strnstr in kext result in symbol not found

Hi,


I'm writing a simple kext that registers for vnode notification. I'm following the kauthORama sample code. I have the same libraries included but when I want to compare a substring with strnstr and run :


$ kextlibs -xml MyKext.kext/


It results in the following:

<key>OSBundleLibraries</key>

<dict>

<key>com.apple.kpi.bsd</key>

<string>15.6</string>

<key>com.apple.kpi.libkern</key>

<string>15.6</string>

</dict>

For x86_64:

1 symbol not found in any library kext.


How do I get to do regular string operations in kext ?

Replies

strstr
is not available in the kernel:
$ nm /System/Library/Kernels/kernel | grep strstr
$
strnstr
is available in the kernel:
$ nm /System/Library/Kernels/kernel | grep strnstr
ffffff800039b520 T _strnstr

but not part of any public KPI:

$ kextfind -defines-symbol _strnstr
/System/Library/Extensions/System.kext/PlugIns/Private.kext

In general, the kernel provides only a subset of the C standard library. If you need stuff beyond that, you’ll have to include your own copy.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thanks Quinn,


I tried searching for a reference that would list all string operation available but did not had any luck. Can you or anyone else, please provide a link. Kernel framework string.h header file is not commented to hint at what is available and what is not.

Just out of curiosity why would functions like this not be in the public KPI? I'd think Apple's code would be safer than any developer copying some version of it off of google into their kext codebase.

ambreen2006 wrote:

I tried searching for a reference that would list all string operation available but did not had any luck.

Yeah, I know this pain well. AFAIK such a reference does not exist.

JZdziarski wrote:

Just out of curiosity why would functions like this not be in the public KPI?

I don’t have a definitive answer to that. I suspect that it’s just historical baggage left over from the kernel’s origins.

For both cases above, please do file enhancement requests for the improvements you’d like to see.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"