panic on 10.15.7

Question

panic on 10.15.7

panjiancai opened this issue 3 years ago · comments

when start , panic in. user_trap_hook,line:
user_trap_t caller = (user_trap_t)hookp->caller_addr; caller(state); // Might not return
I found hookp->caller_addr is NULL.

Steven Michaud · Answer 1 · Sun Feb 07 2021 01:18:18 GMT+0800 (China Standard Time)

Please tell me more. This isn't enough for me to do anything with.

How do you know this? Do you still have the kernel panic report? If so please attach it. Did you have the keepsyms=1 boot arg set? Is the kernel panic report symbolicated?

What, exactly, were you doing when the kernel panic happened? Are you able to reproduce it?

Please attach the source code for the hook library you were testing with.

panjiancai · Answer 2 · Sun Feb 07 2021 01:57:51 GMT+0800 (China Standard Time)

system info are:
dlp@dlpdeMac AnAlbumCover % nvram boot-args
boot-args debug=0x144 kext-dev-mode=1 kcsuffix=development pmuflags=1 -v keepsyms=1
dlp@dlpdeMac AnAlbumCover % uname -r
19.6.0
dlp@dlpdeMac AnAlbumCover % csrutil status
System Integrity Protection status: disabled.
dlp@dlpdeMac AnAlbumCover %

It's not even close to loading the Hook library and it's panic.

Steven Michaud · Answer 3 · Sun Feb 07 2021 02:05:38 GMT+0800 (China Standard Time)

Ah, I see you're using the development kernel. I did very little testing with that for HookCase 5.0. You may need to go back to the release kernel.

How did you generate the images you attached? What program(s) did you use, and how?

It's not even close to loading the Hook library and it's panic.

What does this mean? How, exactly did you try to load the hook library (if that's what you were doing)? How do you know the panic happened before the hook library was loaded?

panjiancai · Answer 4 · Sun Feb 07 2021 02:21:59 GMT+0800 (China Standard Time)

1.yes ,I using development kernel, but after I switch to release kernel, It panic too.
2.I don't copy my dylib to anywhere, so I know panic before hook library was loaded.
3.I use VS code, and install codeLLDB .

Steven Michaud · Answer 5 · Sun Feb 07 2021 02:26:32 GMT+0800 (China Standard Time)

I don't know CodeLLDB, and have never tested with it. It's possible that HookCase doesn't get along with it. Try testing HookCase without using CodeLLDB. You may need to (temporarily) uninstall CodeLLDB. You may also need to disable whatever you're doing with Visual Studio.

Steven Michaud · Answer 6 · Sun Feb 07 2021 02:32:54 GMT+0800 (China Standard Time)

One more thing: I have no idea how you're using CodeLLDB and Visual Studio.

Are they somehow running in the background while you test HookCase? Or do you generate some kind of core dump and feed that to CoreLLDB and Visual Studio?

Are you using a second computer to do some kind of kernel debugging?

panjiancai · Answer 7 · Sun Feb 07 2021 02:51:33 GMT+0800 (China Standard Time)

CodeLLDB is just a add-in of Visual Code, It same as LLDB command line. I attach to the virtual machine after it crash(panic) to see what happened, So the crash has nothing to do with Visual Code.

panjiancai · Answer 8 · Sun Feb 07 2021 02:52:52 GMT+0800 (China Standard Time)

I use VMware fusion 12.0.0 as virtual Machine software.

Steven Michaud · Answer 9 · Sun Feb 07 2021 02:53:19 GMT+0800 (China Standard Time)

I attach to the virtual machine after it crash(panic)

What virtual machine?

panjiancai · Answer 10 · Sun Feb 07 2021 02:58:04 GMT+0800 (China Standard Time)

VMware fusion 12.0.0

Steven Michaud · Answer 11 · Sun Feb 07 2021 02:58:14 GMT+0800 (China Standard Time)

I use VMware Fusion a lot, and have never seen your kernel panic. I don't even know how it's possible.

I did use 12.0.0 for a while (on a macOS 10.15.7 host). Now I'm using 12.1.0. Maybe you should try upgrading to Fusion 12.1.0. If I remember correctly, it's a free upgrade from 12.0.0.

panjiancai · Answer 12 · Sun Feb 07 2021 03:03:07 GMT+0800 (China Standard Time)

I think it nothing to do with Fusion 12.0.0. Because I have tested VM 10.14.6 with no problems. (on a MacOS 10.15.7 host)

Steven Michaud · Answer 13 · Sun Feb 07 2021 03:09:16 GMT+0800 (China Standard Time)

I still don't have enough information to do anything with.

Are you able to reproduce the kernel panics? Do they happen every time you do "something"? If so, tell me exactly, step by step, what that "something" is.

Is there anything unusual about how you've set up your macOS 10.15.7 VM?

Without further information I'll have to set this bug aside. At some point in the future I may bump into it myself, and be able to provide the necessary information myself. But before that happens, there's probably nothing I can do.

panjiancai · Answer 14 · Sun Feb 07 2021 03:24:12 GMT+0800 (China Standard Time)

yes , I can reproduce the kernel panics. I remembered that I install KDK. Kernel_Debug_Kit_10.15.7_build_19H15.dmg.I replaced the original kernel with the one inside the KDK.Is it that HookCase is not compatible with other xnu kernels?

panjiancai · Answer 15 · Sun Feb 07 2021 03:26:15 GMT+0800 (China Standard Time)

macOS High Sierra Kernel Debug Kit Read Me
Please Note: After installation, the Kernel Debug Kit will be available at:
/Library/Developer/KDKs/
———————————————————————————————
The kernel file location has changed.
The kernel file location has moved to /System/Library/Kernels/kernel
DEVELOPMENT and DEBUG kernels
 
The macOS High Sierra Kernel Debug Kit includes the DEVELOPMENT and DEBUG kernel builds. These both have additional assertions and error checking compared to the RELEASE kernel. The DEVELOPMENT kernel can be used for every-day use and has minimal performance overhead, while the DEBUG kernel has much more error checking.
 
To allow development using the Kernel Development Kit on macOS High Sierra, you will need to modify the security configuration with the following steps:
 

Reboot to the Recovery System by restarting your Mac and hold down the Command and R keys at startup. 2. From the Utilities menu, select “Terminal”. 3. Type, “csrutil disable” to disable System Integrity Protection, “csrutil enable” to reenable System Integrity Protection. 4. Restart your Mac.
 
To install these kernels, copy the kernel.development or kernel.debug file from the KDK to /System/Library/Kernels, and add “kcsuffix=development” (or “kcsuffix=debug” as appropriate) to your boot args. Please note, you will need to rebuild your kextcache to use the new kernel for debugging. This can be done by running the “kextcache -invalidate” command against the target volume as follows:
 
sudo kextcache -invalidate /Volumes/  sudo reboot
To return to the Release kernel, delete the kernel.development/kernel.debug file, remove the “kcsuffix” boot-args and run the following:
 
sudo rm /System/Library/Caches/com.apple.kext.caches/Startup/kernelcache.de  sudo rm /System/Library/PrelinkedKernels/prelinkedkernel.de  sudo kextcache -invalidate /  sudo reboot

panjiancai · Answer 16 · Sun Feb 07 2021 03:27:21 GMT+0800 (China Standard Time)

you can download KDK from https://developer.apple.com/download/more/

panjiancai · Answer 17 · Sun Feb 07 2021 03:30:42 GMT+0800 (China Standard Time)

I verified that using the original kernel, it does not panic.

panjiancai · Answer 18 · Sun Feb 07 2021 03:33:01 GMT+0800 (China Standard Time)

Have I provided enough information? If not, please let me know. This software of yours is very good, thank you very much for sharing it. Please get the problem corrected as soon as possible.

Steven Michaud · Answer 19 · Sun Feb 07 2021 03:54:43 GMT+0800 (China Standard Time)

So you see kernel panics with the "release" kernel that comes with the Kernel_Debug_Kit_10.15.7_build_19H15, but not with the "release" kernel that was originally installed?

What's the build id of your current version of macOS 10.15.7? The most recent version (released on 2021/02/01) has build id 19H512. The version before that, with build id 19H114, was released on 2020/12/14. (https://en.wikipedia.org/wiki/MacOS_Catalina#Release_history) Build id 19H15 was released on 2020/11/05. But that's the most recent KDK that Apple has made available.

It sounds like kernels from Kernel_Debug_Kit_10.15.7_build_19H15 (the "release" kernel and the others) don't match the version of macOS 10.15.7 that you're actually running. No wonder you had problems.

HookCase will never support kernels that don't match the release they've been installed on.

panjiancai · Answer 20 · Sun Feb 07 2021 09:52:57 GMT+0800 (China Standard Time)

When I use the kernel included in Kernel_Debug_Kit_10.15.7_build_19H15, I have no problem running other kernel extensions. I also have no problem using our own kernel extensions, and all the apps run fine, so I guess it's compatible with the original distribution.
My current version of macOS 's build id is :10.15.7 (19H2).
I guess HookCase use hard code to adapted to the operating system.
I have used many KDKs, which are not very compatible with macOS distributions, but will be a little newer than the newer versions of macOS releases, all without running problems and startup issues.
Hookcase is amazing, thank you for your efforts. Can you tell me where to modify to adapt to the new kernel? I'll change it myself and let you know when I'm done, is that okay? I use the KDK a lot because I often can't find a version of the KDK that exactly matches the macOS distribution.

Steven Michaud · Answer 21 · Sun Feb 07 2021 12:56:25 GMT+0800 (China Standard Time)

Why do you use the KDK's kernels? Is it because you want (or need) to use the development kernel? If you'd be OK using the release kernel, I see no reason for you not to use the one that came with your particular version of macOS 10.15.7. Alternatively, you could upgrade to build 19H15 -- then your macOS version would match the KDK's version.

What you choose is ultimately up to you. My choice is that I don't have the time or the energy to deal with problems that arise from using mismatched kernels with HookCase.

I suspect you are having problems using mismatched kernels, even when HookCase is not involved. HookCase is compatible with each and every version of macOS 10.15.7 that Apple has released. I test each new one as it comes out. But it reaches deeper into the kernel's internals than any other kernel extension. So it's not too surprising if using it tends to magnify these problems.

It will be a lot of work to adapt HookCase to your needs. I frankly suspect you won't be able to do it. But if you insist, I would start by disabling parts of HookCase's functionality, to see if that makes your problems go away. In the case of the kernel panic you reported, I'd try disabling the user_trap hook, by commenting out the call to hook_user_trap(). This will disable HookCase's watchpoint support. But that might be worthwhile if it gets rid of your kernel panics.

panjiancai · Answer 22 · Sun Feb 07 2021 19:52:25 GMT+0800 (China Standard Time)

Thansks. I will disable user_trap. After do that ,It ok for hook lib.
However, I have encountered another problem where the Hook causes the process to crash. I have SIP enabled on my system and I am attaching the crash logs.
`Process: Script Editor [359]
Path: /Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor
Identifier: com.apple.ScriptEditor2
Version: 2.11 (203.1)
Build Info: ScriptEditorX-203001000000000~37
Code Type: X86-64 (Native)
Parent Process: ??? [1]
Responsible: Script Editor [359]
User ID: 501

PlugIn Path: /usr/lib/dyld
PlugIn Identifier: dyld
PlugIn Version: ??? (655.1.1)

Date/Time: 2021-02-07 03:45:51.623 -0800
OS Version: Mac OS X 10.14.6 (18G103)
Report Version: 12
Anonymous UUID: E2B3B779-A9F0-2B29-A450-43A24BAB8AB0

Time Awake Since Boot: 1300 seconds

System Integrity Protection: enabled

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_ACCESS (Code Signature Invalid)
Exception Codes: 0x0000000000000032, 0x0000000109de9886
Exception Note: EXC_CORPSE_NOTIFY

Termination Reason: Namespace CODESIGNING, Code 0x2

kernel messages:

VM Regions Near 0x109de9886:
mapped file 00000001076e9000-0000000107a08000 [ 3196K] rw-/rwx SM=COW Object_id=af819109
--> __TEXT 0000000109de7000-0000000109e52000 [ 428K] r-x/rwx SM=COW /usr/lib/dyld
__DATA 0000000109e52000-0000000109e57000 [ 20K] rw-/rwx SM=COW /usr/lib/dyld

Application Specific Information:
dyld: in dlopen()

Thread 0 Crashed:: 0 dyld 1 dyld 2 libdyld.dylib 3 com.apple.Foundation 4 com.apple.Foundation 5 com.apple.AppKit 6 libdispatch.dylib 7 libdispatch.dylib 8 com.apple.AppKit 9 com.apple.AppKit 10 com.apple.AppKit 11 com.apple.AppKit 12 com.apple.AppKit 13 com.apple.AppKit 14 com.apple.AppKit 15 com.apple.Foundation 16 com.apple.Foundation 17 com.apple.AE 18 com.apple.AE 19 com.apple.AE 20 com.apple.HIToolbox 21 com.apple.AppKit 22 com.apple.AppKit 23 com.apple.AppKit 24 com.apple.AppKit 25 libdyld.dylib Dispatch queue: com.apple.main-thread
0x0000000109de9886 dyld::mainExecutable() + 0
0x0000000109df6297 dlopen_internal + 282
0x00007fff7f162d43 dlopen + 200
0x00007fff554f143e _NSSoftLinkingLoadFramework + 212
0x00007fff55502bb1 _NSSoftLinkingGetFrameworkFunction + 41
0x00007fff50a9a56e __57-[NSDocumentController _setInvokeVersionsForTimeMachine:]_block_invoke + 32
0x00007fff7f12a63d _dispatch_client_callout + 8
0x00007fff7f12bd4b _dispatch_once_callout + 20
0x00007fff50a9a54c -[NSDocumentController _setInvokeVersionsForTimeMachine:] + 79
0x00007fff50a9a341 -[NSDocumentController addDocument:] + 316
0x00007fff50a988cc -[NSDocumentController openUntitledDocumentAndDisplay:error:] + 390
0x00007fff5081e4f0 -[NSDocumentController(NSInternal) _openUntitled] + 102
0x00007fff5081e1f8 -[NSApplication _doOpenUntitled] + 451
0x00007fff50ce7bdf -[NSApplication(NSAppleEventHandling) _handleAEReopen:] + 356
0x00007fff5081c69b -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 688
0x00007fff554c5700 -[NSAppleEventManager dispatchRawAppleEvent:withRawReply:handlerRefCon:] + 286
0x00007fff554c557d _NSAppleEventManagerGenericHandler + 102
0x00007fff54447397 aeDispatchAppleEvent(AEDesc const*, AEDesc*, unsigned int, unsigned char*) + 1815
0x00007fff54446c29 dispatchEventAndSendReply(AEDesc const*, AEDesc*) + 41
0x00007fff54446b01 aeProcessAppleEvent + 414
0x00007fff524898b7 AEProcessAppleEvent + 54
0x00007fff50818a9d _DPSNextEvent + 1935
0x00007fff5081746b -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1361
0x00007fff50811588 -[NSApplication run] + 699
0x00007fff50800ac8 NSApplicationMain + 777
0x00007fff7f1773d5 start + 1

Thread 1:: com.apple.NSEventThread
0 libsystem_kernel.dylib 0x00007fff7f2ac22a mach_msg_trap + 10
1 libsystem_kernel.dylib 0x00007fff7f2ac76c mach_msg + 60
2 com.apple.CoreFoundation 0x00007fff5322294e __CFRunLoopServiceMachPort + 328
3 com.apple.CoreFoundation 0x00007fff53221ebc __CFRunLoopRun + 1612
4 com.apple.CoreFoundation 0x00007fff5322161e CFRunLoopRunSpecific + 455
5 com.apple.AppKit 0x00007fff508204a2 _NSEventThread + 175
6 libsystem_pthread.dylib 0x00007fff7f36b2eb _pthread_body + 126
7 libsystem_pthread.dylib 0x00007fff7f36e249 _pthread_start + 66
8 libsystem_pthread.dylib 0x00007fff7f36a40d thread_start + 13

Thread 2:
0 libsystem_pthread.dylib 0x00007fff7f36a3f0 start_wqthread + 0

Thread 3:
0 libsystem_pthread.dylib 0x00007fff7f36a3f0 start_wqthread + 0

Thread 4:
0 libsystem_pthread.dylib 0x00007fff7f36a3f0 start_wqthread + 0

Thread 0 crashed with X86 Thread State (64-bit):
rax: 0x65e8342501040010 rbx: 0x0000000109e5b3d8 rcx: 0x0000000000000013 rdx: 0x00007ffeeb1d1890
rdi: 0x0000000109e5b3d8 rsi: 0x0000000109e55938 rbp: 0x00007ffeeb1d18e0 rsp: 0x00007ffeeb1d1858
r8: 0x0000000109e58228 r9: 0x00007fffb59fa920 r10: 0x00007fffb59fa928 r11: 0x00007fef30f014f0
r12: 0x0000000109e55a00 r13: 0x00007fff7d99b62f r14: 0x0000000000000000 r15: 0x00007fef30e03fd0
rip: 0x0000000109de9886 rfl: 0x0000000000010246 cr2: 0x0000000109de9886

Logical CPU: 3
Error Code: 0x00000014
Trap Number: 14

Binary Images:
0x104a2d000 - 0x104a75fff com.apple.ScriptEditor2 (2.11 - 203.1) <29E3BBD1-FE51-34BB-88B1-D8C964D2D960> /Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor
0x104a99000 - 0x104a9affb libdse_system_dlib.dylib (0) /usr/lib/libdse_system_dlib.dylib
0x1065f6000 - 0x1065fbfff com.apple.ScriptEditor.Library (2.8 - 203.1) <6F89F856-4BC6-3BDE-9412-8602D4944717> /System/Library/Script Editor Plugins/Library.seplugin/Contents/MacOS/Library
0x10665b000 - 0x10665fff3 com.apple.ScriptEditor.DictionaryViewer (2.8 - 203.1) /System/Library/Script Editor Plugins/DictionaryViewer.seplugin/Contents/MacOS/DictionaryViewer
0x106666000 - 0x106668fff com.apple.ScriptEditor.ScriptManager (2.8 - 203.1) <493ABB1E-0F66-3BB5-A913-3EE89F6BA2CC> /System/Library/Script Editor Plugins/ScriptManager.seplugin/Contents/MacOS/ScriptManager
0x106677000 - 0x106677fff com.apple.applescript.component (2.7 - 389.1) /System/Library/Components/AppleScript.component/Contents/MacOS/AppleScript
0x109de7000 - 0x109e5170f dyld (655.1.1) /usr/lib/dyld
0x7fff4790d000 - 0x7fff4791cff7 libSimplifiedChineseConverter.dylib (73) <1D43794E-BEB8-359B-A27D-A8C623C925B1> /System/Library/CoreServices/Encodings/libSimplifiedChineseConverter.dylib
0x7fff4f5ca000 - 0x7fff4f5cafff com.apple.Accelerate (1.11 - Accelerate 1.11) <762942CB-CFC9-3A0C-9645-A56523A06426> /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x7fff4f5e2000 - 0x7fff4fc7bfef com.apple.vImage (8.1 - ???) <53FA3611-894E-3158-A654-FBD2F70998FE> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
0x7fff4fc7c000 - 0x7fff4fef5ff3 libBLAS.dylib (1243.200.4) <417CA0FC-B6CB-3FB3-ACBC-8914E3F62D20> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
0x7fff4fef6000 - 0x7fff4ff68ffb libBNNS.dylib (38.250.1) <538D12A2-9B9D-3E22-9896-F90F6E69C06E> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBNNS.dylib
0x7fff4ff69000 - 0x7fff50312ff3 libLAPACK.dylib (1243.200.4) <92175DF4-863A-3780-909A-A3E5C410F2E9> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
0x7fff50313000 - 0x7fff50328feb libLinearAlgebra.dylib (1243.200.4) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLinearAlgebra.dylib
0x7fff50329000 - 0x7fff5032eff3 libQuadrature.dylib (3.200.2) <1BAE7E22-2862-379F-B334-A3756067730F> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libQuadrature.dylib
0x7fff5032f000 - 0x7fff503abff3 libSparse.dylib (79.200.5) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libSparse.dylib
0x7fff503ac000 - 0x7fff503bffe3 libSparseBLAS.dylib (1243.200.4) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libSparseBLAS.dylib
0x7fff503c0000 - 0x7fff505a7ff7 libvDSP.dylib (671.250.4) <7B110627-A9C1-3FB7-A077-0C7741BA25D8> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib
0x7fff505a8000 - 0x7fff5065bff7 libvMisc.dylib (671.250.4) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
0x7fff5065c000 - 0x7fff5065cfff com.apple.Accelerate.vecLib (3.11 - vecLib 3.11) <74288115-EF61-30B6-843F-0593B31D4929> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib
0x7fff507fe000 - 0x7fff515b3ffb com.apple.AppKit (6.9 - 1671.60.109) /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x7fff515f4000 - 0x7fff51604fff com.apple.AppleScriptObjC (1.4 - 35) <9BDF3D28-05F7-3FFF-A890-68C809F0DD66> /System/Library/Frameworks/AppleScriptObjC.framework/Versions/A/AppleScriptObjC
0x7fff51605000 - 0x7fff51605fff com.apple.ApplicationServices (50.1 - 50.1) <84097DEB-E2FC-3901-8DD7-A670EA2274E0> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x7fff51606000 - 0x7fff51671fff com.apple.ApplicationServices.ATS (377 - 453.11.2.2) /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
0x7fff5170a000 - 0x7fff51821fff libFontParser.dylib (228.6.2.3) <3602D55B-3B9E-3B3A-A814-08C1244A8AE4> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontParser.dylib
0x7fff51822000 - 0x7fff51864fff libFontRegistry.dylib (228.12.2.3) <2A56347B-2809-3407-A8B4-2AB88E484062> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontRegistry.dylib
0x7fff518be000 - 0x7fff518f0fff libTrueTypeScaler.dylib (228.6.2.3) <7E4C5D9C-51AF-3EC1-8FA5-11CD4BEE477A> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libTrueTypeScaler.dylib
0x7fff51955000 - 0x7fff51959ff3 com.apple.ColorSyncLegacy (4.13.0 - 1) /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSyncLegacy.framework/Versions/A/ColorSyncLegacy
0x7fff519f4000 - 0x7fff51a46ff7 com.apple.HIServices (1.22 - 628) <2BE461FF-80B9-30D3-A574-AED5724B1C1B> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
0x7fff51a47000 - 0x7fff51a56fff com.apple.LangAnalysis (1.7.0 - 1.7.0) /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x7fff51a57000 - 0x7fff51aa0ff7 com.apple.print.framework.PrintCore (14.2 - 503.8) <57C2FE32-0E74-3079-B626-C2D52F2D2717> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x7fff51aa1000 - 0x7fff51adaff7 com.apple.QD (3.12 - 407.2) <28C7D39F-59C9-3314-BECC-67045487229C> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
0x7fff51adb000 - 0x7fff51ae7fff com.apple.speech.synthesis.framework (8.1.3 - 8.1.3) <5E7B9BD4-122B-3012-A044-3259C97E7509> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x7fff51ae8000 - 0x7fff51d5fff7 com.apple.audio.toolbox.AudioToolbox (1.14 - 1.14) <04F482F1-E1C1-3955-8A6C-8AA152AA06F3> /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x7fff51d61000 - 0x7fff51d61fff com.apple.audio.units.AudioUnit (1.14 - 1.14) /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x7fff520ba000 - 0x7fff5245bfff com.apple.CFNetwork (978.0.7 - 978.0.7) /System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x7fff52470000 - 0x7fff52470fff com.apple.Carbon (158 - 158) <56AD06AA-7BB4-3F0B-AEF7-9768D0BC1C98> /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x7fff52471000 - 0x7fff52474ffb com.apple.CommonPanels (1.2.6 - 98) <1CD6D56D-8EC7-3528-8CBC-FC69533519B5> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
0x7fff52475000 - 0x7fff5276cfff com.apple.HIToolbox (2.1.1 - 918.7) <13F69D4C-D19F-3E09-9231-1978D783A556> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x7fff5276d000 - 0x7fff52770ff3 com.apple.help (1.3.8 - 66) /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
0x7fff52771000 - 0x7fff52776ff7 com.apple.ImageCapture (9.0 - 1534.2) /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
0x7fff52777000 - 0x7fff5280cff3 com.apple.ink.framework (10.9 - 225) <7C7E9483-2E91-3DD3-B1E0-C238F42CA0DD> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
0x7fff5280d000 - 0x7fff52825ff7 com.apple.openscripting (1.7 - 179.1) <9B8C1ECC-5864-3E21-9149-863E884EA25C> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
0x7fff52845000 - 0x7fff52846ff7 com.apple.print.framework.Print (14.2 - 267.4) /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
0x7fff52847000 - 0x7fff52849ff7 com.apple.securityhi (9.0 - 55006) <05717F77-7A7B-37E6-AB3E-03F063E9095B> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
0x7fff5284a000 - 0x7fff52850ff7 com.apple.speech.recognition.framework (6.0.3 - 6.0.3) <3CC050FB-EBCB-3087-8EA5-F378C8F99217> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x7fff52851000 - 0x7fff52971fff com.apple.cloudkit.CloudKit (736.232 - 736.232) /System/Library/Frameworks/CloudKit.framework/Versions/A/CloudKit
0x7fff52972000 - 0x7fff52972fff com.apple.Cocoa (6.11 - 23) /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x7fff52980000 - 0x7fff52acfff7 com.apple.ColorSync (4.13.0 - 3345.6) <31648BB6-7239-3D0E-81B1-BCF51FEF557F> /System/Library/Frameworks/ColorSync.framework/Versions/A/ColorSync
0x7fff52c5b000 - 0x7fff52ce1fff com.apple.audio.CoreAudio (4.3.0 - 4.3.0) <1E8E64E6-0E58-375A-97F7-07CB4EE181AC> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x7fff52d45000 - 0x7fff52d6fffb com.apple.CoreBluetooth (1.0 - 1) /System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth
0x7fff52d70000 - 0x7fff530f5fef com.apple.CoreData (120 - 866.6) <132CB39B-8D58-30FA-B8AD-49BFFF34B293> /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x7fff530f6000 - 0x7fff531e6ff7 com.apple.CoreDisplay (101.3 - 110.18) <0EB2A997-FCAD-3D17-B140-9829961E5327> /System/Library/Frameworks/CoreDisplay.framework/Versions/A/CoreDisplay
0x7fff531e7000 - 0x7fff5362cff7 com.apple.CoreFoundation (6.9 - 1575.22) <51040EEE-7C5D-3433-A271-86B47B0562BF> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x7fff5362e000 - 0x7fff53cbdfff com.apple.CoreGraphics (2.0 - 1265.9) /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x7fff53cbf000 - 0x7fff53fdffff com.apple.CoreImage (14.4.0 - 750.0.140) <11026E39-D2FF-3CF6-8ACE-7BA293F9853E> /System/Library/Frameworks/CoreImage.framework/Versions/A/CoreImage
0x7fff53fe0000 - 0x7fff54058fff com.apple.corelocation (2245.16.14) <0F59F59B-AC14-3116-83C5-CF7BC57D9EB1> /System/Library/Frameworks/CoreLocation.framework/Versions/A/CoreLocation
0x7fff5443d000 - 0x7fff5443dfff com.apple.CoreServices (946 - 946) <2EB6117A-6389-311B-95A0-7DE32C5FCFE2> /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x7fff5443e000 - 0x7fff544baff7 com.apple.AE (773 - 773) <55AE7C9E-27C3-30E9-A047-3B92A6FD53B4> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
0x7fff544bb000 - 0x7fff54792fff com.apple.CoreServices.CarbonCore (1178.33 - 1178.33) /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x7fff54793000 - 0x7fff547dbff7 com.apple.DictionaryServices (1.2 - 284.16.4) <746EB200-DC51-30AE-9CBC-608A7B4CC8DA> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices
0x7fff547dc000 - 0x7fff547e4ffb com.apple.CoreServices.FSEvents (1239.200.12 - 1239.200.12) <8406D379-8D33-3611-861B-7ABD26DB50D2> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvents.framework/Versions/A/FSEvents
0x7fff547e5000 - 0x7fff54996ff7 com.apple.LaunchServices (946 - 946) /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
0x7fff54997000 - 0x7fff54a35ff7 com.apple.Metadata (10.7.0 - 1191.57) /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
0x7fff54a36000 - 0x7fff54a80ff7 com.apple.CoreServices.OSServices (946 - 946) <20C4EEF8-D5AC-39A0-9B4A-78F88E3EFBCC> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x7fff54a81000 - 0x7fff54ae8ff7 com.apple.SearchKit (1.4.0 - 1.4.0) /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x7fff54ae9000 - 0x7fff54b0aff3 com.apple.coreservices.SharedFileList (71.28 - 71.28) <487A8464-729E-305A-B5D1-E3FE8EB9CFC5> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SharedFileList.framework/Versions/A/SharedFileList
0x7fff54e15000 - 0x7fff54f77ff3 com.apple.CoreText (352.0 - 584.26.3.2) <59919B0C-CBD5-3877-8D6F-D6048F1E5F42> /System/Library/Frameworks/CoreText.framework/Versions/A/CoreText
0x7fff54f78000 - 0x7fff54fb8ff3 com.apple.CoreVideo (1.8 - 281.4) <10CF8E52-07E3-382B-8091-2CEEEFFA69B4> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
0x7fff54fb9000 - 0x7fff55048fff com.apple.framework.CoreWLAN (13.0 - 1375.2) /System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN
0x7fff5529f000 - 0x7fff552a4ffb com.apple.DiskArbitration (2.7 - 2.7) /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x7fff5546a000 - 0x7fff55817ffb com.apple.Foundation (6.9 - 1575.22) /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x7fff55886000 - 0x7fff558b5ffb com.apple.GSS (4.0 - 2.0) /System/Library/Frameworks/GSS.framework/Versions/A/GSS
0x7fff559b5000 - 0x7fff55abffff com.apple.Bluetooth (6.0.14 - 6.0.14d3) /System/Library/Frameworks/IOBluetooth.framework/Versions/A/IOBluetooth
0x7fff55b22000 - 0x7fff55bb1fff com.apple.framework.IOKit (2.0.2 - 1483.260.4) <8A90F547-86EF-3DFB-92FE-0E2C0376DD84> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x7fff55bb3000 - 0x7fff55bc2ffb com.apple.IOSurface (255.6.1 - 255.6.1) <85F85EBB-EA59-3A8B-B3EB-7C20F3CC77AE> /System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface
0x7fff55c16000 - 0x7fff55da1fef com.apple.ImageIO.framework (3.3.0 - 1850.2) <75E46A31-D87D-35CE-86A4-96A50971FDB2> /System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x7fff55da2000 - 0x7fff55da6ffb libGIF.dylib (1850.2) <4774EBDF-583B-3DDD-A0E1-9F427CB6A074> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
0x7fff55da7000 - 0x7fff55e83fef libJP2.dylib (1850.2) <697BB77F-A682-339F-8659-35432962432D> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib
0x7fff55e84000 - 0x7fff55ea9feb libJPEG.dylib (1850.2) <171A8AC4-AADA-376F-9F2C-B9C978DB1007> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
0x7fff5616c000 - 0x7fff56192feb libPng.dylib (1850.2) /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
0x7fff56193000 - 0x7fff56195ffb libRadiance.dylib (1850.2) <56907025-D5CE-3A9E-ACCB-A376C2599853> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
0x7fff56196000 - 0x7fff561e3fe7 libTIFF.dylib (1850.2) /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
0x7fff57356000 - 0x7fff5736ffff com.apple.Kerberos (3.0 - 1) /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
0x7fff57d8b000 - 0x7fff57e33ff7 com.apple.Metal (162.2 - 162.2) /System/Library/Frameworks/Metal.framework/Versions/A/Metal
0x7fff57e4f000 - 0x7fff57e6eff7 com.apple.MetalPerformanceShaders.MPSCore (1.0 - 1) <44CE8362-E972-3697-AD6F-15BC863BAEB8> /System/Library/Frameworks/MetalPerformanceShaders.framework/Frameworks/MPSCore.framework/Versions/A/MPSCore
0x7fff57e6f000 - 0x7fff57eebfe7 com.apple.MetalPerformanceShaders.MPSImage (1.0 - 1) /System/Library/Frameworks/MetalPerformanceShaders.framework/Frameworks/MPSImage.framework/Versions/A/MPSImage
0x7fff57eec000 - 0x7fff57f13fff com.apple.MetalPerformanceShaders.MPSMatrix (1.0 - 1) /System/Library/Frameworks/MetalPerformanceShaders.framework/Frameworks/MPSMatrix.framework/Versions/A/MPSMatrix
0x7fff57f14000 - 0x7fff5803fff7 com.apple.MetalPerformanceShaders.MPSNeuralNetwork (1.0 - 1) /System/Library/Frameworks/MetalPerformanceShaders.framework/Frameworks/MPSNeuralNetwork.framework/Versions/A/MPSNeuralNetwork
0x7fff58040000 - 0x7fff5805afff com.apple.MetalPerformanceShaders.MPSRayIntersector (1.0 - 1) /System/Library/Frameworks/MetalPerformanceShaders.framework/Frameworks/MPSRayIntersector.framework/Versions/A/MPSRayIntersector
0x7fff5805b000 - 0x7fff5805cff7 com.apple.MetalPerformanceShaders.MetalPerformanceShaders (1.0 - 1) <69F14BCF-C5C5-3BF8-9C31-8F87D2D6130A> /System/Library/Frameworks/MetalPerformanceShaders.framework/Versions/A/MetalPerformanceShaders
0x7fff58e53000 - 0x7fff58e5fff7 com.apple.NetFS (6.0 - 4.0) /System/Library/Frameworks/NetFS.framework/Versions/A/NetFS
0x7fff59186000 - 0x7fff591c1fff com.apple.OSAKit (1.5 - 107) <879FB449-D01A-3D47-B733-F228FC060B1B> /System/Library/Frameworks/OSAKit.framework/Versions/A/OSAKit
0x7fff5b8fd000 - 0x7fff5b954ff7 com.apple.opencl (2.15.3 - 2.15.3) <056BAD8A-23BC-3F74-9E2C-3AC81E7DEA5A> /System/Library/Frameworks/OpenCL.framework/Versions/A/OpenCL
0x7fff5b955000 - 0x7fff5b970ff7 com.apple.CFOpenDirectory (10.14 - 207.200.4) /System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory
0x7fff5b971000 - 0x7fff5b97cffb com.apple.OpenDirectory (10.14 - 207.200.4) /System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory
0x7fff5c2cc000 - 0x7fff5c2cefff libCVMSPluginSupport.dylib (17.7.3) <8E051EA7-55B6-3DF1-9821-72C391DE953B> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCVMSPluginSupport.dylib
0x7fff5c2cf000 - 0x7fff5c2d4ff3 libCoreFSCache.dylib (166.2) <222C2A4F-7E32-30F6-8459-2FAB98073A3D> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreFSCache.dylib
0x7fff5c2d5000 - 0x7fff5c2d9fff libCoreVMClient.dylib (166.2) <6789ECD4-91DD-32EF-A1FD-F27D2344CD8B> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreVMClient.dylib
0x7fff5c2da000 - 0x7fff5c2e2ff7 libGFXShared.dylib (17.7.3) <8C50BF27-B525-3B23-B86C-F444ADF97851> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGFXShared.dylib
0x7fff5c2e3000 - 0x7fff5c2eefff libGL.dylib (17.7.3) <2AC457EA-1BD3-3C8E-AFAB-7EA6234EB749> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x7fff5c2ef000 - 0x7fff5c329fef libGLImage.dylib (17.7.3) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
0x7fff5c49d000 - 0x7fff5c4dbfff libGLU.dylib (17.7.3) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x7fff5ce78000 - 0x7fff5ce87ffb com.apple.opengl (17.7.3 - 17.7.3) <94B5CF34-5BD6-3652-9A8C-E9C56E0A9FB4> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x7fff5dc8a000 - 0x7fff5dee1ff7 com.apple.QuartzCore (1.11 - 701.14) <33E846BE-1794-3186-9BF2-6ADF62C782A3> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x7fff5e716000 - 0x7fff5ea16fff com.apple.security (7.0 - 58286.270.3.0.1) /System/Library/Frameworks/Security.framework/Versions/A/Security
0x7fff5ea17000 - 0x7fff5eaa3fff com.apple.securityfoundation (6.0 - 55185.260.1) <1EE899E6-222A-3526-B505-B0D0B6FA042A> /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation
0x7fff5ead5000 - 0x7fff5ead9fff com.apple.xpc.ServiceManagement (1.0 - 1) /System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement
0x7fff5ee72000 - 0x7fff5eedffff com.apple.SystemConfiguration (1.17 - 1.17) <30C8327F-3EFF-3520-9C50-016F8B6B954F> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x7fff6211b000 - 0x7fff621c0feb com.apple.APFS (1.0 - 1) <2D22485D-552D-3CB6-9FE1-38547597918F> /System/Library/PrivateFrameworks/APFS.framework/Versions/A/APFS
0x7fff62bd5000 - 0x7fff62bd6ff7 com.apple.AggregateDictionary (1.0 - 1) /System/Library/PrivateFrameworks/AggregateDictionary.framework/Versions/A/AggregateDictionary
0x7fff631d7000 - 0x7fff63203ff7 com.apple.framework.Apple80211 (13.0 - 1380.2) <16F093EF-370B-3B90-8DB4-E94624431D15> /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Apple80211
0x7fff6332b000 - 0x7fff6333afc7 com.apple.AppleFSCompression (96.200.3 - 1.0) <3CF60CE8-976E-3CB8-959D-DD0948C1C2DE> /System/Library/PrivateFrameworks/AppleFSCompression.framework/Versions/A/AppleFSCompression
0x7fff63436000 - 0x7fff63441fff com.apple.AppleIDAuthSupport (1.0 - 1) <2E9D1398-DBE6-328B-ADDA-20FA5FAD7405> /System/Library/PrivateFrameworks/AppleIDAuthSupport.framework/Versions/A/AppleIDAuthSupport
0x7fff63482000 - 0x7fff634cbff3 com.apple.AppleJPEG (1.0 - 1) <4C1F426B-7D77-3980-9633-7DBD8C666B9A> /System/Library/PrivateFrameworks/AppleJPEG.framework/Versions/A/AppleJPEG
0x7fff6371f000 - 0x7fff63741fff com.apple.applesauce (1.0 - ???) /System/Library/PrivateFrameworks/AppleSauce.framework/Versions/A/AppleSauce
0x7fff63742000 - 0x7fff637c2fff com.apple.applescript (2.7 - 389.1) /System/Library/PrivateFrameworks/AppleScript.framework/Versions/A/AppleScript
0x7fff638a0000 - 0x7fff638b4ffb com.apple.AssertionServices (1.0 - 1) <456E507A-4561-3628-9FBE-173ACE7429D8> /System/Library/PrivateFrameworks/AssertionServices.framework/Versions/A/AssertionServices
0x7fff63c83000 - 0x7fff63d6fff7 com.apple.AuthKit (1.0 - 1) <2765ABE9-54F2-3E45-8A93-1261E251B90D> /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKit
0x7fff63f31000 - 0x7fff63f39fff com.apple.coreservices.BackgroundTaskManagement (1.0 - 57.1) <2A396FC0-7B79-3088-9A82-FB93C1181A57> /System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Versions/A/BackgroundTaskManagement
0x7fff63f3a000 - 0x7fff63fcffff com.apple.backup.framework (1.10.5 - ???) <4EEC51E2-AE4C-340A-B686-901810152C12> /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup
0x7fff63fd0000 - 0x7fff6403dff3 com.apple.BaseBoard (360.28 - 360.28) <68FA8044-F3CD-3BC6-9DAB-27DACF52BFC0> /System/Library/PrivateFrameworks/BaseBoard.framework/Versions/A/BaseBoard
0x7fff64e9b000 - 0x7fff64eeaff7 com.apple.ChunkingLibrary (201 - 201) /System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/ChunkingLibrary
0x7fff65004000 - 0x7fff65089ff7 com.apple.CloudDocs (1.0 - 575.302) <524BC6E6-9AF7-3DBE-8FC5-BD35B7A94B55> /System/Library/PrivateFrameworks/CloudDocs.framework/Versions/A/CloudDocs
0x7fff65ca8000 - 0x7fff65cb1ffb com.apple.CommonAuth (4.0 - 2.0) <93335CB6-ABEB-3EC7-A040-8A667F40D5F3> /System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth
0x7fff6657c000 - 0x7fff6659afff com.apple.CoreAnalytics.CoreAnalytics (1.0 - 1) <5AFC8A18-30CA-3D29-A509-DF21AC4DB921> /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics
0x7fff6698a000 - 0x7fff6699bff7 com.apple.CoreEmoji (1.0 - 69.19.9) <228457B3-E191-356E-9A5B-3C0438D05FBA> /System/Library/PrivateFrameworks/CoreEmoji.framework/Versions/A/CoreEmoji
0x7fff66f45000 - 0x7fff66fabff7 com.apple.CoreNLP (1.0 - 130.15.22) <27877820-17D0-3B02-8557-4014E876CCC7> /System/Library/PrivateFrameworks/CoreNLP.framework/Versions/A/CoreNLP
0x7fff67258000 - 0x7fff67260ff7 com.apple.CorePhoneNumbers (1.0 - 1) <11F97C7E-C183-305F-8E6C-9B374F50E26B> /System/Library/PrivateFrameworks/CorePhoneNumbers.framework/Versions/A/CorePhoneNumbers
0x7fff673dc000 - 0x7fff6740dff3 com.apple.CoreServicesInternal (358 - 358) /System/Library/PrivateFrameworks/CoreServicesInternal.framework/Versions/A/CoreServicesInternal
0x7fff677d4000 - 0x7fff67858fff com.apple.CoreSymbolication (10.2 - 64490.25.1) <28B2FF2D-3FDE-3A20-B343-341E5BD4E22F> /System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication
0x7fff678e8000 - 0x7fff67a13ff7 com.apple.coreui (2.1 - 499.10) /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI
0x7fff67a14000 - 0x7fff67bb4fff com.apple.CoreUtils (5.9 - 590.16) <66CC50F7-766D-33E2-A388-4DE22840ADFB> /System/Library/PrivateFrameworks/CoreUtils.framework/Versions/A/CoreUtils
0x7fff67c08000 - 0x7fff67c6bff7 com.apple.framework.CoreWiFi (13.0 - 1375.2) /System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFi
0x7fff67c6c000 - 0x7fff67c7dff7 com.apple.CrashReporterSupport (10.13 - 938.26) /System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport
0x7fff67d0d000 - 0x7fff67d1cfff com.apple.framework.DFRFoundation (1.0 - 211.1) /System/Library/PrivateFrameworks/DFRFoundation.framework/Versions/A/DFRFoundation
0x7fff67d1d000 - 0x7fff67d21ff7 com.apple.DSExternalDisplay (3.1 - 380) <787B9748-B120-3453-B8FE-61D9E363A9E0> /System/Library/PrivateFrameworks/DSExternalDisplay.framework/Versions/A/DSExternalDisplay
0x7fff67da2000 - 0x7fff67e17ffb com.apple.datadetectorscore (7.0 - 590.27) <06FB1A07-7AE6-3ADD-8E7E-41955FAB38E8> /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore
0x7fff67e63000 - 0x7fff67ea0ff7 com.apple.DebugSymbols (190 - 190) <6F4FAACA-E06B-38AD-A0C2-14EA5408A231> /System/Library/PrivateFrameworks/DebugSymbols.framework/Versions/A/DebugSymbols
0x7fff67ea1000 - 0x7fff67fdcff7 com.apple.desktopservices (1.13.5 - ???) <265C0E94-B8BF-3F58-8D68-EA001EEA0B15> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
0x7fff68f23000 - 0x7fff6933efff com.apple.vision.FaceCore (3.3.4 - 3.3.4) /System/Library/PrivateFrameworks/FaceCore.framework/Versions/A/FaceCore
0x7fff6936f000 - 0x7fff693f4ff7 com.apple.FileProvider (125.130 - 125.130) /System/Library/PrivateFrameworks/FileProvider.framework/Versions/A/FileProvider
0x7fff6e293000 - 0x7fff6e298fff com.apple.GPUWrangler (3.50.12 - 3.50.12) <6C820ED9-F306-3978-B5B8-432AD97BBDAF> /System/Library/PrivateFrameworks/GPUWrangler.framework/Versions/A/GPUWrangler
0x7fff6e626000 - 0x7fff6e64aff3 com.apple.GenerationalStorage (2.0 - 285.101) <84C2E52C-F2C6-3FF8-87E5-3C88A40D3881> /System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/GenerationalStorage
0x7fff6e663000 - 0x7fff6f062fff com.apple.GeoServices (1.0 - 1364.26.4.19.6) <041715B5-D82F-31F6-9133-955A7A66025F> /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/GeoServices
0x7fff6f0a4000 - 0x7fff6f0b3fff com.apple.GraphVisualizer (1.0 - 5) <48D020B7-5938-3FAE-B468-E291AEE2C06F> /System/Library/PrivateFrameworks/GraphVisualizer.framework/Versions/A/GraphVisualizer
0x7fff6f219000 - 0x7fff6f28dffb com.apple.Heimdal (4.0 - 2.0) /System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal
0x7fff70593000 - 0x7fff7059affb com.apple.IOAccelerator (404.14 - 404.14) <11A50171-C8AE-3BBC-9FB9-2A3313FFBD31> /System/Library/PrivateFrameworks/IOAccelerator.framework/Versions/A/IOAccelerator
0x7fff7059e000 - 0x7fff705b6fff com.apple.IOPresentment (1.0 - 42.6) <6DFD9A6E-BF95-3A27-89E7-ACAA9E30D90A> /System/Library/PrivateFrameworks/IOPresentment.framework/Versions/A/IOPresentment
0x7fff7095e000 - 0x7fff7098bff7 com.apple.IconServices (379 - 379) <7BAD562D-4FA3-3E11-863C-1EEBE2406D2C> /System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconServices
0x7fff70c1e000 - 0x7fff70c30ff3 com.apple.security.KeychainCircle.KeychainCircle (1.0 - 1) <30CFE05C-4108-3879-AFAA-5BB02CBE190B> /System/Library/PrivateFrameworks/KeychainCircle.framework/Versions/A/KeychainCircle
0x7fff70c4b000 - 0x7fff70d26ff7 com.apple.LanguageModeling (1.0 - 159.15.15) <3DE3CE61-542B-37B7-883E-4B9717CAC65F> /System/Library/PrivateFrameworks/LanguageModeling.framework/Versions/A/LanguageModeling
0x7fff70d27000 - 0x7fff70d63ff7 com.apple.Lexicon-framework (1.0 - 33.15.10) <4B5E843E-2809-3E70-9560-9254E2656419> /System/Library/PrivateFrameworks/Lexicon.framework/Versions/A/Lexicon
0x7fff70d6a000 - 0x7fff70d6ffff com.apple.LinguisticData (1.0 - 238.25) /System/Library/PrivateFrameworks/LinguisticData.framework/Versions/A/LinguisticData
0x7fff71a64000 - 0x7fff71a8cff7 com.apple.spotlight.metadata.utilities (1.0 - 1191.57) <38BB1FB7-3336-384C-B71F-4D0D402EB606> /System/Library/PrivateFrameworks/MetadataUtilities.framework/Versions/A/MetadataUtilities
0x7fff71a8d000 - 0x7fff71b1aff7 com.apple.gpusw.MetalTools (1.0 - 1) /System/Library/PrivateFrameworks/MetalTools.framework/Versions/A/MetalTools
0x7fff71cc5000 - 0x7fff71ce0ffb com.apple.MobileKeyBag (2.0 - 1.0) /System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag
0x7fff71d69000 - 0x7fff71d93ffb com.apple.MultitouchSupport.framework (2450.1 - 2450.1) <42A23EC9-64A7-31C7-BF33-DF4412ED8A3F> /System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/MultitouchSupport
0x7fff71fcf000 - 0x7fff71fd9fff com.apple.NetAuth (6.2 - 6.2) <0D01BBE5-0269-310D-B148-D19DAE143DEB> /System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth
0x7fff7283a000 - 0x7fff7288bff3 com.apple.OTSVG (1.0 - ???) <5BF1A9EB-2694-3267-9514-A4EB3BEF4081> /System/Library/PrivateFrameworks/OTSVG.framework/Versions/A/OTSVG
0x7fff73a23000 - 0x7fff73a32ff7 com.apple.PerformanceAnalysis (1.218.2 - 218.2) <65F3DB3E-6D4E-33A0-B510-EF768D323DAB> /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/PerformanceAnalysis
0x7fff75463000 - 0x7fff75474ffb com.apple.PowerLog (1.0 - 1) <2F41180A-BD8A-3323-87F0-9DC3FD8E1269> /System/Library/PrivateFrameworks/PowerLog.framework/Versions/A/PowerLog
0x7fff7586f000 - 0x7fff758c3ffb com.apple.ProtectedCloudStorage (1.0 - 1) <53B3C1F3-BB97-379F-8CBA-8FDCDF085793> /System/Library/PrivateFrameworks/ProtectedCloudStorage.framework/Versions/A/ProtectedCloudStorage
0x7fff758c4000 - 0x7fff758e2ff7 com.apple.ProtocolBuffer (1 - 263.2) <907D6C95-D050-31DE-99CA-16A5135BC6F9> /System/Library/PrivateFrameworks/ProtocolBuffer.framework/Versions/A/ProtocolBuffer
0x7fff75a7a000 - 0x7fff75acafff com.apple.ROCKit (27.6 - 27.6) <756C2253-E8B1-3C48-9945-DE8D6AD24DE2> /System/Library/PrivateFrameworks/ROCKit.framework/Versions/A/ROCKit
0x7fff75c24000 - 0x7fff75c46fff com.apple.RemoteViewServices (2.0 - 128) <8FB0E4EB-DCBB-32E6-94C6-AA9BA9EE4CAC> /System/Library/PrivateFrameworks/RemoteViewServices.framework/Versions/A/RemoteViewServices
0x7fff77450000 - 0x7fff7756efff com.apple.Sharing (1288.62 - 1288.62) <48B1F247-7910-3C16-814C-B99DE231F7F0> /System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing
0x7fff78382000 - 0x7fff78631fff com.apple.SkyLight (1.600.0 - 340.54) <90EB1C2E-B264-3EC4-AF7F-CDE7E7585746> /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/SkyLight
0x7fff78dd4000 - 0x7fff78de0fff com.apple.SpeechRecognitionCore (5.0.21 - 5.0.21) <7A6A67DB-C813-328E-AAFB-D267A5B50B3D> /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/SpeechRecognitionCore
0x7fff78e92000 - 0x7fff790f5ff3 com.apple.spotlight.index (10.7.0 - 1191.57) <04DE70D5-D9C4-3886-A3DB-6E32040D69E3> /System/Library/PrivateFrameworks/SpotlightIndex.framework/Versions/A/SpotlightIndex
0x7fff79531000 - 0x7fff795bcfc7 com.apple.Symbolication (10.2 - 64490.38.1) <9FDCC98D-5B32-35AD-A9BF-94DF2B78507F> /System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolication
0x7fff795bd000 - 0x7fff795c5ffb com.apple.SymptomDiagnosticReporter (1.0 - 820.267.1) /System/Library/PrivateFrameworks/SymptomDiagnosticReporter.framework/Versions/A/SymptomDiagnosticReporter
0x7fff79aa4000 - 0x7fff79ab0ffb com.apple.TCC (1.0 - 1) <73CF6FA9-44CE-30C9-887F-235940976585> /System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC
0x7fff79d16000 - 0x7fff79ddeff3 com.apple.TextureIO (3.8.4 - 3.8.1) <7CEAC05A-D283-3D5A-B1E3-C849285FA0BF> /System/Library/PrivateFrameworks/TextureIO.framework/Versions/A/TextureIO
0x7fff79e9b000 - 0x7fff7a052ffb com.apple.UIFoundation (1.0 - 551.2) <917480B5-14BE-30E0-ABE6-9702336CC35A> /System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation
0x7fff7acce000 - 0x7fff7ada7fff com.apple.ViewBridge (401.1 - 401.1) <18144EC1-5DEF-369C-8EBA-2826E7142784> /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/ViewBridge
0x7fff7b57f000 - 0x7fff7b582fff com.apple.dt.XCTTargetBootstrap (1.0 - 14490.66) <7AE3457F-AF40-3508-93FB-1D9E31EB1C9D> /System/Library/PrivateFrameworks/XCTTargetBootstrap.framework/Versions/A/XCTTargetBootstrap
0x7fff7b983000 - 0x7fff7b985ffb com.apple.loginsupport (1.0 - 1) <3F8D6334-BCD6-36C1-BA20-CC8503A84375> /System/Library/PrivateFrameworks/login.framework/Versions/A/Frameworks/loginsupport.framework/Versions/A/loginsupport
0x7fff7bc4f000 - 0x7fff7bc83fff libCRFSuite.dylib (41.15.4) <406DAC06-0C77-3F90-878B-4D38F11F0256> /usr/lib/libCRFSuite.dylib
0x7fff7bc86000 - 0x7fff7bc90ff7 libChineseTokenizer.dylib (28.15.3) <9B7F6109-3A5D-3641-9A7E-31D2239D73EE> /usr/lib/libChineseTokenizer.dylib
0x7fff7bd1e000 - 0x7fff7bd1fffb libDiagnosticMessagesClient.dylib (107) /usr/lib/libDiagnosticMessagesClient.dylib
0x7fff7bd56000 - 0x7fff7bfadff3 libFosl_dynamic.dylib (18.3.4) <1B5DD4E2-8AE0-315E-829E-D5BFCD264EA8> /usr/lib/libFosl_dynamic.dylib
0x7fff7bffe000 - 0x7fff7c01dfff libMobileGestalt.dylib (645.270.1) <99A06C8A-97D6-383D-862C-F453BABB48A4> /usr/lib/libMobileGestalt.dylib
0x7fff7c01e000 - 0x7fff7c01efff libOpenScriptingUtil.dylib (179.1) <4D603146-EDA5-3A74-9FF8-4F75D8BB9BC6> /usr/lib/libOpenScriptingUtil.dylib
0x7fff7c15e000 - 0x7fff7c15fffb libSystem.B.dylib (1252.250.1) /usr/lib/libSystem.B.dylib
0x7fff7c1db000 - 0x7fff7c1dcfff libThaiTokenizer.dylib (2.15.1) /usr/lib/libThaiTokenizer.dylib
0x7fff7c1ee000 - 0x7fff7c204ffb libapple_nghttp2.dylib (1.24.1) <6F04250A-6686-3FDC-9A8D-290C64B06502> /usr/lib/libapple_nghttp2.dylib
0x7fff7c205000 - 0x7fff7c22effb libarchive.2.dylib (54.250.1) <47289946-8504-3966-9127-6CE39993DC2C> /usr/lib/libarchive.2.dylib
0x7fff7c22f000 - 0x7fff7c2aefff libate.dylib (1.13.8) <92B44EDB-369D-3EE8-AEC5-61F8B9313DBF> /usr/lib/libate.dylib
0x7fff7c2b2000 - 0x7fff7c2b2ff3 libauto.dylib (187) <3E3780E1-96F3-3A22-91C5-92F9A5805518> /usr/lib/libauto.dylib
0x7fff7c382000 - 0x7fff7c392ffb libbsm.0.dylib (39.200.18) /usr/lib/libbsm.0.dylib
0x7fff7c393000 - 0x7fff7c3a0fff libbz2.1.0.dylib (38.200.3) <272953A1-8D36-329B-BDDB-E887B347710F> /usr/lib/libbz2.1.0.dylib
0x7fff7c3a1000 - 0x7fff7c3f4ff7 libc++.1.dylib (400.9.4) <9A60A190-6C34-339F-BB3D-AACE942009A4> /usr/lib/libc++.1.dylib
0x7fff7c3f5000 - 0x7fff7c40aff7 libc++abi.dylib (400.17) <38C09CED-9090-3719-90F3-04A2749F5428> /usr/lib/libc++abi.dylib
0x7fff7c40b000 - 0x7fff7c40bff3 libcharset.1.dylib (51.200.6) <2A27E064-314C-359C-93FC-8A9B06206174> /usr/lib/libcharset.1.dylib
0x7fff7c40c000 - 0x7fff7c41cffb libcmph.dylib (6.15.1) <9C52B2FE-179F-32AC-B87E-2AFC49ABF817> /usr/lib/libcmph.dylib
0x7fff7c41d000 - 0x7fff7c435ffb libcompression.dylib (52.250.2) <7F4BB18C-1FB4-3825-8D8B-6E6B168774C6> /usr/lib/libcompression.dylib
0x7fff7c6aa000 - 0x7fff7c6c0fff libcoretls.dylib (155.220.1) <4C64BE3E-41E3-3020-8BB7-07E90C0C861C> /usr/lib/libcoretls.dylib
0x7fff7c6c1000 - 0x7fff7c6c2ff3 libcoretls_cfhelpers.dylib (155.220.1) <0959B3E9-6643-3589-8BB3-21D52CDF0EF1> /usr/lib/libcoretls_cfhelpers.dylib
0x7fff7cb6e000 - 0x7fff7cbc4ff3 libcups.2.dylib (462.12) <095619DC-9233-3937-9E50-5F10D917A40D> /usr/lib/libcups.2.dylib
0x7fff7ccf8000 - 0x7fff7ccf8fff libenergytrace.dylib (17.200.1) <80BB567A-FD18-3497-BF97-353F57D98CDD> /usr/lib/libenergytrace.dylib
0x7fff7cd13000 - 0x7fff7cd1ffff libexslt.0.dylib (16.5) /usr/lib/libexslt.0.dylib
0x7fff7cd20000 - 0x7fff7cd21fff libffi.dylib (18.1) /usr/lib/libffi.dylib
0x7fff7cd2a000 - 0x7fff7cd2fff7 libgermantok.dylib (17.15.2) /usr/lib/libgermantok.dylib
0x7fff7cd30000 - 0x7fff7cd35ff7 libheimdal-asn1.dylib (520.270.1) <73F60D6F-76F8-35EF-9C86-9A81225EE4BE> /usr/lib/libheimdal-asn1.dylib
0x7fff7cd60000 - 0x7fff7ce50fff libiconv.2.dylib (51.200.6) <2047C9B7-3F74-3A95-810D-2ED8F0475A99> /usr/lib/libiconv.2.dylib
0x7fff7ce51000 - 0x7fff7d0b2ffb libicucore.A.dylib (62141.0.1) /usr/lib/libicucore.A.dylib
0x7fff7d0ff000 - 0x7fff7d100fff liblangid.dylib (128.15.1) <22D05C4F-769B-3075-ABCF-44A0EBACE028> /usr/lib/liblangid.dylib
0x7fff7d101000 - 0x7fff7d119ff3 liblzma.5.dylib (10.200.3) /usr/lib/liblzma.5.dylib
0x7fff7d131000 - 0x7fff7d1d5ff7 libmecab.1.0.0.dylib (779.24.1) /usr/lib/libmecab.1.0.0.dylib
0x7fff7d1d6000 - 0x7fff7d3dafff libmecabra.dylib (779.24.1) /usr/lib/libmecabra.dylib
0x7fff7d5b2000 - 0x7fff7d903ff7 libnetwork.dylib (1229.250.15) <72C7E9E3-B2BE-3300-BE1B-64606222022C> /usr/lib/libnetwork.dylib
0x7fff7d995000 - 0x7fff7e11afdf libobjc.A.dylib (756.2) <7C312627-43CB-3234-9324-4DEA92D59F50> /usr/lib/libobjc.A.dylib
0x7fff7e12c000 - 0x7fff7e130ffb libpam.2.dylib (22.200.1) <586CF87F-349C-393D-AEEB-FB75F94A5EB7> /usr/lib/libpam.2.dylib
0x7fff7e133000 - 0x7fff7e168fff libpcap.A.dylib (79.250.1) /usr/lib/libpcap.A.dylib
0x7fff7e281000 - 0x7fff7e299ffb libresolv.9.dylib (65.200.2) <893142A5-F153-3437-A22D-407EE542B5C5> /usr/lib/libresolv.9.dylib
0x7fff7e2ec000 - 0x7fff7e4c9fff libsqlite3.dylib (274.26) <6404BA3B-BCA4-301F-B2FE-8776105A2AA3> /usr/lib/libsqlite3.dylib
0x7fff7e6e2000 - 0x7fff7e6e5ff7 libutil.dylib (51.200.4) /usr/lib/libutil.dylib
0x7fff7e6e6000 - 0x7fff7e6f3fff libxar.1.dylib (417.1) <39CCF46B-C81A-34B1-92A1-58C4E5DA846E> /usr/lib/libxar.1.dylib
0x7fff7e6f8000 - 0x7fff7e7daff3 libxml2.2.dylib (32.10) /usr/lib/libxml2.2.dylib
0x7fff7e7db000 - 0x7fff7e803ff3 libxslt.1.dylib (16.5) /usr/lib/libxslt.1.dylib
0x7fff7e804000 - 0x7fff7e816ff7 libz.1.dylib (70.200.4) /usr/lib/libz.1.dylib
0x7fff7effa000 - 0x7fff7effeff3 libcache.dylib (81) <1987D1E1-DB11-3291-B12A-EBD55848E02D> /usr/lib/system/libcache.dylib
0x7fff7efff000 - 0x7fff7f009ff3 libcommonCrypto.dylib (60118.250.2) <1765BB6E-6784-3653-B16B-CB839721DC9A> /usr/lib/system/libcommonCrypto.dylib
0x7fff7f00a000 - 0x7fff7f011ff7 libcompiler_rt.dylib (63.4) <5212BA7B-B7EA-37B4-AF6E-AC4F507EDFB8> /usr/lib/system/libcompiler_rt.dylib
0x7fff7f012000 - 0x7fff7f01bff7 libcopyfile.dylib (146.250.1) <98CD00CD-9B91-3B5C-A9DB-842638050FA8> /usr/lib/system/libcopyfile.dylib
0x7fff7f01c000 - 0x7fff7f0a0fc3 libcorecrypto.dylib (602.260.2) <01464D24-570C-3B83-9D18-467769E0FCDD> /usr/lib/system/libcorecrypto.dylib
0x7fff7f127000 - 0x7fff7f160ff7 libdispatch.dylib (1008.270.1) <97273678-E94C-3C8C-89F6-2E2020F4B43B> /usr/lib/system/libdispatch.dylib
0x7fff7f161000 - 0x7fff7f18dff7 libdyld.dylib (655.1.1) <002418CC-AD11-3D10-865B-015591D24E6C> /usr/lib/system/libdyld.dylib
0x7fff7f18e000 - 0x7fff7f18effb libkeymgr.dylib (30) <0D0F9CA2-8D5A-3273-8723-59987B5827F2> /usr/lib/system/libkeymgr.dylib
0x7fff7f18f000 - 0x7fff7f19bff3 libkxld.dylib (4903.271.2) /usr/lib/system/libkxld.dylib
0x7fff7f19c000 - 0x7fff7f19cff7 liblaunch.dylib (1336.261.2) <2B07E27E-D404-3E98-9D28-BCA641E5C479> /usr/lib/system/liblaunch.dylib
0x7fff7f19d000 - 0x7fff7f1a2fff libmacho.dylib (927.0.3) /usr/lib/system/libmacho.dylib
0x7fff7f1a3000 - 0x7fff7f1a5ffb libquarantine.dylib (86.220.1) <6D0BC770-7348-3608-9254-F7FFBD347634> /usr/lib/system/libquarantine.dylib
0x7fff7f1a6000 - 0x7fff7f1a7ff7 libremovefile.dylib (45.200.2) <9FBEB2FF-EEBE-31BC-BCFC-C71F8D0E99B6> /usr/lib/system/libremovefile.dylib
0x7fff7f1a8000 - 0x7fff7f1bfff3 libsystem_asl.dylib (356.200.4) /usr/lib/system/libsystem_asl.dylib
0x7fff7f1c0000 - 0x7fff7f1c0ff7 libsystem_blocks.dylib (73) /usr/lib/system/libsystem_blocks.dylib
0x7fff7f1c1000 - 0x7fff7f248fff libsystem_c.dylib (1272.250.1) <7EDACF78-2FA3-35B8-B051-D70475A35117> /usr/lib/system/libsystem_c.dylib
0x7fff7f249000 - 0x7fff7f24cffb libsystem_configuration.dylib (963.270.3) <2B4A836D-68A4-33E6-8D48-CD4486B03387> /usr/lib/system/libsystem_configuration.dylib
0x7fff7f24d000 - 0x7fff7f250ff7 libsystem_coreservices.dylib (66) <719F75A4-74C5-3BA6-A09E-0C5A3E5889D7> /usr/lib/system/libsystem_coreservices.dylib
0x7fff7f251000 - 0x7fff7f257fff libsystem_darwin.dylib (1272.250.1) /usr/lib/system/libsystem_darwin.dylib
0x7fff7f258000 - 0x7fff7f25eff7 libsystem_dnssd.dylib (878.270.2) /usr/lib/system/libsystem_dnssd.dylib
0x7fff7f25f000 - 0x7fff7f2aaffb libsystem_info.dylib (517.200.9) /usr/lib/system/libsystem_info.dylib
0x7fff7f2ab000 - 0x7fff7f2d3ff7 libsystem_kernel.dylib (4903.271.2) /usr/lib/system/libsystem_kernel.dylib
0x7fff7f2d4000 - 0x7fff7f31fff7 libsystem_m.dylib (3158.200.7) /usr/lib/system/libsystem_m.dylib
0x7fff7f320000 - 0x7fff7f34afff libsystem_malloc.dylib (166.270.1) <011F3AD0-8E6A-3A89-AE64-6E5F6840F30A> /usr/lib/system/libsystem_malloc.dylib
0x7fff7f34b000 - 0x7fff7f355ff7 libsystem_networkextension.dylib (767.250.2) /usr/lib/system/libsystem_networkextension.dylib
0x7fff7f356000 - 0x7fff7f35dfff libsystem_notify.dylib (172.200.21) <145B5CFC-CF73-33CE-BD3D-E8DDE268FFDE> /usr/lib/system/libsystem_notify.dylib
0x7fff7f35e000 - 0x7fff7f367fef libsystem_platform.dylib (177.270.1) <9D1FE5E4-EB7D-3B3F-A8D1-A96D9CF1348C> /usr/lib/system/libsystem_platform.dylib
0x7fff7f368000 - 0x7fff7f372ff7 libsystem_pthread.dylib (330.250.2) <2D5C08FF-484F-3D59-9132-CE1DCB3F76D7> /usr/lib/system/libsystem_pthread.dylib
0x7fff7f373000 - 0x7fff7f376ff7 libsystem_sandbox.dylib (851.270.1) <9494594B-5199-3186-82AB-5FF8BED6EE16> /usr/lib/system/libsystem_sandbox.dylib
0x7fff7f377000 - 0x7fff7f379ff3 libsystem_secinit.dylib (30.260.2) /usr/lib/system/libsystem_secinit.dylib
0x7fff7f37a000 - 0x7fff7f381ff3 libsystem_symptoms.dylib (820.267.1) <03F1C2DD-0F5A-3D9D-88F6-B26C0F94EB52> /usr/lib/system/libsystem_symptoms.dylib
0x7fff7f382000 - 0x7fff7f397fff libsystem_trace.dylib (906.260.1) /usr/lib/system/libsystem_trace.dylib
0x7fff7f399000 - 0x7fff7f39effb libunwind.dylib (35.4) <24A97A67-F017-3CFC-B0D0-6BD0224B1336> /usr/lib/system/libunwind.dylib
0x7fff7f39f000 - 0x7fff7f3cefff libxpc.dylib (1336.261.2) <7DEE2300-6D8E-3C00-9C63-E3E80D56B0C4> /usr/lib/system/libxpc.dylib

External Modification Summary:
Calls made by other processes targeting this process:
task_for_pid: 263
thread_create: 0
thread_set_state: 0
Calls made by this process:
task_for_pid: 0
thread_create: 0
thread_set_state: 0
Calls made by all processes on this machine:
task_for_pid: 51937
thread_create: 0
thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=386.0M resident=0K(0%) swapped_out_or_unallocated=386.0M(100%)
Writable regions: Total=571.6M written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=571.6M(100%)

                            VIRTUAL   REGION

REGION TYPE SIZE COUNT (non-coalesced)
=========== ======= =======
Activity Tracing 256K 1
CoreUI image file 196K 3
Kernel Alloc Once 8K 1
MALLOC 176.8M 24
MALLOC guard page 32K 7
MALLOC_NANO (reserved) 384.0M 1 reserved VM address space (unallocated)
Memory Tag 103 8K 2
Memory Tag 242 12K 1
Memory Tag 249 156K 2
STACK GUARD 56.0M 5
Stack 10.0M 5
VM_ALLOCATE 68K 4
__DATA 27.1M 255
__DATA_CONST 4K 1
__FONT_DATA 4K 1
__LINKEDIT 222.5M 8
__TEXT 163.5M 264
__UNICODE 564K 1
mapped file 116.1M 12
shared memory 640K 10
=========== ======= =======
TOTAL 1.1G 608
TOTAL, minus reserved VM space 773.9M 608

Model: VMware7,1, BootROM VMW71.00V.16722896.B64.2008100651, 4 processors, 2.20 GHz, 2 GB, SMC 2.8f0
Graphics: spdisplays_display, 128 MB
Memory Module: RAM slot #0/RAM slot #0, 2 GB, DRAM, 0 MHz, VMware Virtual RAM, VMW-2048MB
Bluetooth: Version 6.0.14d3, 3 services, 26 devices, 1 incoming serial ports
Network Service: Ethernet, Ethernet, en0
Serial ATA Device: VMware Virtual SATA Hard Drive, 42.95 GB
Serial ATA Device: VMware Virtual SATA CDRW Drive, 10.74 GB
Serial ATA Device: VMware Virtual SATA Hard Drive, 8.59 GB
USB Device: USB 3.0 Bus
USB Device: VMware Virtual USB Hub
USB Device: VMware Virtual USB Hub
USB Device: VMware Virtual USB Keyboard
USB Device: VMware Virtual USB Mouse
USB Device: USB 2.0 Bus
USB Device: VMware Virtual USB Video Device
USB Device: USB Bus
USB Device: VMware Virtual USB Hub
USB Device: Virtual Bluetooth Adapter
Thunderbolt Bus:
`

Steven Michaud · Answer 23 · Sun Feb 07 2021 22:53:56 GMT+0800 (China Standard Time)

I will disable user_trap. After do that ,It ok for hook lib.

I'm glad to hear it.

However, I have encountered another problem where the Hook causes the process to crash.

This isn't a bug. In fact it's a feature of the "filesystem" (or "fs") part of SIP, which crashes processes that try to load an unsigned module. To work around it you need to codesign your hook library. I do mention this in the Installing part of my documentation.

panjiancai · Answer 24 · Sun Feb 07 2021 23:32:49 GMT+0800 (China Standard Time)

Thanks.
I see your instructions. but, I have signed the lib as following, but it not work. What else do you suggest? :
mac@panMBP16 Release$ codesign -vv -d libdse_system_dlib.dylib
Executable=/Users/mac/Documents/Dev/AppInstaller/App-Installer/Installer/Contents/Release/libdse_system_dlib.dylib
Identifier=libdse_system_dlib
Format=Mach-O thin (x86_64)
CodeDirectory v=20200 size=370 flags=0x0(none) hashes=7+2 location=embedded
Signature size=9069
Authority=Developer ID Application: Shanghai Eff-soft Information Technology Co.,Ltd. (X9EE9PU2A9)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Feb 7, 2021 at 9:20:53 PM
Info.plist=not bound
TeamIdentifier=X9EE9PU2A9
Sealed Resources=none
Internal requirements count=1 size=212

Steven Michaud · Answer 25 · Mon Feb 08 2021 00:39:23 GMT+0800 (China Standard Time)

I notice that your crash report was generated on macOS 10.14.6 build 18G103. This isn't one of the builds for which a KDK is available. Are you using a mismatched kernel?

What, exactly, were you doing in ScriptEditor to trigger the crash?

Do the crashes still happen if HookCase.kext isn't loaded (if it doesn't show up in the kextstat list)?

And what is the "App Installer"? How do you generate an "app installer" with a hook library? What application do you use? What steps do you take?

Steven Michaud · Answer 26 · Mon Feb 08 2021 01:00:25 GMT+0800 (China Standard Time)

Something else just occurred to me:

Besides codesigning your hook library, you may need to also codesign your "AppInstaller".

Steven Michaud · Answer 27 · Mon Feb 08 2021 01:01:51 GMT+0800 (China Standard Time)

The reason I ask all these questions is that I can't read your mind. If you gave me this information beforehand, I wouldn't need to ask.

panjiancai · Answer 28 · Tue Feb 09 2021 00:27:00 GMT+0800 (China Standard Time)

1.I simply start up the ScriptEditor app and set it aside and wait a few minutes for it to crash.
2. "Do the crashes still happen if HookCase.kext isn't loaded (if it doesn't show up in the kextstat list)?" :the answer is No.
3. My App name is DSE, the DSE Installer copy hook lib to /usr/lib/libdse_system_dlib.dylib, the lib was signed. HookCase.kext is copyed to /usr/lib/dse/, HookCase.kext is singed, so It can load when SIP is disabled . The problem is crash after few minutes.
4. I also test on macOS 10.15.7 (19H2),This problem still exists.
5. Process: Notes [516]
Path: /System/Applications/Notes.app/Contents/MacOS/Notes
Identifier: Notes
Version: 4.7 (1111.23)
Build Info: Notes-1111023000000000~59
Code Type: X86-64 (Native)
Parent Process: ??? [1]
Responsible: Notes [516]
User ID: 501

Date/Time: 2021-02-08 07:57:31.596 -0800
OS Version: Mac OS X 10.15.7 (19H2)
Report Version: 12
Anonymous UUID: 1543C62F-E090-8A22-E7EC-29FAE4EC08C0

Time Awake Since Boot: 1000 seconds

System Integrity Protection: enabled

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_ACCESS (Code Signature Invalid)
Exception Codes: 0x0000000000000032, 0x00007fff3695feb9
Exception Note: EXC_CORPSE_NOTIFY

Termination Reason: Namespace CODESIGNING, Code 0x2

kernel messages:

VM Regions Near 0x7fff3695feb9:
__TEXT 00007fff3695e000-00007fff3695f000 [ 4K] r-x/r-x SM=COW /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
--> __TEXT 00007fff3695f000-00007fff36960000 [ 4K] r-x/rwx SM=COW /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
Submap 00007fff36960000-00007fff369dd000 [ 500K] r--/rwx SM=PRV process-only VM submap

Application Specific Information:
dyld: in dlopen_preflight()

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 ??? 0x00007fff3695feb9 _CFGetEUID + 0
1 ??? 0x00007fff36989c5a -[_CFXPreferencesHandle copyPrefs] + 39
2 ??? 0x00007fff3698b058 _CFPreferencesCopyAppValueWithContainerAndConfiguration + 70
3 ??? 0x00007fff39024db8 -[NSUserDefaults(NSUserDefaults) objectForKey:] + 43
4 ??? 0x00007fff33eccf42 -[NSWindow saveFrameUsingName:] + 141
5 ??? 0x00007fff33cadaf9 -[NSWindow _reallySetFrame:] + 519
6 ??? 0x00007fff33cad45e -[NSWindow _oldPlaceWindow:fromServer:] + 195
7 ??? 0x00007fff33cab975 -[NSWindow _setFrameCommon:display:fromServer:] + 1352
8 ??? 0x00007fff3403d3bd -[NSWindow _adjustWindowToScreen] + 1357
9 ??? 0x00007fff34066b1f -[NSWindow _displayChangedSoAdjustWindows:] + 105
10 ??? 0x00007fff347459a9 ___NSApplicationPerformScreenInvalidationReactions_block_invoke + 72
11 ??? 0x00007fff33c4bece -[NSApplication enumerateWindowsWithOptions:usingBlock:] + 274
12 ??? 0x00007fff34744b89 _NSApplicationPerformScreenInvalidationReactions + 556
13 ??? 0x00007fff34745955 ___NSMainRunLoopPerformBlockInModes_block_invoke + 25
14 ??? 0x00007fff369e19ec 0 + 140734109719020
15 ??? 0x00007fff369e1934 0 + 140734109718836
16 ??? 0x00007fff369e0e2d 0 + 140734109716013
17 ??? 0x00007fff369dfe3e 0 + 140734109711934
18 com.apple.HIToolbox 0x00007fff3560cabd RunCurrentEventLoopInMode + 292
19 com.apple.HIToolbox 0x00007fff3560c7d5 ReceiveNextEventCommon + 584
20 com.apple.HIToolbox 0x00007fff3560c579 _BlockUntilNextEventMatchingListInModeWithFilter + 64
21 ??? 0x00007fff33c52039 _DPSNextEvent + 883
22 ??? 0x00007fff33c50880 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1352
23 ??? 0x00007fff33c4258e -[NSApplication run] + 658
24 ??? 0x00007fff33c14396 NSApplicationMain + 777
25 com.apple.Notes 0x0000000100ff6f2d 0x100ff4000 + 12077
26 ??? 0x00007fff70a96cc9 start + 1

6.My conclusion is that with SIP enabled, Hook operation of secure processes is not possible.I wonder if you approve of it?
7.Not only Notes.app crashed, but all the other Hooked processes crashed.The following is the log of Reminders.app process crash.
Process: Reminders [520]
Path: /System/Applications/Reminders.app/Contents/MacOS/Reminders
Identifier: Reminders
Version: 7.0 (2081.2)
Build Info: RemindersApp-2081002000000000~38
Code Type: X86-64 (Native)
Parent Process: ??? [1]
Responsible: Reminders [520]
User ID: 501

Date/Time: 2021-02-08 07:57:32.836 -0800
OS Version: Mac OS X 10.15.7 (19H2)
Report Version: 12
Anonymous UUID: 1543C62F-E090-8A22-E7EC-29FAE4EC08C0

Time Awake Since Boot: 1000 seconds

System Integrity Protection: enabled

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_ACCESS (Code Signature Invalid)
Exception Codes: 0x0000000000000032, 0x00007fff3695feb9
Exception Note: EXC_CORPSE_NOTIFY

Termination Reason: Namespace CODESIGNING, Code 0x2

kernel messages:

VM Regions Near 0x7fff3695feb9:
__TEXT 00007fff3695e000-00007fff3695f000 [ 4K] r-x/r-x SM=COW /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
--> __TEXT 00007fff3695f000-00007fff36960000 [ 4K] r-x/rwx SM=COW /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
Submap 00007fff36960000-00007fff369dd000 [ 500K] r--/rwx SM=PRV process-only VM submap

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 ??? 0x00007fff3695feb9 _CFGetEUID + 0
1 ??? 0x00007fff36989c5a -[_CFXPreferencesHandle copyPrefs] + 39
2 ??? 0x00007fff3698b058 _CFPreferencesCopyAppValueWithContainerAndConfiguration + 70
3 com.apple.Foundation 0x00007fff39024db8 -[NSUserDefaults(NSUserDefaults) objectForKey:] + 43
4 com.apple.AppKit 0x00007fff33eccf42 -[NSWindow saveFrameUsingName:] + 141
5 com.apple.AppKit 0x00007fff33cadaf9 -[NSWindow _reallySetFrame:] + 519
6 com.apple.AppKit 0x00007fff33cad45e -[NSWindow _oldPlaceWindow:fromServer:] + 195
7 com.apple.AppKit 0x00007fff33cab975 -[NSWindow _setFrameCommon:display:fromServer:] + 1352
8 com.apple.AppKit 0x00007fff3403d3bd -[NSWindow _adjustWindowToScreen] + 1357
9 com.apple.AppKit 0x00007fff34066b1f -[NSWindow _displayChangedSoAdjustWindows:] + 105
10 com.apple.AppKit 0x00007fff347459a9 ___NSApplicationPerformScreenInvalidationReactions_block_invoke + 72
11 com.apple.AppKit 0x00007fff33c4bece -[NSApplication enumerateWindowsWithOptions:usingBlock:] + 274
12 com.apple.AppKit 0x00007fff34744b89 _NSApplicationPerformScreenInvalidationReactions + 556
13 com.apple.AppKit 0x00007fff34745955 ___NSMainRunLoopPerformBlockInModes_block_invoke + 25
14 ??? 0x00007fff369e19ec 0 + 140734109719020
15 ??? 0x00007fff369e1934 0 + 140734109718836
16 ??? 0x00007fff369e0e2d 0 + 140734109716013
17 ??? 0x00007fff369dfe3e 0 + 140734109711934
18 com.apple.HIToolbox 0x00007fff3560cabd RunCurrentEventLoopInMode + 292
19 com.apple.HIToolbox 0x00007fff3560c7d5 ReceiveNextEventCommon + 584
20 com.apple.HIToolbox 0x00007fff3560c579 _BlockUntilNextEventMatchingListInModeWithFilter + 64
21 com.apple.AppKit 0x00007fff33c52039 _DPSNextEvent + 883
22 com.apple.AppKit 0x00007fff33c50880 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1352
23 com.apple.AppKit 0x00007fff33c4258e -[NSApplication run] + 658
24 com.apple.AppKit 0x00007fff33c14396 NSApplicationMain + 777
25 com.apple.reminders 0x00000001044e06b9 0x1044c8000 + 100025
26 ??? 0x00007fff70a96cc9 start + 1

Steven Michaud · Answer 29 · Tue Feb 09 2021 00:39:29 GMT+0800 (China Standard Time)

1.I simply start up the ScriptEditor app and set it aside and wait a few minutes for it to crash.

Had you previously opened your DSE app installer in the ScriptEditor? Was it in the list of files to open when the ScriptEditor starts up?

"Do the crashes still happen if HookCase.kext isn't loaded (if it doesn't show up in the kextstat list)?" :the answer is No.

Were there any hook libraries currently loaded (into any process) when the crashes happened?

Do the crashes happen if you're not using mismatched kernels?

HookCase.kext is copyed to /usr/lib/dse/, HookCase.kext is singed, so It can load when SIP is disabled .

How, exactly, does HookCase.kext get loaded? Does it happen "automatically", or do you have to load it explicitly using kextutil /usr/lib/dse/HookCase.kext?

panjiancai · Answer 30 · Tue Feb 09 2021 00:49:59 GMT+0800 (China Standard Time)

Had you previously opened your DSE app installer in the ScriptEditor? Was it in the list of files to open when the ScriptEditor starts up?

no.no.

Were there any hook libraries currently loaded (into any process) when the crashes happened?

no.

Do the crashes happen if you're not using mismatched kernels?

no.

How, exactly, does HookCase.kext get loaded? Does it happen "automatically", or do you have to load it explicitly using kextutil /usr/lib/dse/HookCase.kext?

using kextutil /usr/lib/dse/HookCase.kext

Steven Michaud · Answer 31 · Tue Feb 09 2021 01:00:15 GMT+0800 (China Standard Time)

Do the crashes happen if you're not using mismatched kernels?
no.

I'm not going to continue to help you with any HookCase problems that happen while you're using mismatched kernels. Yes, I know that you think you haven't seen any problems using them. But HookCase.kext is a special case, and we've already seen one problem (your kernel panics in user_trap_hook()) that seems to be caused by using them.

panjiancai · Answer 32 · Tue Feb 09 2021 09:24:11 GMT+0800 (China Standard Time)

I am sorry ,Do the crashes happen if you're not using mismatched kernels?
no.

Do the crashes happen if you're not using mismatched kernels?
The answer is Yes.

panjiancai · Answer 33 · Tue Feb 09 2021 09:25:27 GMT+0800 (China Standard Time)

macOS 10.15.7 (19H2),The official distribution is used.

Steven Michaud · Answer 34 · Tue Feb 09 2021 13:23:12 GMT+0800 (China Standard Time)

Even leaving mismatched extensions aside, I doubt that I'll be able to help you. I still don't have enough information to act on. Today I loaded the HookCase.kext kernel extension and ran the Script Editor, then left it running for several hours. I had no problems, and certainly no crashes. I did this on both macOS 10.15.7 build 19H512 and 10.14.6 build 18G8012. Both are VMWare VMs.

As far as I know, here's where we stand: You load HookCase.kext and then run the Script Editor and leave it running. A short while later it crashes with some kind of codesignature violation. I have never seen this, and can't begin to explain why it happens.

If the problem isn't a mismatched kernel, I can only think that you're running some other kind of software that doesn't get along with HookCase.kext. Above you mentioned "our kernel extensions". Were any of them loaded while you ran your tests? Do your problems (including the kernel panics) still happen if you unload them all?

qiuwenqiao · Answer 35 · Fri Feb 26 2021 14:51:34 GMT+0800 (China Standard Time)

@panjiancai Can you give me your email?