How To: List Kernel Extensions with kextstat
macOS has a very flexible and striving kernel modules ecosystem. There are so many granularities for integrating with OS kernel that modules are called extensions. Many third party software packages install their own kernel extensions in macOS.
List Kernel Extensions in macOS
Here’s how many kernel extensions my MacBook with macOS Catalina runs:
greys@MacBook-Pro:~ $ kextstat
Index Refs Address Size Wired Name (Version) UUID
1 141 0xffffff7f80c3e000 0xc340 0xc340 com.apple.kpi.bsd (19.0.0) 4138A7E1-7AAC-46CC-A40D-B3CD34D42A0F
2 12 0xffffff7f8106f000 0x5d00 0x5d00 com.apple.kpi.dsep (19.0.0) 28FFE9F3-6AA9-4B45-8083-5E1F8339A1B7
3 171 0xffffff7f80c07000 0x25750 0x25750 com.apple.kpi.iokit (19.0.0) F32F3E6F-CA35-474E-A19D-DA902B7DF058
4 0 0xffffff7f84153000 0x57e0 0x57e0 com.apple.kpi.kasan (19.0.0) D8CD3720-E2FA-4653-9782-75A7A305A795
5 177 0xffffff7f80c2d000 0x10070 0x10070 com.apple.kpi.libkern (19.0.0) EF0ABB46-BDD6-43F7-BA12-94619B2FC0D8
6 158 0xffffff7f80c00000 0x62e0 0x62e0 com.apple.kpi.mach (19.0.0) AE30D5D8-CC3C-491C-804D-297CD2CDE62A
7 88 0xffffff7f80c54000 0x104c0 0x104c0 com.apple.kpi.private (19.0.0) 1F6F48E4-F657-406A-B278-F6D4E2175FD3
8 100 0xffffff7f80c4b000 0x8200 0x8200 com.apple.kpi.unsupported (19.0.0) 5C7AA78C-E5AD-4D6A-97F5-42F9B3766819
9 2 0xffffff7f80db9000 0x10000 0x10000 com.apple.kec.Libm (1) 9946AE67-6E42-30DF-8E4D-BA58C59B961E <5>
10 11 0xffffff7f81699000 0xd8000 0xd8000 com.apple.kec.corecrypto (1.0) 827A0D77-211B-330E-8C84-A0DE01F13426 <8 7 6 5 3 1>
...
233 1 0xffffff7f85713000 0x6000 0x6000 com.apple.driver.usb.serial (6.0.0) 57547DE4-80AD-3418-B964-2D6370E3C92A <102 28 6 5 3 1>
234 0 0xffffff7f85719000 0x8000 0x8000 com.apple.driver.usb.cdc.acm (5.0.0) A5C845ED-E909-3B4A-8C20-F4013C9AA466 <233 107 106 105 102 28 6 5 3 1>
greys@MacBook-Pro:~ $ kextstat | wc -l
186
Show Third Party Kernel Extensions
It is so common for software to be installing kernel extensions in macOS, that some extensions stay running long after you stop using the software that brought them. Whether extensions stay or not highly depends on how you removed or upgraded the software (most installers are pretty good at tidying up).
If you exclude extensions starting with com.apple, you can see the third party ones:
greys@MacBook-Pro:~ $ kextstat | grep -v com.apple
Index Refs Address Size Wired Name (Version) UUID
17 0 0xffffff7f81075000 0xc000 0xc000 com.fsecure.XFENCE (1.8.88) 83DEF05D-E416-322C-871A-55308708CB27 <8 6 5 3 2 1>
95 0 0xffffff7f810b0000 0x185000 0x185000 at.obdev.nke.LittleSnitch (5430) 7462BC7A-1330-3F92-A73F-3FBFE331C74A <8 6 5 3 1>
139 0 0xffffff7f813b1000 0x6000 0x6000 com.acronis.fileprotector (1.5) F74F91DC-0D15-3880-B60A-81070629A1D5 <29 8 6 5 3 1>
166 0 0xffffff7f8148f000 0x6000 0x6000 com.valvesoftware.SteamInput (3083.39.62) DED4413E-CD8E-3E56-B0AB-7B3B20ECE4BF <50 6 5 3>
167 0 0xffffff7f8145e000 0x1e000 0x1e000 com.kaspersky.kext.klif (3.6.15a14) 86F2DE0E-8DBE-3DEA-B091-7E459F9739B9 <29 6 5 3 1>
168 0 0xffffff7f8144c000 0xc000 0xc000 com.kairos.driver.DuetDisplay (1) 7620686C-E9CE-3C70-AA12-DC77DABA52DD <117 6 5 3>
170 0 0xffffff7f812fb000 0x7000 0x7000 org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600 (4.6.0) D92AF3AB-DDF6-3B68-B481-7297ABD9F291 <50 6 5 3 1>
171 0 0xffffff7f80ff6000 0x5c000 0x5c000 com.kaspersky.nke (2.4.7a10) 5BA7A711-DA4B-3557-83EE-FABA43B43968 <19 8 6 5 3 1>
172 0 0xffffff7f80ebc000 0x7000 0x7000 com.AmbrosiaSW.AudioSupport (4.1.4) no UUID <115 6 5 3 1>
173 0 0xffffff7f80dac000 0x5000 0x5000 com.techsmith.TACC (1.0.3) 851BEDD1-1D12-3756-A948-978610078DEF <6 5 3>
188 0 0xffffff7f855b6000 0x5000 0x5000 org.pqrs.driver.Karabiner.VirtualHIDDevice.v061000 (6.10.0) 4D004D1A-ED2F-3780-AD53-A10F286EC759 <50 6 5 3 1>
greys@MacBook-Pro:~ $
This has been a useful exercise, cause I already see how some kexts are no longer needed – I’ll find out how to safely remove them and will create another post on Unix Tutorial later.
See Also
macOS has a very flexible and striving kernel modules ecosystem. There are so many granularities for integrating with OS kernel that modules are called extensions. Many third party software packages install their own kernel extensions in macOS.
List Kernel Extensions in macOS
Here’s how many kernel extensions my MacBook with macOS Catalina runs:
greys@MacBook-Pro:~ $ kextstat
Index Refs Address Size Wired Name (Version) UUID
1 141 0xffffff7f80c3e000 0xc340 0xc340 com.apple.kpi.bsd (19.0.0) 4138A7E1-7AAC-46CC-A40D-B3CD34D42A0F
2 12 0xffffff7f8106f000 0x5d00 0x5d00 com.apple.kpi.dsep (19.0.0) 28FFE9F3-6AA9-4B45-8083-5E1F8339A1B7
3 171 0xffffff7f80c07000 0x25750 0x25750 com.apple.kpi.iokit (19.0.0) F32F3E6F-CA35-474E-A19D-DA902B7DF058
4 0 0xffffff7f84153000 0x57e0 0x57e0 com.apple.kpi.kasan (19.0.0) D8CD3720-E2FA-4653-9782-75A7A305A795
5 177 0xffffff7f80c2d000 0x10070 0x10070 com.apple.kpi.libkern (19.0.0) EF0ABB46-BDD6-43F7-BA12-94619B2FC0D8
6 158 0xffffff7f80c00000 0x62e0 0x62e0 com.apple.kpi.mach (19.0.0) AE30D5D8-CC3C-491C-804D-297CD2CDE62A
7 88 0xffffff7f80c54000 0x104c0 0x104c0 com.apple.kpi.private (19.0.0) 1F6F48E4-F657-406A-B278-F6D4E2175FD3
8 100 0xffffff7f80c4b000 0x8200 0x8200 com.apple.kpi.unsupported (19.0.0) 5C7AA78C-E5AD-4D6A-97F5-42F9B3766819
9 2 0xffffff7f80db9000 0x10000 0x10000 com.apple.kec.Libm (1) 9946AE67-6E42-30DF-8E4D-BA58C59B961E <5>
10 11 0xffffff7f81699000 0xd8000 0xd8000 com.apple.kec.corecrypto (1.0) 827A0D77-211B-330E-8C84-A0DE01F13426 <8 7 6 5 3 1>
...
233 1 0xffffff7f85713000 0x6000 0x6000 com.apple.driver.usb.serial (6.0.0) 57547DE4-80AD-3418-B964-2D6370E3C92A <102 28 6 5 3 1>
234 0 0xffffff7f85719000 0x8000 0x8000 com.apple.driver.usb.cdc.acm (5.0.0) A5C845ED-E909-3B4A-8C20-F4013C9AA466 <233 107 106 105 102 28 6 5 3 1>greys@MacBook-Pro:~ $ kextstat | wc -l
186Show Third Party Kernel Extensions
It is so common for software to be installing kernel extensions in macOS, that some extensions stay running long after you stop using the software that brought them. Whether extensions stay or not highly depends on how you removed or upgraded the software (most installers are pretty good at tidying up).
If you exclude extensions starting with com.apple, you can see the third party ones:
greys@MacBook-Pro:~ $ kextstat | grep -v com.apple
Index Refs Address Size Wired Name (Version) UUID
17 0 0xffffff7f81075000 0xc000 0xc000 com.fsecure.XFENCE (1.8.88) 83DEF05D-E416-322C-871A-55308708CB27 <8 6 5 3 2 1>
95 0 0xffffff7f810b0000 0x185000 0x185000 at.obdev.nke.LittleSnitch (5430) 7462BC7A-1330-3F92-A73F-3FBFE331C74A <8 6 5 3 1>
139 0 0xffffff7f813b1000 0x6000 0x6000 com.acronis.fileprotector (1.5) F74F91DC-0D15-3880-B60A-81070629A1D5 <29 8 6 5 3 1>
166 0 0xffffff7f8148f000 0x6000 0x6000 com.valvesoftware.SteamInput (3083.39.62) DED4413E-CD8E-3E56-B0AB-7B3B20ECE4BF <50 6 5 3>
167 0 0xffffff7f8145e000 0x1e000 0x1e000 com.kaspersky.kext.klif (3.6.15a14) 86F2DE0E-8DBE-3DEA-B091-7E459F9739B9 <29 6 5 3 1>
168 0 0xffffff7f8144c000 0xc000 0xc000 com.kairos.driver.DuetDisplay (1) 7620686C-E9CE-3C70-AA12-DC77DABA52DD <117 6 5 3>
170 0 0xffffff7f812fb000 0x7000 0x7000 org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600 (4.6.0) D92AF3AB-DDF6-3B68-B481-7297ABD9F291 <50 6 5 3 1>
171 0 0xffffff7f80ff6000 0x5c000 0x5c000 com.kaspersky.nke (2.4.7a10) 5BA7A711-DA4B-3557-83EE-FABA43B43968 <19 8 6 5 3 1>
172 0 0xffffff7f80ebc000 0x7000 0x7000 com.AmbrosiaSW.AudioSupport (4.1.4) no UUID <115 6 5 3 1>
173 0 0xffffff7f80dac000 0x5000 0x5000 com.techsmith.TACC (1.0.3) 851BEDD1-1D12-3756-A948-978610078DEF <6 5 3>
188 0 0xffffff7f855b6000 0x5000 0x5000 org.pqrs.driver.Karabiner.VirtualHIDDevice.v061000 (6.10.0) 4D004D1A-ED2F-3780-AD53-A10F286EC759 <50 6 5 3 1>
greys@MacBook-Pro:~ $This has been a useful exercise, cause I already see how some kexts are no longer needed – I’ll find out how to safely remove them and will create another post on Unix Tutorial later.
