning at all, so do not attempt to change any kernel extension without a compelling reason and understanding of what it’s usage is.

Loading a Kernel Extension in OS X with kextload

To load a kernel extension into OS X, you’ll need to use the command line kextload utility. The syntax is otherwise simple enough, requiring sudo for administrative access to perform the action:

sudo kextload /path/to/kext.kext

You can also use the bundle identifier (which are frequently the targets of defaults commands) with the -b flag:

sudo kextload -b com.apple.driver.ExampleBundle

Either way, hit return and with the entry of the administrator password the kernel extension will be loaded into OS X.

You can confirm a kernel has been loaded by listing it with kextstat, using grep to search for the given name like so:

$ kextstat |grep com.apple.driver.ExampleBundle
125 0 0xdddddd7f23351040 0x5000 0x5000 com.apple.driver.ExampleBundle (1) 12 8 7 5 4 2 1

This can be helpful after manually installing a kernel extension into OS X as in some situations it will prevent the need for rebooting the Mac.

Modern versions of Mac OS X also allow kernel extension loading to be completed with the kextutil command, which is a bit more full featured for debugging reasons, but is otherwise the same for loading a kext.

Loading and unloading kernel extensions in Mac OS X

Unloading a Kernel Extension with kextunload

Unloading a kernel extension from OS X is basically the exact same as loading a kext, except you’ll use the kextunload utility with sudo as follows:

sudo kextunload -b com.apple.driver.ExampleBundle

Or by pointing directly to the kernel extensions path:

sudo kextunload /System/Library/Extensions/ThirdPartyMystery.kext

Again, you can confirm the kernel extension has been unloaded by using kextstat and grep, where it should return nothing.

Enjoy this tip? Subscribe to the OSXDaily newsletter to get more of our great Apple tips, tricks, and important news delivered to your inbox! Enter your email address below:

Related articles:

Posted by: Paul Horowitz in Command Line, Mac OS X, Tips & Tricks

9 Comments

» Comments RSS Feed

  1. yyzguy says:

    Thanks for the info.

    Do you know how to unload the kext for Thunderbolt? There are attacks that can be done if someone has physical access to the thunderbolt (or firewire) port, because those have direct access to main memory. I believe someone could theoretically obtain the filevault2 encryption key this way.

    I rarely use the thunderbolt connection, so I would like to disable it for daily use and only enable it when I need it.

  2. Inderjeet says:

    I don’t load kernel extensions much, but I’ve seen plenty of poorly configured installers that want to quit the 15+ apps I’ve got busy doing other things.

  3. kazuba says:

    Good to know. Can unload webcam etc this way.

  4. Milton says:

    Could this be how a virus is loaded on a Mac

    • int says:

      If you don’t know what a kernel extension is or why you would load it, you should not load it. This is for advanced users, don’t load random kernel extensions ever, there is no reason to without a reason.

  5. Thomas says:

    Hello,

    When attempting to unload a kernel I am getting a error:

    sudo kextunload /System/Library/Extensions/AppleUSBTopCase.kext/Contents/PlugIns/AppleUSBTCKeyboard.kext
    (kernel) Kext com.apple.driver.AppleUSBTCKeyboard not found for unload request.
    Failed to unload com.apple.driver.AppleUSBTCKeyboard – (libkern/kext) not found.

    I am running mac os 10.10.5 (Yosemite)

    Does anyone know how to fix this?

    Thank you all very much in advance!

    • Canfui says:

      List your kexts and make sure you are picking one that exists, it says it can not find the kext you are trying to unload.

  6. Sheel says:

    I typed:

    Sudo kextunload iousbmassstorageclass.kext

    It reverts with:
    Sudo: unable to stat /etc/sudoers: permission denied
    Sudo: no valid sudoers sources found, quitting

    Please help.

    My Mac os x is not rebooting. I read somewhere that uninstalling kext files will help. Now it won’t uninstall.

    • omruk says:

      Uhm, you read wrong. Kernel extensions are an essential piece of Mac OS. That’d be like trying to start a car without an engine. And likewise if you aren’t a mechanic are you going to start yanking hoses and undoing screws in your car? Come on, think about it.

      If you do not know what you are doing you should never mess around with kernel extensions, it’s no wonder you Mac isn’t rebooting. You might need to reinstall Mac OS.

Leave a Reply

 

Shop for Apple & Mac Deals on Amazon.com

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates