Script to display kernel extensions on Mac

Kernel Extensions (kexts) are drivers that allow the Mac OS X kernel to communicate with hardware devices. Kext files are usually stored in the “/System/Library/Extensions” directory on your Mac’s startup disk, although third-party kexts can be located in other directories as well. Kexts are important for Mac administrators because it allows them to manage and monitor the devices connected to the Mac, including their drivers. By fetching kext details from Mac devices, administrators can ensure that all devices are working properly and identify any potential issues before they become critical. Hexnode’s Execute Custom Script feature lets you remotely fetch all kernel extensions on your Mac devices.

Scripting Language – Bash

File extension – .sh

Fetch loaded kernel extensions

1. Get the details of all loaded kernel extensions using the ‘kextstat’ command:

2. Execute the following script to get the details of a particular loaded kernel extension using its bundle ID:

For example, to display the details of the com.apple.kpi.bsd kext, you can run the following command.

kextstat | grep com.apple.kpi.bsd

3. Get a list of all third-party kernel extensions loaded on the device using the script:

Load a Kernel extension

To load a kernel extension, use the script:

For example, to load the kext /System/Library/Extensions/FakeSMC.kext, run the following command.

sudo kextload /System/Library/Extensions/FakeSMC.kext

Unload a Kernel extension

1. To unload a kernel extension, use the script:

For example, to unload the kext “/System/Library/Extensions/FakeSMC.kext”, run the following command.

sudo kextunload /System/Library/Extensions/FakeSMC.kext

2. To unload a kernel extension using its bundle ID, use the script:

For example, to unload the kext com.apple.driver.FakeSMC.kext, run the following command.

sudo kextunload -b com.apple.driver.FakeSMC.kext

Find kernel extensions

To find kernel extensions using their bundle ID, execute the following script:

The “-b” option in the command stands for “bundle identifier.” The bundle identifier is a unique identifier assigned to a macOS application or component, including kernel extensions (kexts), to distinguish it from other components of the system.

For example, to find the “com.apple.driver.AppleHDA kext”, use the following command.

kextfind -b com.apple.driver.AppleHDA