site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com I am trying to get a Kext that I had working on 10.5 to work on 10.6. It's a research system to detect flow from processes to files in the system using KAUTH to detect events, extended attribtutes to mark files, and KUNC to notify the users on certain events (sometimes preventing execution before it occurs). It works on 10.5.8 how I want it to, never crashes, etc. When trying to move it onto 10.6 it is failing to load and I am getting these errors when I run "kextibs -all-symbols" on it - 3 symbols not found in any library _KUNCUserNotificationDisplayAlert _mac_vnop_getxattr _mac_vnop_setxattr I know that none of these things are actually supported, but since this is just for limited use, is there any way around this problem? -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... On Mar 3, 2010, at 12:32 PM, Chris Gates wrote: There are no errors when building. I imagine that you were previously linking your KEXT vs. the entire kernel to get at all the kernel symbols, which is no longer supported. My guess is that you are now working with a 64 bit kernel? KUNCUserNotificationDisplayAlert is exported by System6.0.exports and Unsupported.exports You can get to this by declaring appropriate dependencies for your KEXT (OSBundleLibraries / com.apple.kpi.unsupported - String - 10,0,0d2). Note that "Unsupported" is code for "this is going away in a future release, so please stop using this API and build your own user agent daemon to talk to your driver instead". mac_vnop_getxattr and mac_vnop_setxattr are exported by MACFramework.exports You will not be able to get to this; the MACF KPI is private and currently unpublished, and subject to change or removal in future releases. Your best bet is to build your own kernel, including your code in the kernel proper so that it can access private symbols like this. This email sent to site_archiver@lists.apple.com