# Script to display kernel extensions on Mac

Kernel Extensions (kexts) are drivers that allow the Mac OS X kernel to communicate with hardware devices. Kext files are usually stored in the “/System/Library/Extensions” directory on your Mac’s startup disk, although third-party kexts can be located in other directories as well. Kexts are important for Mac administrators because it allows them to manage and monitor the devices connected to the Mac, including their drivers. By fetching kext details from Mac devices, administrators can ensure that all devices are working properly and identify any potential issues before they become critical. Hexnode’s [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/how-to-run-scripts-on-mac-using-hexnode-mdm/) feature lets you remotely fetch all kernel extensions on your Mac devices.

Scripting Language – Bash

File extension – .sh

 Disclaimer: 
The sample scripts provided below are adapted from third-party open-source sites.

 

Fetch loaded kernel extensions
------------------------------

1\. Get the details of all loaded kernel extensions using the ‘kextstat’ command:

Script to display details of all kext

kextstat

   1

  kextstat

   

 

  

2\. Execute the following script to get the details of a particular loaded kernel extension using its bundle ID:

Script to display details of a particular kext

kextstat | grep 'Bundle ID' 

   1

  kextstat | grep 'Bundle ID' 

   

 

  

For example, to display the details of the com.apple.kpi.bsd kext, you can run the following command.

`kextstat | grep com.apple.kpi.bsd`

3\. Get a list of all third-party kernel extensions loaded on the device using the script:

Script to get list of all third-party kexts

kextstat | grep -v com.apple 

   1

  kextstat | grep -v com.apple 

   

 

  

Load a Kernel extension
-----------------------

To load a kernel extension, use the script:

Script to load a kernel extension

sudo kextload /System/Library/Extensions/'kextname'.kext 

   1

  sudo kextload /System/Library/Extensions/'kextname'.kext 

   

 

  

For example, to load the kext /System/Library/Extensions/FakeSMC.kext, run the following command.

`sudo kextload /System/Library/Extensions/FakeSMC.kext`

Unload a Kernel extension
-------------------------

1\. To unload a kernel extension, use the script:

Script to unload a kernel extension

sudo kextunload /System/Library/Extensions/'kextname'.kext 

   1

  sudo kextunload /System/Library/Extensions/'kextname'.kext 

   

 

  

For example, to unload the kext “/System/Library/Extensions/FakeSMC.kext”, run the following command.

`sudo kextunload /System/Library/Extensions/FakeSMC.kext `

2\. To unload a kernel extension using its bundle ID, use the script:

Script to unload a kernel extension

sudo kextunload -b 'bundle ID'

   1

  sudo kextunload -b 'bundle ID'

   

 

  

For example, to unload the kext com.apple.driver.FakeSMC.kext, run the following command.

`sudo kextunload -b com.apple.driver.FakeSMC.kext`

 Notes: 
The “kextunload” command can be used to unload both third-party and Apple-provided kernel extensions. However, unloading Apple-provided kernel extensions is generally not recommended, as it can cause stability issues.

 

Find kernel extensions
----------------------

To find kernel extensions using their bundle ID, execute the following script:

Script to find kexts

kextfind -b 'Bundle ID'

   1

  kextfind -b 'Bundle ID'

   

 

  

The “-b” option in the command stands for “bundle identifier.” The bundle identifier is a unique identifier assigned to a macOS application or component, including kernel extensions (kexts), to distinguish it from other components of the system.

For example, to find the “com.apple.driver.AppleHDA kext”, use the following command.

`kextfind -b com.apple.driver.AppleHDA`

 Notes:- It is recommended to manually validate the script execution on a system before executing the action in bulk.
- Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.