Is there an easy way to make the mapping from kernel extension to the file it came from?
I can get the list of currently loaded kernel extension via kextstat
. This gives me the bundle names, like com.AmbrosiaSW.AudioSupport
or jp.plentycom.driver.SteerMouse
. But how can I then find the actual file locations of these bundles? For example, the Ambrosia bundle is AmbrosiaAudioSupport.kext
, and I can only find the bundle name in the Info.plist
inside that bundle. I could grep the /System/Library/Extensions/
directory, but this does not necessarily contain extensions loaded after booting, and I assume there is a better way to do it?
KextManagerCreateURLForBundleIdentifier
as described in stackoverflow.com/questions/197383/… which gives you the path for a kext no matter where it's loaded from. It's used in objective-see's app objective-see.org/products/kextviewr.html