macOS Kernel Extensions
How to remove a buggy Kernel Extension
Sometimes macOS can become slow or give random crashes due to a Kernel Extension. In this case, I experienced issues after installing the Paperlike E-ink display driver. In these steps I will explain how to remove the Kernel Extension and resolve the problems, these steps can be applied to remove any third party Kernel Extension.
Even though the Paperlike E-ink display looks great on paper (pun intended), relaxing and reducing the stress on your eyes. It has a slow refresh rate, which makes it unsuitable for programming. I really wanted E-ink to work. But instead of making programming more fun it became a slow a painful experience. Today I decided to uninstall the buggy driver. Unfortunately, the drivers are as experimental as the display itself and did not come with an uninstaller, which means we have to uninstall the driver manually.
Even though the Paperlike E-ink display looks great on paper (pun intended), relaxing and reducing the stress on your eyes. It has a slow refresh rate, which makes it unsuitable for programming. I wanted E-ink to work for programming, but the low refresh rate makes it unusable. Today I decided to uninstall the buggy driver. Unfortunately, the drivers are as experimental as the display itself and did not come with an uninstaller, which means we have to uninstall the driver manually.
Locating
Since the driver is loaded as a Kernel Extension, we need first to find where its files are located. Let's start with listing all Kernel Extensions, and since Apple has a lot, we will exclude the Apple Kernel Extensions from our results using grep:
$ kextstat | grep -v com.apple
Index Refs Wired Name (Version)
64 0 0x4f000 at.obdev.nke.LittleSnitch (4354)
115 0 0xd000 com.MyCompany.driver.UsbDisplayVideo (1.0.0d1)
This shows that we have 2 non-Apple extensions loaded, at.obdev.nke.LittleSnitch and com.MyCompany.driver.UsbDisplayVideo The first one is from LittleSnitch, the second one looks like our USB Display Driver. At this point, we can see that the driver is a quick and dirty job since the developers didn't even take the time to add a proper bundle-id and choose com.MyCompany
The next step is to find where the com.MyCompany.driver.UsbDisplayVideo Kernel Extension is located so we can remove it.
$ kextfind -bundle-id com.MyCompany.driver.UsbDisplayVideo
/System/Library/Extensions/UsbDisplayVideo.kext
Unloading
My initial thought was just to unload the driver and then remove it. But macOS didn't really like that and treated me with a kernel panic after using this command to unload the Kernel Extension:
$ sudo kextunload -b com.MyCompany.driver.UsbDisplayVideo
Booting in single-user mode
To resolve this we are going to reboot our machine into single-user mode and remove the Kernel Extension from there.
- Shut down your Mac.
- Press the
Power Buttonto start up your Mac. - Immediately hold down the following keys:
Command + S
Removing
After we booted in the single-user mode you will see a root prompt, here we will type these commands to first mount the disk as writable, then go into the Extensions directory and remove the UsbDisplayVideo.kext to finish up with a reboot.
$ mount -o update /
$ cd /System/Library/Extentions
$ rm -Rf UsbDisplayVideo.kext
$ reboot
Playing with Kernel Extensions can break your system and prevent you from successfully booting again. If you are unsure of the consequences please move the .kext file to a personal directory using the mv command, instead of directly removing it with rm -Rf. That way you could always revert to the previous state by moving the .kext file back.
Verifying
Now that we removed our Kernel Extension and rebooted our machine we need to verify that our uninstall was successful. Let's list all non-Apple Kernel Extensions again and see that the com.MyCompany.driver.UsbDisplayVideo is no longer loaded:
$ kextstat | grep -v com.apple
Index Refs Wired Name (Version)
64 0 0x4f000 at.obdev.nke.LittleSnitch (4354)
As you can see, only LitteSnich is loaded and the Paperlike driver is gone.