How to Load & Unload Kernel Extensions in Mac OS X
Kernel extensions, called kext for short, are modules of code that are loaded directly into the kernel space of Mac OS X, able to run at a low-level to perform a variety of tasks. Most kexts are part of the core Mac OS X system software, typically hardware device drivers, but some third party apps will install a kext as well.
Sometimes, advanced Mac users and systems administrators may need to manually load or unload a kernel extension. Because kernel extensions are often critical components of MacOS, this is only appropriate for users who have a specific reason to be modifying whether a kext is loaded or unloaded into the MacOS X kernel space. Inappropriate modification of kext behavior can render Mac hardware useless or inaccessible, and can also prevent Mac OS X from functioning at all, so do not attempt to change any kernel extension without a compelling reason and understanding of what it’s usage is.
Loading a Kernel Extension in Mac OS X with kextload
To load a kernel extension into Mac OS X, you’ll need to use the command line kextload utility. The syntax is otherwise simple enough, requiring sudo for administrative access to perform the action:
sudo kextload /path/to/kext.kext
You can also use the bundle identifier (which are frequently the targets of defaults commands) with the -b flag:
sudo kextload -b com.apple.driver.ExampleBundle
Either way, hit return and with the entry of the administrator password the kernel extension will be loaded into Mac OS X.
You can confirm a kernel has been loaded by listing it with kextstat, using grep to search for the given name like so:
$ kextstat |grep com.apple.driver.ExampleBundle
125 0 0xdddddd7f23351040 0x5000 0x5000 com.apple.driver.ExampleBundle (1) 12 8 7 5 4 2 1
This can be helpful after manually installing a kernel extension into Mac OS X as in some situations it will prevent the need for rebooting the Mac.
Modern versions of Mac OS X also allow kernel extension loading to be completed with the kextutil command, which is a bit more full featured for debugging reasons, but is otherwise the same for loading a kext.
Unloading a Kernel Extension with kextunload
Unloading a kernel extension from Mac OS X is basically the exact same as loading a kext, except you’ll use the kextunload utility with sudo as follows:
sudo kextunload -b com.apple.driver.ExampleBundle
Or by pointing directly to the kernel extensions path:
sudo kextunload /System/Library/Extensions/ThirdPartyMystery.kext
Again, you can confirm the kernel extension has been unloaded by using kextstat and grep, where it should return nothing.
i tried loading but it gives an error
failed to load – (libkern/kext) requested architecture/executable not found; check the system/kernel logs for errors or try kextutil(8).
Hallo ,
öffne ein Terminal und tippe ein:
sudo spctl kext-consent –add VB5E2TV963
sudo spctl kext-consent –enable VB5E2TV963
damit wird die Virtual Box kernel extension zugelassen und
nach dem Reboot kann VB genutzt werden.
VG
HMaiser
I found the answer to my question using ‘man kextfind’. I am posting this in case anyone ever has the same question after unloading a kext.
The command ‘sudo kextfind -not -loaded’ will show all unloaded kexts.
The command ‘sudo kextfind -report -b -loaded’ will list all kexts and a Yes/No column saying whether or not each kext is loaded. Replace or add ‘-print’ with the ‘-b’ option to display the path location for each kext.
Hopefully a simple question. Once you unload a kext, how do you run a query to list all kexts that are available but unloaded?
Hopefully a simple question. What happens when you unload the kext? I am thinking the associated file remains on the system. If so, how do I run a query to find all kexts that are unloaded?
mochte gerne virtuelbox auf mein mac installieren, bekomme ich aber folgendes Problem…
Kernel driver not installed (rc=-1908)
Make sure the kernel module has been loaded successfully.
where: suplibOsInit what: 3 VERR_VM_DRIVER_NOT_INSTALLED (-1908) – The support driver is not installed. On linux, open returned ENOENT.
wie und was soll ich noch installieren? vielen dank im voraus..
Hi there, how are you? Can someone please take a look and comment at this topic of mine? I can’t recover from this… I deleted a kext and the Mac won’t boot now.
Best regards.
Hi Jota,
If you deleted kext and now it won’t boot… well you need to fix the system software. In this case; You must reinstall Mac OS if you deleted a kext file and the system will not boot any longer. In the future, never delete a kext file. Kernel extensions are required by Mac OS to work properly. The only kext files that can be removed safely are from third parties and even then they can break the app they are related to.
Kernel extension modification is for advanced users, best to avoid if you are not fluent in their specifics. It is not a big deal, but it is complex and so that is why it is best to avoid. Never touch them.
I would reinstall Mac OS, that will fix your problem. You can reinstall system software without formatting the Mac.
You can reinstall Mac OS X from the Recovery mode:
https://osxdaily.com/2016/02/09/howto-reinstall-os-x-mac-recovery/
You can reinstall macOS High Sierra and Sierra from Recovery too:
https://osxdaily.com/2016/10/12/reinstall-macos-sierra/
I typed:
Sudo kextunload iousbmassstorageclass.kext
It reverts with:
Sudo: unable to stat /etc/sudoers: permission denied
Sudo: no valid sudoers sources found, quitting
Please help.
My Mac os x is not rebooting. I read somewhere that uninstalling kext files will help. Now it won’t uninstall.
Uhm, you read wrong. Kernel extensions are an essential piece of Mac OS. That’d be like trying to start a car without an engine. And likewise if you aren’t a mechanic are you going to start yanking hoses and undoing screws in your car? Come on, think about it.
If you do not know what you are doing you should never mess around with kernel extensions, it’s no wonder you Mac isn’t rebooting. You might need to reinstall Mac OS.
No need to be a jerk about it. We’re all here to learn.
Make sure your account has Administrators permission before doing that or sudo wont let you pass. If that doesnt work, I’d take your mac in to a genius bar or mac repair shop.
You should *never* remove an apple kext. However there is a way to get a list of NON apple ones;-
kextstat | grep -v com.app
will list all non apple kexts. Try unloading those, and ONLY those, or bad mojo will befall you. I’m an IT engineer of 20+ years and even I wont touch those apple kexts. Its a recipe for sad times.
Hello,
When attempting to unload a kernel I am getting a error:
sudo kextunload /System/Library/Extensions/AppleUSBTopCase.kext/Contents/PlugIns/AppleUSBTCKeyboard.kext
(kernel) Kext com.apple.driver.AppleUSBTCKeyboard not found for unload request.
Failed to unload com.apple.driver.AppleUSBTCKeyboard – (libkern/kext) not found.
I am running mac os 10.10.5 (Yosemite)
Does anyone know how to fix this?
Thank you all very much in advance!
List your kexts and make sure you are picking one that exists, it says it can not find the kext you are trying to unload.
Could this be how a virus is loaded on a Mac
If you don’t know what a kernel extension is or why you would load it, you should not load it. This is for advanced users, don’t load random kernel extensions ever, there is no reason to without a reason.
Good to know. Can unload webcam etc this way.
I don’t load kernel extensions much, but I’ve seen plenty of poorly configured installers that want to quit the 15+ apps I’ve got busy doing other things.
Thanks for the info.
Do you know how to unload the kext for Thunderbolt? There are attacks that can be done if someone has physical access to the thunderbolt (or firewire) port, because those have direct access to main memory. I believe someone could theoretically obtain the filevault2 encryption key this way.
I rarely use the thunderbolt connection, so I would like to disable it for daily use and only enable it when I need it.
i have experience with someone doing just that.
bluetooth is just as bad.
and firewire