List All Third Party Kernel Extensions in Mac OS X
If you’re troubleshooting a Mac machine with some particularly odd issues that routine measures don’t seem to be resolving, it can be helpful to list what kernel extensions are activated, particularly third party kexts loaded in OS X.
Determining what kernel extensions are loaded and running in Mac OS X is rather easy, and using grep you can then easily list all third party kexts. You can also use the same command to list native kernel extensions as well. To accomplish this, you’ll use the kextstat command and pipe the output to grep, using the command line. This works the same in all versions of Mac OS X.
How to See All Third Party Kernel Extensions in Mac OS X
The full syntax to see third party kernel extensions is as follows:
kextstat | grep -v com.apple
The output is going to vary depending on what, if any, third party extensions are in the kernel. It may look something like this:
Index Refs Address Size Wired Name (Version) Linked Against
117 0 0xffdddfff8209ff910 0x2000 0x2000 com.radiosilenceapp.nke.PrivateEye (1) 4 1
119 0 0xfffff945818248770 0x3000 0x3000 com.whattheheckisthis.WeirdExtension (1) 5 2
If you see something out of place in that list, that could be a good place to start troubleshooting.
How to List All Kernel Extensions in OS X
Of course you can always list all kernel extensions (meaning, Apple’s official Mac OS X kexts included) by just typing the following command string:
kextstat
The output here is going to be significant, but it can still be valuable.
If you want to learn more about kextstat, just type ‘man kextstat’ to open the man page in the OS X Terminal.
Don’t forget that you can manually inspect the traditional kernel extension system folder location as well if necessary, even moving and removing kext files from there to aid in the process of installing, uninstalling, troubleshooting, or discovery of kernel extensions.
to argue that “most people” don’t need something is not an argument against making it available to those people who do need it. for example, right now my mac won’t finish booting due to a third party extension i’m trying to remove manually (because i can’t even get to the point where i’d run the uninstall gui tool that would be used by “most people”…)
I’m one of those doesn’t believe in extensions that left laying around or added in (obvious reasons, keylogger, etc). It would be better if they were compiled into one module, and not an option, unless chosen by the owner or developer. It would seem the design concept reactive, and not proactive in keeping have both options available.
I have been creating kernel extensions by myself and I have found I can load an extension with com.apple.kext.falsekext as CFBundleIdentifier, and other as com.apple.driver.falsekext as Identifier. When I use kextstat and grep to detect third-party extensions, it is not listed. How can I detect this third party extensions that could affect my system and contains com.apple into his CFBundleIdentifier??
“don’t need this…” poster:
I found that old software I thought I had removed left broken and old kexts in my system. This tool helped me isolate them and remove them.
I bet any user would be well served by an app that searches for kexts that no longer have their associated app in the system, and remove them. Product Idea! You’re welcome…
[…] most people won’t need this application, or have any need to tweak with kext files and kernel extensions. This is usually the realm of deep troubleshooting and Hackintosh installations, but not necessary […]
Thanks to Bill Ellis. Used kextstat to see what was installed and removed the software. My Display Sleep function stopped working with the OS X 10.7 install this morning. Now it works. I removed VirtualBox by its own uninstall program.
[…] came across this little hint over at OSXDaily, a site I visit quite often because of the variety of topics […]