macOS 10.15.7 build 19H2026 breaks HookCase
steven-michaud opened this issue · comments
On macOS 10.15.7 build 19H2026, released today, HookCase fails to load with the following error. There are no problems on any of the earlier builds of macOS 10.15.7 (build 19H1922 and prior).
sudo kextutil /usr/local/sbin/HookCase.kext
Password:
Kext with invalid signature (-67062) allowed: <OSKext 0x7fe9ed436a40 [0x7fff864dcce0]> { URL = "file:///usr/local/sbin/HookCase.kext/", ID = "org.smichaud.HookCase" }
Code Signing Failure: not code signed
Disabling KextAudit: SIP is off
(kernel) kxld[org.smichaud.HookCase]: The following symbols were defined more than once:
(kernel) kxld[org.smichaud.HookCase]: _mac_vnode_check_open: 0xffffff7f89246330 - 0xffffff8006eac830
(kernel) Can't load kext org.smichaud.HookCase - link failed.
(kernel) Failed to load executable for kext org.smichaud.HookCase.
(kernel) Kext org.smichaud.HookCase failed to load (0xdc008016).
(kernel) Failed to load kext org.smichaud.HookCase (error 0xdc008016).
Failed to load /usr/local/sbin/HookCase.kext - (libkern/kext) link error.
Check library declarations for your kext with kextlibs(8).
It turns out macOS 10.15.7 build 19H2026 added mac_vnode_check_open() to its list of supported kernel calls. Since HookCase.kext had a symbol with the same name, the kernel extension loader complained about it being defined more than once. The workaround is easy -- just rename the symbol in HookCase.kext.
Both macOS 12.5 and macOS 11.6.8 also have this as a "supported" kernel call, but only for Apple kernel extensions. It's in /System/Library/Extensions/System.kext/PlugIns/Private.kext. So it's not visible to non-Apple kexts like HookCase.kext. I don't know why 10.15.7 build 19H2026 didn't also do this. It may just have been a mistake, which will be corrected in the future. But that won't break my workaround.