9

I have a 2014 MacBook Pro experiencing this issue. Catalina does not allow kexts to be deleted via this method. Unless I am able to delete or disable this kext my laptop will shut down randomly. Anyone know how to remove kexts in Catalina?

Improve this question
4
  • Are you trying to modify system kernel extensions so this needs to involve system integrity protection as well as the read only system volume or just removing third party extensions?
    – bmike ♦
    Commented Jun 13, 2020 at 11:38
  • I need to remove the AppleThunderboltNHI.kext because it causes constant crashing of my laptop.
    – alfwhfwef
    Commented Jun 14, 2020 at 16:30
  • 1
    Aah - so you’re disabling parts of the system to work around failing / failed hardware. You might edit this to put the full path to that if you want more answers. If you’re good, no need to edit of course.
    – bmike ♦
    Commented Jun 14, 2020 at 16:48
  • 1
    @bmike: The issue is not failing hardware, it's well-known MacOS breakage since 10.12 with AppleThunderboltNHI.kext on 2014 MBP, which Apple have refused to fix for several years.
    – smci
    Commented Jan 27, 2023 at 2:10

4 Answers 4

Reset to default
11

1. Check for System Integrity Protection (SIP)

Open Terminal and type

csrutil status

if it says

System Integrity Protection status: enabled.

continue to step 2. Else, skip to step 3.

2. Defeat SIP by Rebooting into macOS Recovery mode

  1. Turn off Mac; turn back on while hodling ⌘ and R.
  2. Open Terminal from the Utilities menu.
  3. Type csrutil disable
  4. Reboot (reboot)

3. Unload, then delete kext

In Terminal,

  1. Unload Extension
sudo kextunload /System/Library/Extensions/AppleThunderboltNHI.kext
  1. Delete Extension
sudo mount -rw / # mount root as RW
sudo rm -rf /System/Library/Extensions/AppleThunderboltNHI.kext

4. Re-enable SIP (if turned off)

Follow the steps for 2. except type csrutil enable on step 2.3.

Improve this answer
1
  • 1
    This answer worked for me. SIP was preventing me. My kext was not showing up in the directory listing in recovery mode, so I couldn't rm it from there. This is a great answer.
    – Scot Nery
    Commented Oct 29, 2020 at 17:58
8

For Mac OS Big Sur

  1. Reboot in rescue mode (reboot while "Cmd + R")

  2. Utilities -> Terminal

  3. csrutil disable

  4. csrutil authenticated-root disable

  5. mount -uw /Volumes/[MacOS ]

  6. delete (or rename, or move elsewhere) the AppleThunderboltNHI.kext directory (I've moved all thunderbolt kext directories since I have no needs about this interface, but I think it works only by disabling AppleThunderboltNHI)

cd /Volumes/Macos (Enter WHATEVER YOUR MACOS DRIVE NAME IS, my macOS drive name is Macos)/System/Library/Extensions

rm -rf AppleThunderboltNHI.kext

  1. Remove cache

rm -rf /System/Library/Caches/*

  1. REBUILD the extensions cache ! (new has-to-do in Big Sur...)

kmutil install -u --force --volume-root /Volumes/[MacOS ]

  1. DON'T FORGET to create another system snapshot to take these modifications under account at next reboot

bless --folder /Volumes/[MacOS ]/System/Library/CoreServices --bootefi --create-snapshot

  1. reboot (in rescue mode). This step may be unnecessary, not tested straight to
  2. csrutil enable
  3. Reboot
Improve this answer
3
  • 1
    Thank you. I will try this and see if it works!
    – alfwhfwef
    Commented Dec 4, 2020 at 11:03
  • 2
    Had to reference my root volume as '/Volumes/[Mac OS]\ 1' for some reason. It worked. Thanks!
    – alfwhfwef
    Commented Jan 6, 2021 at 2:54
  • 2
    Unfortunately csrutil authenticated-root disable doesn’t work with FileVault enabled… Will have to disable it somehow maybe in the safe mode. And you cannot enable SSV again once you’ve disabled it.
    – xji
    Commented Jul 2, 2021 at 11:50
2

  1. Open Terminal and enter the following command:

    sudo kextunload /System/Library/Extensions/AppleThunderboltNHI.kext

  2. If that fails to work, you can also just force-delete the kext using

    Use the following Terminal command to remove the kext file:

    sudo rm -rf /System/Library/Extensions/AppleThunderboltNHI.kext

  3. Restart your MAC

Improve this answer
4
  • 6
    RE: 2, i.e, sudo rm -rf /System/Library/Extensions/AppleThunderboltNHI.kext. By default, all this will do is return the error "Operation not permitted" Because in macOS Catalina, by default and aside from any SIP restrictions, the e.g. Macintosh HD is mounted at / as read-only and nothing can be modified on this volume unless one boots to macOS Recovery and then either makes modifications from there, or disables SIP and then reboot and mount / as rw.
    – user3439894
    Commented Oct 16, 2019 at 13:03
  • @user3439894 I tried to mount and perform these actions in Recovery and with SIP disabled. I was still unable to delete the kext.
    – alfwhfwef
    Commented Oct 17, 2019 at 23:53
  • 1
    @user3439894 so how did an app install its kext there?
    – minseong
    Commented Jan 24, 2020 at 22:26
  • @theonlygusti In macOS Catalina, files in /System/Library/Extensions/ are part of the Core.pkg in Install macOS Catalina.app/Contents/SharedSupport/InstallESD.dmg and put there by Apple on a, by default, read-only filesystem (when booted normally).
    – user3439894
    Commented Jan 25, 2020 at 1:43
0

In Terminal, enter sudo mount -rw /. Then run either of the commands:

  1. to rename - cd /Volumes/Macintosh\ HD/System/Library/Extensions ; mv -v AppleThunderboltNHI.kext AppleThunderboltNHI.kext.original
  2. sudo kextunload /System/Library/Extensions/AppleThunderboltNHI.kext
  3. sudo rm -rf /System/Library/Extensions/AppleThunderboltNHI.kext

Thanks to @Udhy and @user3439894 for the tips that led me to the answer. I also found out how to mount and change drive permissions here.

Improve this answer
3
  • 5
    When booted to macOS Recovery the Macintosh HD is not protected and you do not need to disable SIP! Simple boot to macOS Recovery, open Terminal from the Utilities menu and use the following command: rm -r /Volumes/Macintosh\ HD/System/Library/Extensions/AppleThunderboltNHI.kext -- It's gone! Reboot... Done! That said, I would have just renamed it, e.g. : cd /Volumes/Macintosh\ HD/System/Library/Extensions ; mv -v AppleThunderboltNHI.kext AppleThunderboltNHI.kext.original That way, then if need be it can easily be renamed back to AppleThunderboltNHI.kext.
    – user3439894
    Commented Oct 18, 2019 at 1:06
  • 2
    The rigamarole of rebooting to macOS Recovery, disabling SIP, rebooting back to normal mode, doing something (that actually can be done the first time booted to macOS Recovery without disabling SIP), rebooting again the macOS Recovery, enabling SIP, rebooting again back to normal mode it a totally needless dance and a utter waste of time!
    – user3439894
    Commented Oct 18, 2019 at 1:12
  • 4
    @user3439894 you should've posted that as an answer rather than a comment.
    – alfwhfwef
    Commented Oct 18, 2019 at 21:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .