1 Reply
      Latest reply: Dec 19, 2016 1:49 PM by eskimo RSS
      offlinehacker Level 1 Level 1 (0 points)

        I have created a simple kext mach kernel driver using xcode. I have disable osx integrity protection, checked that permissions are ok, and without linking to any additional simbols, driver loads just fine. The problem is if i am using any symbols like mach_vm_allocate, they do not get resolved and while kextloading driver i see following error from syslog:

         

        kxld[redacted.osxdrv]: The following symbols are unresolved for this kext:
        kxld[redacted.osxdrv]:   _exc_server
        kxld[redacted.osxdrv]:   _mach_msg_overwrite
        kxld[redacted.osxdrv]:   _mach_port_allocate
        kxld[redacted.osxdrv]:   _mach_port_deallocate
        kxld[redacted.osxdrv]:   _mach_port_extract_right
        kxld[redacted.osxdrv]:   _mach_port_insert_right
        kxld[redacted.osxdrv]:   _mach_port_mod_refs
        kxld[redacted.osxdrv]:   _mach_vm_allocate
        kxld[redacted.osxdrv]:   _mach_vm_deallocate
        kxld[redacted.osxdrv]:   _mach_vm_read_overwrite
        kxld[redacted.osxdrv]:   _mach_vm_write
        kxld[redacted.osxdrv]:   _task_info
        kxld[redacted.osxdrv]:   _thread_create
        kxld[redacted.osxdrv]:   _thread_get_state
        kxld[redacted.osxdrv]:   _thread_info
        kxld[redacted.osxdrv]:   _thread_resume
        kxld[redacted.osxdrv]:   _thread_set_exception_ports
        kxld[redacted.osxdrv]:   _thread_set_state
        kxld[redacted.osxdrv]:   _thread_suspend
        Can't load kext redacted.osxdrv - link failed.
        Failed to load executable for kext redacted.osxdrv.
        Kext redacted.osxdrv failed to load (0xdc008016).
        Failed to load kext redacted.osxdrv (error 0xdc008016).
        

         

        I have included libraries to info.plist file, but this does not help:

         

                <key>OSBundleLibraries</key>
                <dict>
                        <key>com.apple.kpi.bsd</key>
                        <string>15.6</string>
                        <key>com.apple.kpi.dsep</key>
                        <string>15.6</string>
                        <key>com.apple.kpi.libkern</key>
                        <string>15.6</string>
                        <key>com.apple.kpi.mach</key>
                        <string>15.6</string>
                        <key>com.apple.kpi.unsupported</key>
                        <string>15.6</string>
                </dict>
        

         

        I am building kext on osx 10.11 with 10.11 SDK and xcode 8.0, i have also checked that build target is for 10.11.

         

        Thanks!

        • Re: Kext unresolved symbols
          eskimo Apple Staff Apple Staff (5,995 points)

          The problem is if i am using any symbols like mach_vm_allocate

          You can use kextlibs to work out what to put in OSBundleLibraries for any given KEXT.  If you create a KEXT that just links with mach_vm_allocate, it will tell you that mach_vm_allocate is not a valid KPI.

          $ kextlibs build/Debug/xxx.kext
          …
          
          For x86_64:
              1 symbol not found in any library kext.
          

          It seems unlikely you’ve come up with all of this Mach goo by yourself.  Presumably you’re compiling some existing source that was intended for the kernel itself, or for a pre-KPI macOS kernel (KPI being new in Mac OS X 10.4 Tiger :-).  You’ll have to adapt it to the brave new world of KPIs, which will be challenging if it’s heavily dependent on Mach messaging.

          Share and Enjoy

          Quinn “The Eskimo!”
          Apple Developer Relations, Developer Technical Support, Core OS/Hardware
          let myEmail = "eskimo" + "1" + "@apple.com"