Macos 即使在10.11中禁用了系统完整性保护，KEXT也不可加载

目前，我正在开发一个可以阻止访问USB存储的小KEXT。但是，当我无法使用kextutil加载我的KEXT时

Code Signing Failure: not code signed

我确实在10点11分关掉了小口

System Integrity Protection status: disabled.

请帮忙。我不知道该怎么办！

---

谢谢。

对于这些简单的步骤和文档，我做了很长时间的研究，我在这里为像我这样的人列出它

在执行此过程之前，请禁用SIP

在恢复模式下启动Mac电脑，方法是关闭Mac电脑，然后按command+R按钮启动Mac电脑，直到出现apple徽标。 打开终端应用程序并输入以下命令

csrutil禁用

重新启动

这些是使用对位置的根访问控制kext、将其所有权更改为wheel、检查其对OSBundleLibrary的依赖性以及检查kext是否可加载的重要命令

sudo cp-R

sudo chown-R根：轮子

sudo kextlibs-xml//检查要显示在info plist中的osbundlelibrary文件

sudo-kextutil-n-t//检查kext和日志是否可加载

sudo kextutil-n//检查kext和日志是否可加载

sudo-kextutil//检查kext和日志是否可加载

sudo kextload//如果内核不产生死机，则加载您的kext

sudo-kextunload//卸载您的kext

重要网址

内核控制/事件api使用情况

最佳工作模式

IMP数据包创建源

交替转发和检查数据包

sudo lsof-iTCP-sTCP:LISTEN-n-p

netstat-a-n

sudo pfctl-s nat

sudo pfctl-F all-F/etc/pf.conf

回声“ rdr将inet协议tcp从任意端口传递到任意端口80->127.0.0.1端口8080 rdr将inet协议tcp从任意端口传递到任意端口443->127.0.0.1端口8443 “| sudo pfctl-ef-

内托普

sudo tcpdump-i en0-p-vv-A ip和主机192.168.1.92

sudo tcpdump-i en0-p-vv-A ip

sudo tcpdump-i en0-p-vv-A ip和net 192.0.2.0/24

https://github.com/robbiehanson/CocoaAsyncSocket/tree/master/Examples/GCD
https://tools.ietf.org/html/rfc7230
https://developer.apple.com/documentation/security/certificate_key_and_trust_services?language=objc
http://openssl.cs.utah.edu/docs/apps/x509v3_config.html
https://docs.mitmproxy.org/stable/concepts-howmitmproxyworks/
http://technologeeks.com/course.jl?course=OSXRE
https://www.fastcompany.com/3042030/the-huge-web-security-loophole-that-most-people-dont-know-about-and-how-its-be
https://stackoverflow.com/questions/589622/how-does-a-root-ca-verify-a-signature
https://deliciousbrains.com/https-locally-without-browser-privacy-errors/
https://rednaga.io/2017/04/09/remote_kext_debugging/
http://www.robertopasini.com/index.php/2-uncategorised/628-osx-packaging-a-kernel-extension-for-distribution-and-installation
http://ddeville.me/2015/08/using-the-vmware-fusion-gdb-stub-for-kernel-debugging-with-lldb
https://objective-see.com/blog.html
https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/KEXTConcept/KEXTConceptDebugger/debug_tutorial.html
https://forums.macrumors.com/threads/turn-off-verbose-bootup.1247361/
https://adimitrov.net/main/code/code/raw_packet.c
http://www.enderunix.org/docs/en/rawipspoof/
https://www.eit.lth.se/ppplab/IPHeader.htm#TOS,%20Type%20of%20Service
https://www.tenouk.com/download/pdf/Module39.pdf
https://developer.apple.com/library/archive/documentation/DeviceDrivers/Conceptual/IOKitFundamentals/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP0000018-BAJFFJAD
https://github.com/slavaim/MacOSX-Network-Sockets-Filter
https://www.blackhat.com/us-18/arsenal.html#learn-how-to-build-your-own-utility-to-monitor-malicious-behaviors-of-malware-on-macos
https://developer.apple.com/documentation/networkextension?language=objc
https://github.com/TrustRouter/TrustRouter/blob/master/client/kernelmode/MacOS/trustrouter/trustrouter.c
https://github.com/LawlietRyuzakiCode/NKETest/blob/master/TestFilter/TestFilter/TestFilter.c
https://objective-see.com/blog/blog_0x0B.html
http://www.ragingmenace.com/software/menumeters/
https://people.sissa.it/~inno/pubs/skb-reduced.pdf
http://haifux.org/lectures/122/FreeBSD_kernel_networking.pdf
http://www.zytrax.com/books/dns/ch15/