<< back

KextViewr 2.0.0

Display all currently loaded kexts

Category: Utilities
Price: Free
Popularity: High
Version String: 2.0.0
Release Date: 2023-02-21
Architecture: Intel & AppleSilicon(ARM)
Minimum OS: macOS 11.0
Vendor Name: Objective-See, LLC
Homepage: objective-see.org

Version History 2.0.0

#{version_history}

Description:

KextViewr

View all modules on that are loaded in the OS kernel.

Modules that are loaded into the kernel are called kernel extension, or 'kexts.' They run at the OS's highest privilege level; ring-0. KextViewr displays all loaded kexts, along with their signing status, full path, VirusTotal detection ratios, and more!

KextViewr is a utility with a simply goal; display all currently loaded kexts. While Apple's commandline tool 'kextstat' can provide similar information, it is (IMHO), somewhat lacking. For example, it does not provide file paths for loaded kernel extentions, or whether or not, the kext is signed. On the other hand, KextViewr provides a myriad of infomation about each loaded kext, including:
▪ Full File Path
displays the full path to the kext's on-disk file image

▪ Signing Status
shows whether the kext signed or unsigned, and if signed, by whom.

▪ VirusTotal Integration
provides invaluable information about persistent files and can automatically detect known malware