The /usr/sbin/kextstat tool is run twice to list all loaded kernel extensions:
- Lists all Apple specific extensions to a file named AppleKexts.txt - Lists all non-Apple specific extensions to a file named NonAppleKexts.txt
Both files are saved in the latest dump/Kexts folder.
LZVN
This binary can be used for extracting information from the prelinked kernel
- prelinked_kexts_list.txt will show a list of prelinked kext information - prelinked_kexts_dictionary.plist will be the extracted dictionary
Source | Piker-Alpha's LZVN GitHub repo |
---|