Force remove a system extension

Question

frankfenn OP

Created Apr ’20

Replies 2

Boosts 0

Participants 3

Hello all,

I'm stuck, I have a ES client system extension installed which is misbehaving but not crashing. In its bad state it adds a 30 second delay to each file open call (AUTH_OPEN events) which make the system pretty much unresponsive.

So I try to get rid of this extension, unfortunately with it running (SIP is disable) the system is unresponsive and attempts to use the systemextensionsctl command is impossible. With SIP turned on I can boot and log in normally, but now the systemextensionsctl tools is not available.

Booting in recovery or single user mode I can see the extension in the SystemExtensions folder buit have no permissions to remove it.

help is really appreciated

Frank

Boost

Answer 1

KMT OP

Apr ’20

Is this an extension you made, or are you simply a user?

0

Answer 2

DTS Engineer OP

Apple

Apr ’20

Have you tried target disk mode? When you mount a Mac’s system volume on another machine, it’s generally treated as a normal volume and thus you can override any protections that would otherwise apply.

ps I avoid problems like this by always testing my system extensions on a VM; that way a working system is only a snapshot restore away.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0