macOS Kernel Extensions
How to remove a buggy Kernel Extension
Sometimes macOS can become slow or give random crashes due to a Kernel Extension. In this case, I experienced issues after installing the Paperlike E-ink display driver. In these steps I’ll explain how to remove the Kernel Extension and resolve the issues, these steps can be applied to remove any third party Kernel Extension.
Even though the Paperlike E-ink display looks great on paper (pun intended), relaxing and reducing the stress on your eyes. It has a slow refresh rate which makes it unsuitable for programming. I really wanted E-ink to work, badly. But instead of making programming more fun it became a slow a painful experience. Today I decided to uninstall the buggy driver. Unfortunately, the drivers are as experimental as the display itself and did not come with a uninstaller, which means we have to manually uninstall the driver.
Since the driver is loaded as a Kernel Extension, we need to first find where its files are located. Let's start with listing all Kernel Extensions, and since Apple obviously has a lot, we will excluding the Apple Kernel Extensions from our list:
$ kextstat | grep -v com.apple Index Refs Wired Name (Version) 64 0 0x4f000 at.obdev.nke.LittleSnitch (4354) 115 0 0xd000 com.MyCompany.driver.UsbDisplayVideo (1.0.0d1)
This shows that we have 2 non-Apple extensions loaded,
com.MyCompany.driver.UsbDisplayVideo The first one is from LittleSnitch, the second one looks like our USB Display Driver. At this point, we can see that the driver is a quick and dirty job since the developers didn’t even take the time to add a proper
bundle-id and choose
The next step is to find where the
com.MyCompany.driver.UsbDisplayVideo Kernel Extension is located so we can remove it.
$ kextfind -bundle-id com.MyCompany.driver.UsbDisplayVideo /System/Library/Extensions/UsbDisplayVideo.kext
Now, my initial thought was to just unload the driver and then remove it. But macOS didn’t really like that and treated me with a nice kernel panic after using this command to unload the Kernel Extension:
$ sudo kextunload -b com.MyCompany.driver.UsbDisplayVideo
Booting in single-user mode
To resolve this we are going to reboot our machine into single-user mode and remove the Kernel Extension from there.
- Shut down your Mac.
- Press the
Power Buttonto start up your Mac.
- Immediately hold down the following keys:
Command + S
After we booted in the single-user mode you will see a root prompt, here we will type these commands to first mount the disk as writable, then go into the Extensions directory and remove the
UsbDisplayVideo.kext to finish up with a reboot.
$ mount -o update / $ cd /System/Library/Extentions $ rm -Rf UsbDisplayVideo.kext $ reboot
Playing with Kernel Extensions can break your system and prevent you from successfully booting again. If you are unsure of the consequences please move the .kext file to a personal directory using the mv command, instead of directly removing it with rm -Rf. That way you could always revert back to the previous state by moving the .kext file back.
Now that we removed our Kernel Extension and rebooted our machine we need to verify that our uninstall was successful. Let's list all non-Apple Kernel Extensions again and see that the
com.MyCompany.driver.UsbDisplayVideo is no longer loaded:
$ kextstat | grep -v com.apple Index Refs Wired Name (Version) 64 0 0x4f000 at.obdev.nke.LittleSnitch (4354)
As you can see, only LitteSnich is loaded and the Paperlike driver is gone.