Knowledge and Some!

What is KEXT?
KEXT stands for Kernel Extension, this means that whatever needs to run in the kernel (OS core) environment can be written as extension and then loaded, even after the OSX has finished loading, this mostly answer the needs for hardware drivers.

Where are kext located?
kext are not files rather a folder (disguised as a file),

File extension KEXT description:
A .kext file is a kernel extension. They're generally used for device drivers and other things that need to modify the system at the lowest level. They're not the same as classic Mac OS extensions, as many of the things that classic Mac OS extensions did are done differently in Mac OS X.
Since kernel extensions aren't protected by Mac OS X's memory protection, developers are encouraged to stay away from writing them unless they absolutely have to. Even then, Mac OS X can dynamically load them, so chances are you'd rarely have to add anything to Mac OS X's Extensions folder.
Leopard holds kext files/folders in the /System/Library/Extensions folder,
at boot time the relevant kext are uploaded from Extensions.mkext this is a cache folder that contains kext related to the installed hardware,



you can delete it, if Leopard can't find it, it will create it again,

you can also state to rebuild it from darwin prompt at boot time using the switch -f see this post for further information.

How to Load and UnLoad Kext?
Kext can be loaded and unloaded during runtime using the kextload and kextunload command lines.

in order to load kext, from terminal write:
sudo kextload kextName (where kextName stands for the kext name you want to load)
enter your password and press enter
the system should reply with a success or fail message.
see the manual page for this command

in order to unload kext, from terminal write:
sudo kextunload kextName (where kextName stands for the kext name you want to unload)
enter your password and press enter
the system should reply with a success or fail message.
see the manual page for this command

you can also check the load status of your kext using kextstat, from terminal write:
sudo kextstat
the system will display a list of loaded kext and details on it
see the manual page for this command

How to Install a new Kext?
there is an easier method (not appropriate for all kext installs but works for 99% of them),
it is a little utility named KextHelper and it can be download here: KextHelperb7.pkg.zip....Drop files on its icon or on the open application.

Remember to BACKUP your system before installing a new Kext.



Kext Utility x64
v2.3.2

FULL version

Description

Kext Utility provide the next operations:
Install kext files;
Repair kexts permisssions for system's and Extra folders;
Pack kext files to mkext cache file.
UnPack mkext cache files.
Note:
The utility uses a modified widely applied fast method repairing of all (non/standart) kexts with little improvements. To all kexts the identical permisssions (a little more liberal, than it is necessary) are granted. Though it not 100% satisfies the system's "Disk Utility", however on working capacity of system, to the worst, does not affect.
Note that to run "Disk Utility" when you have enough time is the best way for repair all standart kext.

Update v2.3.2:
* improved repair routine for SnowLeo support
* additional info for CPU
Update v2.3.1:
* Corrected mkext's packing routine for SnowLeo x64 support
Update v2.3.0:
* rewritten repair algorithm
* improved statistic output

Download it here:KextUtility.v2.3.2.full.Snow.Leo..zip

what is Disabler.kext?

Since first running 10.5 on PCs, we noticed a new kernel extension which would create a little havoc with many PCs - AppleIntelCPUPowerManagement. The basic purpose of this kext to to help managing the CPU state with its voltage and frequencies via the thermal zones that are set up for it. However, the timer which is specifically uses is HPET, a much more optimized and effective timer compared to the RTC and 8254 timers which are commonly preferred as of now in PCs. Though Windows is starting to take advantage of HPET from what I've read recently. HPET also never needs to use the CPU's time stamp counter, which is an advantage of freeing up the CPU a little more.

What is AppleDecrypt.kext?

Apple uses an AES encryption scheme with a few of the binaries in their software - Dock, Finder, loginwindow, SystemUIServer, mds, ATSServer, translate and translated for rosetta. Google them if you don't know their purposes. On regular Mac computers these are decrypted via the SMC included in the computer, and is used as a (very weak imo) implementation of making sure that only Apple computers run OS X. I can tell you that many people who use boot-132 CDs find out they forgot to include a copy of dsmos.kext or AppleDecrypt.kext when they attempt to run the OS and when they finally get to the GUI screen, nothing start up. That's because loginwindow is segfaulting.

Basically AppleDecrypt.kext is one of the 3 common kexts used to execute dsmos_page_transform_hook and return the 2 32 byte values that is needed to completely decrypt the binary. What these kexts do is they are a replacement for the vanilla kext that gets installed with system version updates, called "Dont Steal Mac OS X.kext" - its difference is they perform the same purpose but returns the known decryption key itself. Without overriding this, you wouldn't be able to use the OS, or at least the GUI end, as it is only used with a minimal list of binaries. (-nawcom).





What is a vanilla compatible system ?


A vanilla compatible system is a computer capable of running OSx86 with minimal modifications (no patched kernel, compatible with Apple software updates). You have a vanilla capable system if: you have a Core 2 based processor

What is DSDT ?

DSDT is a part of ACPI. Actually DSDT tells OS how to interract with the hardware (simplified way of telling it). OSX has an incomplete ACPI implementation which supports only a subset of DSDT. By replacing DSDT we can declare essentially the same interface but in the way that OSX understands. This potentially can solve nearly any ACPI-related problem (except if OSX bypasses ACPI). Other usage case is emulating by the means of DSDT features or hardware components not present on your system. But this is limited to devices that use ACPI.

ACPI defines a large number of tables that provide the interface between an ACPI-compliant operating system and system firmware. These allow description of system hardware in a platform-independent manner, and are presented as either fixed formatted data structures or in ACPI Machine Language (AML). The main AML table is the DSDT (differentiated system description table).
The Root System Description Pointer is located in a platform-dependent manner, and describes the rest of the tables.


Q. What is EFI emulation ?


Extensible Firmware Interface (EFI) is a specification that defines a software interface between an operating system and platform firmware.. EFI is basically the “BIOS” of a Mac. For a computer to be properly recognized as a mac and to have the most compatibility it must have EFI. The problem here is that PCs do not have EFI.Developers have counteracted this problem by using EFI emulation which enables basic EFI function calls through a specially modified bootloader. EFI distributions for OSx86 include PC_EFI and Chameleon. Nearly all OSx86 installs have some form of EFI emulation installed, so this is not necessarily something to worry about. EFI emulation is required to use vanilla (unpatched) kernels and kexts, and to use GUID partition maps and EFI strings.

you can learn more in the link below:

EFI emulation


LegacyAppleIntelPIIXATA.kext? Well known legacy plist for SATA controllers.

NullCPUPowerManagement.kext?

DFE's IntelCPUPM disabler. NullCPUPowerManagement is an XNU kernel extension for use with OS X to prevent a kernel panic caused by incorrectly configured HPET devices on generic x86 hardware. Note, this extension overrides the CPU power management functionality making the CPU run at full throttle all the time. This in turn gives better performance but reduces battery life on mobile units.

OpenAHCI.kext? Legacy plist for ICH9 and ICH10 AHCI driver.

OpenBlockDevice.kext? Legacy plist for orange hard drive icons (internal seen as external).

OpenCompatible.kext? SMBIOS injector.

OpenHaltRestart.kext? Well known kext to fix Shutdown and Restart issues.

OpenInstall.kext? Looks like a decrypter kext (dsmos / AppleDecrypt).

Elliott Force Legacy RTC.kext?

ElliottForceLegacyRTC is an extension that fixes ACPI issues which became problematic with 10.6 without patching/replacing the DSDT (prevent bios settings reset on Snow Leopard). Thank you Dave for coming up with this idea...patching sucks. Note, this extension does no detection and blatantly forces the RTC length to 2 bytes, which should be the correct value on x86 systems.

Realtek R1000.kext?
Realtek kernel extension for 8111(X) chip sets for 10.6.X.

FakeSMC 2.5 - SMC (System Management Emulator) Emulator.

Intel82566MM.kext? - Driver for the ethernet controller Intel 82566MM *x64 only

AppleACPIPS2NUB.kext? & ApplePS2Controller.kext? - Allows the use of PS/2 keyboards, mice.

AttansicL1eEthernet.kext? - KEXT for the Attansic L1e Ethernet chipset.

NVInject.kext? - An Nvidia graphic injector *x64 only.

Natit.kext? - Graphic injector KEXT with editable paramaters.

SKGE.kext? - Gives functionally to some select Marvell ethernet controller.

AtherosFix.kext? - Dummy KEXT for Atheros Wireless cards. Add device-id to the existing info.plist if need be.



Don't forget to subscribe to my blog!