Available for hire. Let's increase your profits. View Résumé

I'm Gawin. Remote CTO, entrepenerd, and minimalist.
Currently making Nomad Family and the 7 kg challenge.
Exploring the world with a 7 kg backpack and two wonderful girls.

macOS Kernel Extensions

How to remove a buggy Kernel Extension

Sometimes macOS can become slow or give random crashes due to a Kernel Extension. In this case, I experienced issues after installing the Paperlike E-ink display driver. In these steps I’ll explain how to remove the Kernel Extension and resolve the issues, these steps can be applied to remove any third party Kernel Extension.

Even though the Paperlike E-ink display looks great on paper (pun intended), relaxing and reducing the stress on your eyes. It has a slow refresh rate which makes it unsuitable for programming. I really wanted E-ink to work, badly. But instead of making programming more fun it became a slow a painful experience. Today I decided to uninstall the buggy driver. Unfortunately, the drivers are as experimental as the display itself and did not come with a uninstaller, which means we have to manually uninstall the driver.

Locating

Since the driver is loaded as a Kernel Extension, we need to first find where its files are located. Let's start with listing all Kernel Extensions, and since Apple obviously has a lot, we will excluding the Apple Kernel Extensions from our list:

$ kextstat | grep -v com.apple
Index Refs Wired Name (Version)
64 0 0x4f000 at.obdev.nke.LittleSnitch (4354)
115 0 0xd000 com.MyCompany.driver.UsbDisplayVideo (1.0.0d1)

This shows that we have 2 non-Apple extensions loaded, at.obdev.nke.LittleSnitch and com.MyCompany.driver.UsbDisplayVideo The first one is from LittleSnitch, the second one looks like our USB Display Driver. At this point, we can see that the driver is a quick and dirty job since the developers didn’t even take the time to add a proper bundle-id and choose com.MyCompany

The next step is to find where the com.MyCompany.driver.UsbDisplayVideo Kernel Extension is located so we can remove it.

$ kextfind -bundle-id com.MyCompany.driver.UsbDisplayVideo
/System/Library/Extensions/UsbDisplayVideo.kext

Unloading

Now, my initial thought was to just unload the driver and then remove it. But macOS didn’t really like that and treated me with a nice kernel panic after using this command to unload the Kernel Extension:

$ sudo kextunload -b com.MyCompany.driver.UsbDisplayVideo

macOS Kernel Panic

Booting in single-user mode

To resolve this we are going to reboot our machine into single-user mode and remove the Kernel Extension from there.

  1. Shut down your Mac.
  2. Press the Power Button to start up your Mac.
  3. Immediately hold down the following keys: Command + S

Removing

After we booted in the single-user mode you will see a root prompt, here we will type these commands to first mount the disk as writable, then go into the Extensions directory and remove the UsbDisplayVideo.kext to finish up with a reboot.

$ mount -o update /
$ cd /System/Library/Extentions
$ rm -Rf UsbDisplayVideo.kext
$ reboot

Playing with Kernel Extensions can break your system and prevent you from successfully booting again. If you are unsure of the consequences please move the .kext file to a personal directory using the mv command, instead of directly removing it with rm -Rf. That way you could always revert back to the previous state by moving the .kext file back.

Verifying

Now that we removed our Kernel Extension and rebooted our machine we need to verify that our uninstall was successful. Let's list all non-Apple Kernel Extensions again and see that the com.MyCompany.driver.UsbDisplayVideo is no longer loaded:

$ kextstat | grep -v com.apple
Index Refs Wired Name (Version)
64 0 0x4f000 at.obdev.nke.LittleSnitch (4354)

As you can see, only LitteSnich is loaded and the Paperlike driver is gone.


Get an email when I write something new.