Skip to content

Instantly share code, notes, and snippets.

@joaocc
Created October 29, 2021 12:28
Show Gist options
  • Save joaocc/3ca400e0750556597dc86fe1f341d123 to your computer and use it in GitHub Desktop.
Save joaocc/3ca400e0750556597dc86fe1f341d123 to your computer and use it in GitHub Desktop.
Removing Auxiliary kexts in macOS bigSur+
# USE WITH CARE... NO WARRANTIES!!!
# THESE ARE NOTES ON HOW TO CLEANUP OR REMOVE SOME KEXTS
# AS A MATTER OF FACT, YOUR SYSTEM MAY START MALFUNCTIONING
# IF YOU DO FOLLOW THIS WITHOUT UNDERSTANDING WHAT YOU ARE DOING
(after the disclaimer, just some notes for my future reference)
(glad if they help you, but taking no responsibility)
this came across as the need to cleanup some Auxiliary Kernel Collection (AuxKC)
* com.samsung.portablessd.driver
* com.samsung.portablessd.driverX
* net.lundman.zfs/fq
* io.macfuse.filesystems.macfuse
Reference info
• https://support.apple.com/en-gb/guide/security/sec8e454101b/web
• https://eclecticlight.co/2021/07/07/extensions-are-moving-away-from-the-kernel/
The following shows some in AuxKC heading
```
sudo kmutil dumpstate
```
Places to remove from:
* /private/var/db/KernelExtensionManagement/AuxKC
* /private/var/db/KernelExtensionManagement/AuxKC/StashedExtensions
* /Library/Extensions/SamsungPortableSSDDriver.kext
* /Library/Extensions/SamsungPortableSSDDriverX.kext
* /Library/Filesystems/macfuse.fs
* /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kex
* /Library/Extensions/zfs.kext
* ~/Library/Preferences/com.samsung.portablessd.software.plist
* ~/Library/LaunchAgents/com.samsung.portablessd.mon.plist
* ~/Library/Application\ Support/PortableSSD
* ~/Library/Saved\ Application\ State/com.samsung.portablessd.software.savedState
Locations to edit
```
cd /private/var/db/KernelExtensionManagement/AuxKC/CurrentAuxKC
sudo nano \
./com.apple.kcgen.instructions.plist \
./com.apple.kcgen.uakl.plist
sudo sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy
select * from kext_policy;
select * from kext_policy_mdm;
select * from kext_load_history_v3;
delete from kext_policy where path like "%MYEXT%";
delete from kext_policy_mdm where path like "%MYEXT%";
delete from kext_load_history_v3 where path like "%MYEXT%";
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment