Can't Remove Kernel Extensions Under Mojave

After updating to Mojave my system crashes. It can only be started in safe-mode.

According to crash logs from sysdiagnose, a particular extension is causing problems:

0xffffff811b0f3fa0 : 0xffffff800c9590ce
  Kernel Extensions in backtrace:
    com.coriolis-systems.driver.Snapshot(122.0)[5611248B-6440-3559-9F69-2F249150EA5A]@0xffffff7f8d734000->0xffffff7f8d7aafff
      dependency: com.apple.iokit.IOStorageFamily(2.1)[499E27C9-AC4D-3239-9FC4-754C7699FA76]@0xffffff7f8d704000

It seems the extension can be found but not removed

$:/Library/Extensions$ kextfind -b com.coriolis-systems.driver.Snapshot
/Library/Extensions/CoriolisSnapshot.kext
$:/Library/Extensions$ kextunload -b /Library/Extensions/CoriolisSnapshot.kext
(kernel) Kext /Library/Extensions/CoriolisSnapshot.kext not found for unload request.
Failed to unload /Library/Extensions/CoriolisSnapshot.kext - (libkern/kext) not found.

How do I remove this extension completely? It also shows up under /Library/StagedExtensions/Library/Extensions and /Library//SystemMigration/History/Migration-XXX/QuarantineRoot/Library/StagedExtensions/Library/Extensions/

For that matter are there any way to just remove all third-party extensions without a fresh install?

-- UPDATE --

After losing patience I just removed the /Library/Extensions/CoriolisSnapshot.kext directory after having started in safe-mode. The system booted successfully into Mojave and then opened notification windows indicating several third party extensions were blocked. After allowing one to load the security and privacy pane opened where I was able to check/uncheck other extensions. The Coriolis Systems box was there and I left it unchecked. The system then restarted successfully without any more requests.

Fair warning! This was somewhat risky. Removing system folders can have unintended consequences. The only reason I was willing to try was that I made a full disk image backup just prior to installing Mojave.


Solution 1:

As the developer responsible for that KEXT, I'm sorry that it's crashing. You did the right thing just deleting it; it isn't going to be updated for Mojave (because, frankly, there's no point; what with APFS and the various security changes, I'm afraid iDefrag is now a legacy-only product).

For anyone else seeing this problem, you can boot into Safe Mode by restarting your machine and holding Shift (the key marked ⇧) when you hear the boot chime. Alternatively, you can boot into Recovery Mode by holding Command (⌘) and R when you hear the chime; if you're in Recovery Mode, you can open Terminal from the "Utilities" menu at the top of the screen.

To delete the KEXT, follow the instructions below:

From Finder

  1. In Finder, choose "Go to Folder…" from the "Go" menu.

  2. Enter /Library/Extensions into the box that appears.

  3. Press "Go" (or hit Return).

  4. Drag the CoriolisSnapshot.kext to the Trash (or choose "Move to Trash" from the "File" menu).

From Terminal

  1. Enter sudo rm -rf /Library/Extensions/CoriolisSnapshot.kext at the prompt, and press Return.

  2. If prompted, enter your password and press Return.

Solution 2:

I found it by myself! Thanks to Alastair to making me going a bit deeper into reasoning why removing physically everything still gave me the error.

Disable SIP!!! <--- ALMOST EVERYTHING YOU NEED TO DO.

It is much more important than trying anything else. I cannot believe Apple made it so mindblowing to use the "evoluted" way, as they put MacOS much more into "children playing games" OSes...

So, my solution is:

  • booting into Recovery Mode by holding Command (⌘) and R when you hear the Mac's chime (as previously stated by Alastair); then from the Utils menu choose Terminal and type csrutil disable. type reboot or reboot by the specific menu.

  • If you also need to clean some cache, I found also some few lines useful for Hackintoshes, but by using the same Recovery Mode, you can go here: https://www.tonymacx86.com/threads/rebuilding-kernel-cache-in-catalina.285643/

Not all commands work (Gatekeeper is useless in Recovery Mode, isn't it?), but I tried some and nothing gone wrong... at least it says that it cannot be done or files are non-existing...

Cross fingers and reboot: works! Thanks guys, whatever you wrote for anybody lurking around. It saves headaches to many of us!!!

Long live and prosper, Happy Easter.

Seba

Solution 3:

To remove the files inside Library/StagedExtensions/Library/Extensions/, open Terminal and type sudo kextcache --clear-staging and the files will be erased. To make sure they get completely removed, reboot your Mac. Also, this doesn't require you to disable SIP.