Kext unresolved symbols

I have created a simple kext mach kernel driver using xcode. I have disable osx integrity protection, checked that permissions are ok, and without linking to any additional simbols, driver loads just fine. The problem is if i am using any symbols like mach_vm_allocate, they do not get resolved and while kextloading driver i see following error from syslog:


kxld[redacted.osxdrv]: The following symbols are unresolved for this kext:
kxld[redacted.osxdrv]:   _exc_server
kxld[redacted.osxdrv]:   _mach_msg_overwrite
kxld[redacted.osxdrv]:   _mach_port_allocate
kxld[redacted.osxdrv]:   _mach_port_deallocate
kxld[redacted.osxdrv]:   _mach_port_extract_right
kxld[redacted.osxdrv]:   _mach_port_insert_right
kxld[redacted.osxdrv]:   _mach_port_mod_refs
kxld[redacted.osxdrv]:   _mach_vm_allocate
kxld[redacted.osxdrv]:   _mach_vm_deallocate
kxld[redacted.osxdrv]:   _mach_vm_read_overwrite
kxld[redacted.osxdrv]:   _mach_vm_write
kxld[redacted.osxdrv]:   _task_info
kxld[redacted.osxdrv]:   _thread_create
kxld[redacted.osxdrv]:   _thread_get_state
kxld[redacted.osxdrv]:   _thread_info
kxld[redacted.osxdrv]:   _thread_resume
kxld[redacted.osxdrv]:   _thread_set_exception_ports
kxld[redacted.osxdrv]:   _thread_set_state
kxld[redacted.osxdrv]:   _thread_suspend
Can't load kext redacted.osxdrv - link failed.
Failed to load executable for kext redacted.osxdrv.
Kext redacted.osxdrv failed to load (0xdc008016).
Failed to load kext redacted.osxdrv (error 0xdc008016).


I have included libraries to info.plist file, but this does not help:


        <key>OSBundleLibraries</key>
        <dict>
                <key>com.apple.kpi.bsd</key>
                <string>15.6</string>
                <key>com.apple.kpi.dsep</key>
                <string>15.6</string>
                <key>com.apple.kpi.libkern</key>
                <string>15.6</string>
                <key>com.apple.kpi.mach</key>
                <string>15.6</string>
                <key>com.apple.kpi.unsupported</key>
                <string>15.6</string>
        </dict>


I am building kext on osx 10.11 with 10.11 SDK and xcode 8.0, i have also checked that build target is for 10.11.


Thanks!

Up vote post of offlinehacker Down vote post of offlinehacker
3.6k views
Posted by
offlinehacker
Reply
Add a Comment

Replies

The problem is if i am using any symbols like 

mach_vm_allocate
…

You can use 

kextlibs
to work out what to put in 
OSBundleLibraries
for any given KEXT. If you create a KEXT that just links with 
mach_vm_allocate
, it will tell you that 
mach_vm_allocate
is not a valid KPI. 
$ kextlibs build/Debug/***.kext
…

For x86_64:
    1 symbol not found in any library kext.

It seems unlikely you’ve come up with all of this Mach goo by yourself. Presumably you’re compiling some existing source that was intended for the kernel itself, or for a pre-KPI macOS kernel (KPI being new in Mac OS X 10.4 Tiger :-). You’ll have to adapt it to the brave new world of KPIs, which will be challenging if it’s heavily dependent on Mach messaging.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware 

let myEmail = "eskimo" + "1" + "@apple.com"
Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo
Add a Comment