Vladimir (Alkenso) Alkenso
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // Common code | |
| // used in both client and kernel parts. | |
| // Common.h | |
| enum TestKEXTEventType | |
| { | |
| TestKextEventStart = 1, | |
| TestKextEventStop = 2 | |
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import IOKit | |
| let serviceName = "FSGuardService" | |
| let watcher = IOKitKEXTWatcher(ioServiceName: serviceName) | |
| watcher.updateHandler = { | |
| if $0 != nil { | |
| NSLog("IOKit service loaded: \(serviceName).") | |
| } else { | |
| NSLog("IOKit service unloaded: \(serviceName).") |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import IOKit.kext // #import <IOKit/kext/KextManager.h> | |
| func LocateKEXT(_ identifier: String) -> URL? { | |
| KextManagerCreateURLForBundleIdentifier(kCFAllocatorDefault, identifier as CFString)?.takeRetainedValue() as URL? | |
| } | |
| func IsKEXTLoaded(_ identifier: String) -> Bool { | |
| LocateKEXT(identifier) != nil | |
| } |
Alkenso
/ ObserveKEXT+NSDistributedNotificationCenter.swift
Last active
April 29, 2020 18:38
Observe KEXT: NSDistributedNotificationCenter
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import Cocoa | |
| @NSApplicationMain | |
| class AppDelegate: NSObject, NSApplicationDelegate { | |
| private var _token: NSObjectProtocol? | |
| func applicationDidFinishLaunching(_ notification: Notification) { | |
| _token = DistributedNotificationCenter.default().addObserver(forName: NSNotification.Name(rawValue: "Loaded Kext Notification"), | |
| object: nil, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // Requires Swift 5.1 (Xcode 11.1+). | |
| // | |
| // Using pthread_rw_lock allows to minimize system resources | |
| // and prevent creation of DispatchQueue per each @Atomic property. | |
| // | |
| @propertyWrapper | |
| final class Atomic<Value> { | |
| var value: Value |