LZVN with kexts/dictionary extraction

It was two weeks ago that I updated LZVN to support kernel extraction from a prelinkedkernel, and todays update adds extraction of the dictionary with:

./lzvn -d /System/Library/Prelinkedkernels/prelinkedkernel dictionary

And all kexts with:

./lzvn -d /System/Library/Prelinkedkernels/prelinkedkernel kexts

The extracted kexts are saved in kexts/Library/Extensions and/or kexts/System/Library/Extensions, in RAW format. The latter means that extracted kexts are saved like they are found in the prelinked kernel. Not like ‘normal’ kexts.

Note: Source code needs a few cleanups here and there, but it works.

Update: The Dictionary.plist is now saved in proper XML format, so that you can open it with Xcode, and the number of signed and unsigned (extracted) kexts is now also dumped in the output.

Edit: Here is a list with the signed kexts:

/System/Library/Extensions/System.kext/PlugIns/Mach.kext
/System/Library/Extensions/System.kext/PlugIns/IOKit.kext
/System/Library/Extensions/System.kext/PlugIns/Libkern.kext
/System/Library/Extensions/System.kext/PlugIns/Private.kext
/System/Library/Extensions/System.kext/PlugIns/Unsupported.kext
/System/Library/Extensions/System.kext/PlugIns/BSDKernel.kext
/System/Library/Extensions/System.kext/PlugIns/MACFramework.kext

All other kexts are stored in unsigned format in the prelinkedkernel.

Have fun with it!

New AppleHDA8Series.sh update

I am working on a new update for AppleHDA8Series.sh and I would like to hear from you what… if anything, that you would want to see in the new update.

Support for El Capitan is a must have for me, so don’t you worry about that. Already taken care of. System Integrity Protection checks are in place (function _getSIPStatus()) and appears to be functioning properly.

One other thing that I already fixed is issue 15.

I also renamed -d (target directory) to -t (makes sense no?) and now use -d to enable debug output.

I also added a new function called _getVolumeName() and this is what I have come up with:

diskutil info / | grep "Volume Name" | sed -e 's/.*: *//

Do you know about a shorter variant, then please let me know about it. Thanks.

ssdtPRGen.sh/Data/Skylake.cfg updated

Intel released new processor data on ark.intel.com/products which I used to update Skylake.cfg for ssdtPRGen.sh but I’m not sure about the used LFM frequency so if you have any of the new Skylake processors, then please compile and run AppleIntelInfo.kext and let me know if 500 MHz is right or not. Thank you.