NAME
kkeexxttffiinndd - find kernel extensions based on a variety of criteria and
print informationSYNOPSIS
kkeexxttffiinndd [options] [directory or extension ...] [query][-rreeppoorrtt [-nnoo-hheeaaddeerr] reportpredicate ...]
DESCRIPTION
The kkeexxttffiinndd utility locates and prints information, or generates reports, about kernel extensions (kexts) matching the search criteria in query from among those in the named directory and extension arguments.If no directories or extensions are specified, searches the system exten-
sions folder. Searches are performed via kext management logic as usedby kextload(8) and kextd(8), by which only kexts directly in the reposi-
tory directory or kexts explicitly named (and their immediate plugins)are eligible; this is specifically not an exhaustive, recursive filesys-
tem search. Construct your search using any of the query and command predicates listed below. You can combine predicates with the logical operators-aanndd, -oorr, and -nnoott, and group them with parentheses.
Query command predicates generally print some bit of information about a kext, such as its pathname or bundle identifier, followed by either anewline or an ASCII NUL. You can also generate a tab-delimited report
using the -rreeppoorrtt keyword after the query expression; if you do, you must
not specify any of the command predicates described below. OOPPTTIIOONNSS-hh
-hheellpp Display a help message and exit.
-ii
-ccaassee-iinnsseennssiittiivvee
Performs case-insensitive comparisons for all property, match
property, and bundle identifier query predicates when values are strings. Has no effect when property values are numbers or booleans. You can also use this option with individual property query predicates.-nnoo-ppaatthhss
Prints no paths for kexts, just their bundle name, and for info dictionary and executable files, their paths relative to the kext itself. This can be ambiguous with plugins of the same name and when searching multiple repositories.-00
-nnuull Causes the -eecchhoo and all -pprriinntt... command predicates except for
-pprriinntt-ddiiaaggnnoossttiiccss to emit an ASCII NUL character (character code
0) in place of any newlines. This is useful when sending the output to xargs(1). You can also use this flag individually with those command predicates.-rreellaattiivvee-ppaatthhss
Print pathnames relative to kexts' repositories (which can be ambiguous if multiple repositories are being searched).-ff directory or extension
-sseeaarrcchh-iitteemm directory or extension
Specifies a directory or kext to search. While you can normallyjust list them without an option flag, these are provided to pre-
vent ambiguity with the query expression.-ss
-ssuubbssttrriinngg
Performs substring searches for all property, match property, and bundle identifier query predicates when values are strings. Has no effect when property values are numbers or booleans. You can also use this option with individual property query predicates.-ee
-ssyysstteemm-eexxtteennssiioonnss
Adds the system extensions folder to the list of directory to search. If you don't specify any directories or kexts, this is used by default.-- End of options.
QQUUEERRYY PPRREEDDIICCAATTEESS Descriptions of all available search criteria and commands follow, grouped by general category. SSeeaarrcchh bbyy BBuunnddllee NNaammee,, oorr IInnffoo DDiiccttiioonnaarryy oorr MMaattcchh ((PPeerrssoonnaalliittyy)) PPrrooppeerrttiieessThese predicates all take the -ccaassee-iinnsseennssiittiivvee (-ii) and -ssuubbssttrriinngg (-ss)
options as described above.-bb [-ii | -ccaassee-iinnsseennssiittiivvee] [-ss | -ssuubbssttrriinngg] id
-bbuunnddllee-iidd [-ii | -ccaassee-iinnsseennssiittiivvee] [-ss | -ssuubbssttrriinngg] id
True if the kext's bundle identifier matches id.-BB [-ii | -ccaassee-iinnsseennssiittiivvee] [-ss | -ssuubbssttrriinngg] id
-bbuunnddllee-nnaammee [-ii | -ccaassee-iinnsseennssiittiivvee] [-ss | -ssuubbssttrriinngg] id
True if the kext's bundle name matches name. This is equivalentto -pprrooppeerrttyy options CCFFBBuunnddlleeIIddeennttiiffiieerr id.
-mm [-ii | -ccaassee-iinnsseennssiittiivvee] [-ss | -ssuubbssttrriinngg] name value
-mmaattcchh-pprrooppeerrttyy [-ii | -ccaassee-iinnsseennssiittiivvee] [-ss | -ssuubbssttrriinngg] name value
True if the kext has at least one personality containing as a string, number, or boolean value (expressible as ``true'',``yes'', ``1'' or ``false'', ``no'', ``0'') for the named prop-
erty.-mmee name
-mmaattcchh-pprrooppeerrttyy-eexxiissttss name
True if the kext has at least one personality containing any value for the named property.-pp [-ii | -ccaassee-iinnsseennssiittiivvee] [-ss | -ssuubbssttrriinngg] name value
-pprrooppeerrttyy [-ii | -ccaassee-iinnsseennssiittiivvee] [-ss | -ssuubbssttrriinngg] name value
True if the kext's info dictionary contains value as a string, number, or boolean value (expressible as ``true'', ``yes'', ``1'' or ``false'', ``no'', ``0'') for the named property.-ppee name
-pprrooppeerrttyy-eexxiissttss name
True if the kext's info dictionary contains any value for the named property. SSeeaarrcchh bbyy LLooaaddeedd//LLooaaddaabbllee-aa
-aauutthheennttiicc
True if the kext is owned by root:wheel and has proper permis-
sions.-dd
-ddeeppeennddeenncciieess-mmeett
True if the kext has all its dependencies met.-nndd
-ddeeppeennddeenncciieess-mmiissssiinngg
True if the kext is missing dependencies (or can't have its dependencies resolved).-nnaa
-iinnaauutthheennttiicc
True if the kext is not owned by root:wheen or has improper per-
missions (or can't be so authenticated).-nnvv
-iinnvvaalliidd
True if the kext is not valid.-ll
-llooaaddaabbllee
True if the kext appears to be loadable. (It may still fail to load due to link errors.)-llooaaddeedd
True if the kext is currently loaded (if its bundle identifier and version match a kext loaded in the kernel).-nnll
-nnoonnllooaaddaabbllee
True if the kext can't be loaded because it is invalid, inauthen-
tic, or missing dependencies.-vv
-vvaalliidd True if the kext is valid.
-ww
-wwaarrnniinnggss
True if any warnings are noted while validating the kext. SSeeaarrcchh bbyy EExxeeccuuttaabbllee,, AArrcchhiitteeccttuurree,, oorr SSyymmbbooll-aarrcchh arch1[,arch2...]
True if the kext contains all of the named CPU architectures in its executable.-aaxx arch1[,arch2...]
-aarrcchh-eexxaacctt arch1[,arch2...]
True if the kext contains all of the named CPU architectures, and no others, in its executable.-ddssyymm symbol
-ddeeffiinneess-ssyymmbbooll symbol
True if the kext defines the named symbol in any of its architec-
tures. The name must match exactly with the (possibly mangled) symbol in the kext's executable. A kext must also be a libraryfor others to link against it (see -lliibbrraarryy).
-xx
-eexxeeccuuttaabbllee
True if the kext declares an executable (whether it actually has one or not; that is, if the kext declares one but it's missing, this predicate is true even though the kext is invalid).-nnxx
-nnoo-eexxeeccuuttaabbllee
True if the kext declares no executable.-rrssyymm symbol
-rreeffeerreenncceess-ssyymmbbooll symbol
True if the kext has an undefined reference to the named symbol in any of its architectures. The name must match exactly with the (possibly mangled) symbol in the kext's executable. SSeeaarrcchh bbyy MMiisscceellllaanneeoouuss AAttttrriibbuuttee-ddeebbuugg True if the kext has a top-level OSBundleDebugLevel property
other than zero, or if any of its personalities has an IOKitDebug property other than zero.-hhaass-pplluuggiinnss
True if the kext contains plugins.-iinntteeggrriittyy { ccoorrrreecctt | mmooddiiffiieedd | nnoo-rreecceeiipptt | nnoott-aappppllee | uunnkknnoowwnn }
True if the kext has the specified integrity.-kkeerrnneell-rreessoouurrccee
True if the kext represents a resource built into the kernel.-lliibb
-lliibbrraarryy
True if the kext is a library that other kexts can link against.-pplluuggiinn
True if the kext is a plugin of another kext. SSeeaarrcchh bbyy SSttaarrttuupp RReeqquuiirreemmeennttThese options find kexts that are used at startup or allowed to load dur-
ing safe boot. They should be combined with the -oorr operator. (The
standard system mkext file contains console, local-root, and root kexts,
so you would specify ``\( -console -or -local-root -or -root \)''.
-CC
-ccoonnssoollee
True if the kext is potentially required for console-mode startup
(same as -pp OOSSBBuunnddlleeRReeqquuiirreedd CCoonnssoollee but always case-sensitive).
-LL
-llooccaall-rroooott
True if the kext is potentially required for local-root startup
(same as -pp OOSSBBuunnddlleeRReeqquuiirreedd LLooccaall-RRoooott but always case-sensi-
tive).-NN
-nneettwwoorrkk-rroooott
True if the kext is potentially required for network-root startup
(same as -pp OOSSBBuunnddlleeRReeqquuiirreedd NNeettwwoorrkk-RRoooott but always case-sensi-
tive).-RR
-rroooott True if the kext is potentially required for root startup (same
as -pp OOSSBBuunnddlleeRReeqquuiirreedd RRoooott but always case-sensitive).
-SS
-ssaaffee-bboooott
True if the kext is potentially allowed to load during safe boot(same as -pp OOSSBBuunnddlleeRReeqquuiirreedd ''SSaaffee BBoooott'' but always case-sensi-
tive). SSeeaarrcchh bbyy VVeerrssiioonn-ccoommppaattiibbllee-wwiitthh-vveerrssiioonn version
True if the kext is a library kext compatible with the given ver-
sion.-VV [nnee|ggtt|ggee|lltt|llee]version[-version]
-vveerrssiioonn [nnee|ggtt|ggee|lltt|llee]version[-version]
True if the kext's version matches the version expression. You can either specify an operator before a single version, or a range of versions. Remember that nonfinal versions such as 1.0d21 compare as less than final versions (in this case 1.0); construct your version expression accordingly. See also-lliibbrraarryy.
QQUUEERRYY CCOOMMMMAANNDD PPRREEDDIICCAATTEESS Use these predicates to print information about kexts that match the query or run a utility on the kext bundle directory, its info dictionaryfile, or its executable. Execpt for -eexxeecc, these all have a true result
for purposes of query evaluation.The -eecchhoo and all -pprriinntt... command predicates except for
-pprriinntt-ddiiaaggnnoossttiiccss accept the -nnuull (-00) option to emit an ASCII NUL char-
acter (character code 0) in place of any newlines. This is useful when sending the output to xargs(1).-eecchhoo [-nn | -nnoo-nneewwlliinnee] [-00 | -nnuull] string
Prints string followed by a newline. You can specify -nn or
-nnoo-nneewwlliinnee to omit the newline. If you specify both -nn and
-nnuull, string is not followed by either a newline or an ASCII NUL
character.-eexxeecc utility [argument ...] ;
True if the program named utility returns a zero value as its exit status. Optional arguments may be passed to the utility. The expression must be terminated by a semicolon (``;''). If you invoke kkeexxttffiinndd from a shell you may need to quote the semicolon if the shell would otherwise treat it as a control operator. Thestrings ``{}'', ``{info-dictionary}'', and ``{executable}'',
appearing anywhere in the utility name or the arguments arereplaced by the pathname of the current kext, its info dictio-
nary, or its executable, respectively. Utility will be executed from the directory from which kkeexxttffiinndd was executed. Utility andarguments are not subject to the further expansion of shell pat-
terns and constructs.-pprriinntt [-00 | -nnuull]
Prints the pathname of the kext. If no command predicate is specified, the query as a whole becomes equivalent to (( query ))-aanndd -pprriinntt.
-pprriinntt00
Equivalent to -pprriinntt -nnuull, for all you find(1) users out there.
-ppaa [-00 | -nnuull]
-pprriinntt-aarrcchheess [-00 | -nnuull]
Prints the names of all the architectures in the kext executable (if it has one), separated by commas.-pprriinntt-ddeeppeennddeenncciieess [-00 | -nnuull]
Prints the pathnames of all direct and indirect dependencies of the kext.-pprriinntt-ddeeppeennddeennttss [-00 | -nnuull]
Prints the pathnames of all direct and indirect dependents of the kext.-ppddiiaagg
-pprriinntt-ddiiaaggnnoossttiiccss
Prints validation and authentication failures, missing dependen-
cies, and warnings for the kext.-ppxx [-00 | -nnuull]
-pprriinntt-eexxeeccuuttaabbllee [-00 | -nnuull]
Prints the pathname to the kext's executable file.-ppiidd [-00 | -nnuull]
-pprriinntt-iinnffoo-ddiiccttiioonnaarryy [-00 | -nnuull]
Prints the pathname to the kext's info dictionary file. (You canuse ``-exec cat {info-dictionary} \;'' or ``-exec pl -input
{info-dictionary} \;'' to print the contents of the file.)
-pprriinntt-iinntteeggrriittyy [-00 | -nnuull]
Prints the integrity state of the kext.-pprriinntt-pplluuggiinnss [-00 | -nnuull]
Prints the pathnames of all plugins of the kext.-ppmm [-00 | -nnuull] name
-pprriinntt-mmaattcchh-pprrooppeerrttyy [-00 | -nnuull] name
For each matching personality in the kext, if property exists, prints the personality's name, a colon, then name followed by an equals sign and the property's value. Results in true even if the property does not exist for any personality.-pppp [-00 | -nnuull] name
-pprriinntt-pprrooppeerrttyy [-00 | -nnuull] name
If the top-level property exists, prints name followed by an
equals sign and its value. Results in true even if the property does not exist. OOPPEERRAATTOORRSS The query primaries may be combined using the following operators. The operators are listed in order of decreasing precedence. (( expression )) This evaluates to true if the parenthesized expression evaluatesto true. Note that in many shells parentheses are special char-
acters and must be escaped or quoted. !! expression-nnoott expression
This is the unary NOT operator. It evaluates to true if expression is false, to false if expression is true. Note that in many shells ``!'' is a special character and must be escaped or quoted.expression -aanndd expression
expression expression The and operator is the logical AND operator. It is implied by the juxtaposition of two expressions and therefore need not be specified. It evaluates to true if both expressions are true. If the first expression is false, the second expression is not evaluated.expression -oorr expression
The -oorr operator is the logical OR operator. It evaluates to
true if either expression is true. If the first expression is true, the second expression is not evaluated. RREEPPOORRTTSSUse the following predicates in a report expression to generate a tab-
delimited format, one kext per line, suitable for further processing (or immediate edification). The report normally starts with a header linelabeling each column; you can skip this by following -rreeppoorrtt directly
with -nnoo-hheeaaddeerr.
The report predicate keywords are almost all the same as query predi-
cates, but have different purposes (and arguments in several cases). Ingeneral, where a query predicate is looking for a value, a report predi-
cate is retrieving it. Thus, the property predicates only take the name of the property, and print the value of that property for the kext being examined. Report predicates based on attributes with multiple values,such as -pprriinntt-ddeeppeennddeenncciieess, print the number of values rather than the
values themselves. Finally, report predicates for yes/no questions print ``yes'' or ``no''.Note that many shorthands for inverted meanings, such as -iinnvvaalliidd, are
not available for reports (they would only be confusing). Others, suchas -mmaattcchh-pprrooppeerrttyy, could generate multiple values that would be impossi-
ble to embed meaningfully in plain tab-delimited text (and knowing how
many of them there are is not useful). VVaalluuee RReeppoorrtt PPrreeddiiccaatteess-bb | -bbuunnddllee-iidd
Prints the kext's bundle identifier.-BB | -bbuunnddllee-nnaammee
Prints the kext's bundle name.-iinntteeggrriittyy | -pprriinntt-iinntteeggrriittyy
Prints the integrity state of the kext.-VV | -vveerrssiioonn
Prints the kext's version.-pprriinntt Prints the kext's pathname.
-ppaa | -pprriinntt-aarrcchheess
Prints the names of the architectures, if any, in the kext exe-
cutable.-pprriinntt-ddeeppeennddeenncciieess
Prints the number of dependencies found for the kext.-pprriinntt-ddeeppeennddeennttss
Prints the number of kexts found that depend on the kext.-ppxx | -pprriinntt-eexxeeccuuttaabbllee
Prints the pathname of the kext's executable (if it has one).-ppiidd | -pprriinntt-iinnffoo-ddiiccttiioonnaarryy
Prints the pathname of the kext's info dictionary.-pprriinntt-pplluuggiinnss
Prints the number of plugin kexts the kext has.-pp name | -pprrooppeerrttyy name
-pppp name | -pprriinntt-pprrooppeerrttyy name
Prints the value for the top-level info dictionary property with
key name. If the key is not defined, prints ``''. -ssyymm symbol | -ssyymmbbooll symbol
Prints "references" or "defines" as if the kext references of defines symbol. (This is the only report predicate that is not also a query predicate.) YYeess//NNoo RReeppoorrtt PPrreeddiiccaatteess-aarrcchh arch1[,arch2...]
``yes'' if the kexts contains all the named architectures, ``no'' otherwise.-aaxx arch1[,arch2...] | -aarrcchh-eexxaacctt arch1[,arch2...]
``yes'' if the kexts contains only the named architectures, ``no'' otherwise.-aa | -aauutthheennttiicc
-ddeebbuugg
-ddssyymm symbol | -ddeeffiinneess-ssyymmbbooll symbol
-dd | -ddeeppeennddeenncciieess-mmeett
-xx | -eexxeeccuuttaabbllee
-hhaass-pplluuggiinnss
-kkeerrnneell-rreessoouurrccee
-lliibb | -lliibbrraarryy
-ll | -llooaaddaabbllee
-llooaaddeedd
-pplluuggiinn
-ww | -wwaarrnniinnggss
-vv | -vvaalliidd
EEXXAAMMPPLLEESS The following examples are shown as given to the shell:kextfind -case-insensitive -not -bundle-id -substring 'com.apple.' -print
Print a list of all non-Apple kexts.
kextfind \( -nonloadable -or -warnings \) -print -print-diagnostics
Print a list of all kexts that aren't loadable or that have any warnings, along with what's wrong with each.kextfind -nonloadable -print-dependents | sort | uniq
Print a list of all kexts that can't be loaded because of prob-
lems with their dependencies.kextfind -defines-symbol ZTV14IONetworkStack
Print a list of all kexts that define the symbol ZTV14IONet-
workStack.kextfind -relative-paths -arch-exact ppc,i386
Print a list of all kexts kexts that contain only ppc and i386 code.kextfind -debug -print -pp OSBundleDebugLevel -pm IOKitDebug
Print a list of all kexts that have debug options set, along with the values of the debug options.kextfind -m IOProviderClass IOMedia -print -exec pl -input {info-
dictionary} ; Print a list of all kexts that match on IOMedia, along with their info dictionaries.kextfind -no-paths -nl -report -print -v -a -d
Print a report of kexts that can't be loaded, with hints as to the problems. DIAGNOSTICS The kkeexxttffiinndd utility exits with a status of 0 on completion (whether or not any kexts are found), or with a nonzero status if an error occurs.SEE ALSO
find(1), kextcache(8), kextd(8), kextload(8), kextstat(8), kextunload(8), xargs(1)BUGS
Several special characters used by kkeexxttffiinndd are also special characters to many shell programs. In particular, the characters ``!'', ``('', and ``)'', may have to be escaped from the shell. Darwin April 11, 2006 Darwin