KextRW - GitLite

KO | EN

gitlite — search

#ai #llm #golang #go #android #linux #java #kubernetes #vue #awesome-list #security #mcp #ios #openai

KextRW

(★ 114)

macOS kext with kernel R/W, kalloc and kcall

File Explorer

Download Latest Version (.zip)

- settings.json
- libkextrw.c
- libkextrw.h
- Makefile
- Info.plist
- KextRW.cpp
- KextRW.h
- KextRWUserClient.cpp
- KextRWUserClient.h
- kmod.cpp
- kpi.h
- routines.h
- routines.S
- entitlements.plist
- kextrw_test.c
- Makefile
.gitignore
LICENSE.md
Makefile
README.md

# Installation Guide

1. Get the code

git clone https://github.com/alfiecg24/KextRW

Downloads the entire project code from GitHub to your computer.

cd KextRW

Moves into the project folder you just downloaded.

2. Make

Medium Recommended

Prerequisites

Git Needed to download the project code from GitHub.
Make Usually pre-installed on Linux/macOS. On Windows, install separately (e.g. via MSYS2 or WSL).

make

Compiles the code based on the generated build configuration to produce an executable.

✅ If it finishes without errors, it worked. Try running the generated executable directly.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# KextRW

A macOS kernel extension offering several features useful for security/vulnerability research against XNU.

The features provided by this kernel extension include:
* Virtual kernel read/write
* Physical read/write
* Getting the kernel base and slide
* Kernel memory allocation and freeing
* Kernel call primitive
* Address translation

The codebase is originally based on [IOKernelRW](https://github.com/Siguza/IOKernelRW), where you can find installation instructions, as they will be the same for this project. Any binary that wishes to create a userclient for this kernel extension must possess the `com.apple.security.alfie.kext-rw` entitlement. An easy-to-use test program can be found in the `tests/` folder, but the offsets and addresses are specific to my machine.

You can find the path to your kernelcache by running `kmutil inspect` - it will be printed at the top. This will be necessary if you would like to update the offsets and addresses in `kextrw_test.c`. I have not tested this on anything other than macOS 15.2.

Building the project using `make all` will output a static `libkextrw` library and a header file in the `build/` directory, which you can then use to build projects on top of the primitives provided by the kernel extension. The `kextrw_test.c` file in the `tests/` directory offers an example of this use case.