ProjectOSX

Welcome Guest!

Returning User? Login here.

Want membership privileges? Register here.

 
Start a new topic Add Reply
> Creating Your Own Injector, No more editing with plist !
prasys
post Nov 30 2009, 02:34 PM
Post #1
I am not sure if it has been posted before or not. I've tried searching but then there is no where to be found. In this tutorial , we'll be looking at on how to create dummy kexts that can be used an injectors to inject our device id and vendor id without the need of modifying the actual kext in /System/Library/Extensions. The biggest advantage of it is that we can get to keep the latest kext . This covers up the basic understandings on how you could create your own injector for say your bluetooth.kext or for your SATA.kext or just about anything , even your nVidia.kext. it makes it easier so that you don't have to mess with.

Note : These injectors would only work if they are placed in /Extra/Extensions or in your EFI partition (/Extras). they would not work if its placed in /System/Library/Extensions as obviously these are dummy kexts. I mean if you want to place it in /System/Library/Extensions , wouldn't it be better just to edit the kext and add your device ID

Now lets talk a look at a dummy info.plist and what each string does . I would like to thank TeaTeam for this as I've used this LegacyNC10bluetooth injector as the sample , however I've edited it to make it work for my Bluetooth

CODE
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CFBundleDevelopmentRegion</key>
    <string>English</string>
    <key>CFBundleIdentifier</key>
    <string>org.tgwbd.driver.LegacyCSRUSBBluetoothHCIController</string>
    <key>CFBundleInfoDictionaryVersion</key>
    <string>6.0</string>
    <key>CFBundleName</key>
    <string>Legacy CSR USB Bluetooth HCI Controller</string>
    <key>CFBundlePackageType</key>
    <string>KEXT</string>
    <key>CFBundleShortVersionString</key>
    <string>6.0</string>
    <key>CFBundleSignature</key>
    <string>????</string>
    <key>CFBundleVersion</key>
    <string>6.6.1</string>
    <key>IOKitPersonalities</key>
    <dict>
        <key>VideoKilledTheRadioStar</key>
        <dict>
            <key>CFBundleIdentifier</key>
            <string>com.apple.driver.CSRUSBBluetoothHCIController</string>
            <key>IOClass</key>
            <string>CSRUSBBluetoothHCIController</string>
            <key>IOProviderClass</key>
            <string>IOUSBDevice</string>
            <key>IOProviderMergeProperties</key>
            <dict>
                <key>ClassicMustNotSeize</key>
                <true/>
            </dict>
            <key>idProduct</key>
            <integer>43386</integer>
            <key>idVendor</key>
            <integer>3504</integer>
        </dict>
    </dict>
    <key>OSBundleCompatibleVersion</key>
    <string>1.2b9</string>
    <key>OSBundleLibraries</key>
    <dict>
        <key>com.apple.driver.AppleUSBBluetoothHCIController</key>
        <string>2.0.0</string>
        <key>com.apple.iokit.IOBluetoothFamily</key>
        <string>2.0.0</string>
        <key>com.apple.kpi.iokit</key>
        <string>8.0</string>
        <key>com.apple.kpi.libkern</key>
        <string>8.0</string>
    </dict>
    <key>OSBundleRequired</key>
    <string>Local-Root</string>
</dict>
</plist>


Shall we take a look at one key by one key which can be altered. The ones that I do not mention are constants , meaning that you shouldn't alter them unless you know what you're doing

<key>CFBundleDevelopmentRegion</key> - Its generally set to English
<key>CFBundleIdentifier</key>- Its an identifer used by the kext when its loaded (i am not sure how to explain this , I do hope someone with better command of the english language and understanding how this works , would help me to explain it better). I would simply call it loading name, suppose if you made a fix for your wifi (broadcom for instance) you can call it com.<yourname>.<whatever you did>. Generally it has to start with .com.<something>.<whatsthefixabout>
<key>CFBundleName</key> The english name for it , you can say "Bluetooth MSI Wind U100 Fix" or whatever fix that you did. Its up to you
<key>CFBundleInfoDictionaryVersion</key> - The Version number you want to give it. Its up to you. If you gave this 6.0
<key>CFBundleVersion</key> - Again its up to you , if you gave the previous one a 6.0 , then this value should be larger , say something like 6.6.1 or something like that.

Now here comes the Important part , in this case I'll be adding injector information to the CSRBLuetoothkext. So first I've to open a genuine CSRKext to take a look at it. If you're editing Atheros or Broadcom kext , then look inside IO80211Family.kext --> plugins --> AppleBCM. If you're editing nvidia resman , then look at its info.plist

<key> VideoKilledTheRadioStar </key>- This key corresponds to what you're about to inject . You can call it MSIWindu100_bluetooth , nvidia_5200_fix , or anything. in this case I called it as videoKilledtheradiostar, yes it was taken from a song.


Below your key , you would see another list of CFBundleIndentifer , IOClass , IOmatchCategory , IONameMatch , IOProbeScore , IOProviderClass. Now in order for us to find out these values . It may vary from one kext to another kext , but you're able to see it. So let me take a snippet of the original CSR bluetooth kext with an ID

CODE
<key>AppleDesktopModule</key>
        <dict>
            <key>CFBundleIdentifier</key>
            <string>com.apple.driver.CSRUSBBluetoothHCIController</string>
            <key>IOClass</key>
            <string>CSRUSBBluetoothHCIController</string>
            <key>IOProviderClass</key>
            <string>IOUSBDevice</string>
            <key>IOProviderMergeProperties</key>
            <dict>
                <key>ClassicMustNotSeize</key>
                <true/>
            </dict>
            <key>idProduct</key>
            <integer>33284</integer>
            <key>idVendor</key>
            <integer>1452</integer>
        </dict>

and mine

CODE
        <key>CSRUSBBluetoothHCIController</key>
        <dict>
            <key>CFBundleIdentifier</key>
            <string>com.apple.driver.CSRUSBBluetoothHCIController</string>
            <key>IOClass</key>
            <string>CSRUSBBluetoothHCIController</string>
            <key>IOProviderClass</key>
            <string>IOUSBDevice</string>
            <key>IOProviderMergeProperties</key>
            <dict>
                <key>ClassicMustNotSeize</key>
                <true/>
            </dict>
            <key>idProduct</key>
            <integer>43386</integer>
            <key>idVendor</key>
            <integer>3504</integer>
        </dict>


Notice the similarities , generally i've to take a snippet of how it looks like in the actual kext , copy a <dict> and then change few of the things such as my idProduct and idVendor. For some kexts , its IONameMatch , so just see how the real thing looks like and copy that and just alter it to your device id and to your vendor id and voila. You may want to add IOProbeScore if you wish , so that it gets a higher priority to be loaded , I did not put in this case as its not needed.

The most crucial part is
CODE
    <key>OSBundleLibraries</key>
    <dict>
        <key>com.apple.driver.AppleUSBBluetoothHCIController</key>
        <string>2.0.0</string>
        <key>com.apple.iokit.IOBluetoothFamily</key>
        <string>2.0.0</string>
        <key>com.apple.kpi.iokit</key>
        <string>8.0</string>
        <key>com.apple.kpi.libkern</key>
        <string>8.0</string>
    </dict>


I've seen some kexts without this part such as Xyz' Atheros Injector they do work fine. However for this bluetooth when i tried removing it , poof it did nothing. It did not inject and my bluetooth did not work. So thats the actual reason why mr tea added this up. To get what this kext needs , look at its original kext , you'll have to copy its OSBundleLibaries to your injector kext. Again it varies from one kext to another.

Bam there you go , thats how you make your very own injector for your device. You don't have to edit any more of your bluetooth kext or patch it up in order for you to get it to work. You can get to enjoy the latest drivers from Apple too. This is how kexts like IOAHCIInjector work. If you want to get more experience on how it works , I suggest you to take a look at some of the popular kexts such as LegacyAppleHDA , IOAHCInjector and see how these dummy kexts work

I've attached a dummy kext that you can look (just in case if you dont have one)

This is my first draft , as I've more spare time. I am be sure to add more spices. Advices from the great gurus , sith lords , jedi masters are always welcomed. I thought of documenting it as it would be useful for someone especially those who still do modify by hand in /S/L/E
Attached File  VideoKilledTheRadioStar.kext.zip ( 2.7K ) Number of downloads: 205


Kexts which works great with an "injector/legacy kext"
- NvidiaResMan - generally I got them to load fine in /E/E .
- Broadcom and Atheros wifi kext - as Xyz has done one
- Bluetooth
- AppleYukonKext - seems to be working great with a legacy kext from /E/E

These are the kexts which I've tested which works great with injected value from a dummy kext in /Extra/Extensions



This post has been edited by prasys: Nov 30 2009, 03:08 PM
Dell Dimension 9100 | Intel Pentium D 830 3.00Ghz | 4GB 533Mhz RAM | 750GB combined HDD storage | GeForce 8600GT (EFI strings) | ST9200 HD Audio (AppleHDA.kext from OSX 10.4.4) | D-link GWL-520G+ Rev B1 | OSX 10.5.7 (Voodoo Kernel - 9.7.0) , Win Vista ,Debian etch , Win XP
MSI Wind U100-835MY | Intel Atom N280 1.66Ghz | 2GB 667Mhz RAM | 160GB HDD | GMA 950 (patched kext) | ALC88x Audio (VoodooHDA) | AR242x (AR5006EXS) | CSR Bluetooth | OSX 10.5.7 (Retail Disc install) + WinXP
iBook G4 | PPC G4 7447A 1.06Ghz | 512MB DDR1 | 30GB HDD | AC97 audio | ATI Mobility Radeon 9200 | BCM4311 Apple Airport | OSX 10.5.7
Mac Mini G4 | PPC G4 7447A 1.42Ghz | 1GB DDR1 | 100GB HDD | AC97 audio | ATI Radeon 9200 | BCM Bluetooth (BTO) | OSX 10.5.7 + ubuntu 8.04
kDawg
post Dec 5 2009, 11:22 AM
Post #2
QUOTE (prasys @ Nov 30 2009, 09:34 AM) *
I am not sure if it has been posted before or not. I've tried searching but then there is no where to be found. In this tutorial , we'll be looking at on how to create dummy kexts that can be used an injectors to inject our device id and vendor id without the need of modifying the actual kext in /System/Library/Extensions. The biggest advantage of it is that we can get to keep the latest kext . This covers up the basic understandings on how you could create your own injector for say your bluetooth.kext or for your SATA.kext or just about anything , even your nVidia.kext. it makes it easier so that you don't have to mess with.

Note : These injectors would only work if they are placed in /Extra/Extensions or in your EFI partition (/Extras). they would not work if its placed in /System/Library/Extensions as obviously these are dummy kexts. I mean if you want to place it in /System/Library/Extensions , wouldn't it be better just to edit the kext and add your device ID

Now lets talk a look at a dummy info.plist and what each string does . I would like to thank TeaTeam for this as I've used this LegacyNC10bluetooth injector as the sample , however I've edited it to make it work for my Bluetooth


Great explanation. Question. How can I get it to override a different kext? For instance in Snow Leopard for some reason my D-Link DBT120 is loading AppleUSBBluetoothHCIController.kext instead of CSRUSBBluetoothHCIController.kext. In 10.5 Leopard I know the DBT120 used the CSRUSBBluetoothHCIController.kext and functioned properly. In Snow Leopard it is not.
prasys
post Dec 5 2009, 02:55 PM
Post #3
QUOTE (kDawg @ Dec 5 2009, 07:22 PM) *
Great explanation. Question. How can I get it to override a different kext? For instance in Snow Leopard for some reason my D-Link DBT120 is loading AppleUSBBluetoothHCIController.kext instead of CSRUSBBluetoothHCIController.kext. In 10.5 Leopard I know the DBT120 used the CSRUSBBluetoothHCIController.kext and functioned properly. In Snow Leopard it is not.

You can add AppleUSBBluetoothHCIController.kext to blacklist kext , so that it does not get loaded and/or give the injector for CSR Bluetooth a higher iOProbescore so that it gets loaded first
Dell Dimension 9100 | Intel Pentium D 830 3.00Ghz | 4GB 533Mhz RAM | 750GB combined HDD storage | GeForce 8600GT (EFI strings) | ST9200 HD Audio (AppleHDA.kext from OSX 10.4.4) | D-link GWL-520G+ Rev B1 | OSX 10.5.7 (Voodoo Kernel - 9.7.0) , Win Vista ,Debian etch , Win XP
MSI Wind U100-835MY | Intel Atom N280 1.66Ghz | 2GB 667Mhz RAM | 160GB HDD | GMA 950 (patched kext) | ALC88x Audio (VoodooHDA) | AR242x (AR5006EXS) | CSR Bluetooth | OSX 10.5.7 (Retail Disc install) + WinXP
iBook G4 | PPC G4 7447A 1.06Ghz | 512MB DDR1 | 30GB HDD | AC97 audio | ATI Mobility Radeon 9200 | BCM4311 Apple Airport | OSX 10.5.7
Mac Mini G4 | PPC G4 7447A 1.42Ghz | 1GB DDR1 | 100GB HDD | AC97 audio | ATI Radeon 9200 | BCM Bluetooth (BTO) | OSX 10.5.7 + ubuntu 8.04
kDawg
post Dec 5 2009, 04:57 PM
Post #4
QUOTE (prasys @ Dec 5 2009, 09:55 AM) *
You can add AppleUSBBluetoothHCIController.kext to blacklist kext , so that it does not get loaded and/or give the injector for CSR Bluetooth a higher iOProbescore so that it gets loaded first


At one point I actually removed the AppleUSBBluetoothHCIController.kext but then I totally lost Bluetooth. Feels like a bug Apple hasn't squashed yet. The real problem is that since Snow Leopard I've lost the "Let this device wake computer option" in the preferences. Bluetooth works fine I just can't wake my computer with my new Magic Mouse.

You also bring up another good topic. You should describe how to make a disabler kext in your tutorial.

This post has been edited by kDawg: Dec 5 2009, 05:01 PM
cyf
post Nov 30 2012, 06:00 AM
Post #5
QUOTE (kDawg @ Dec 5 2009, 08:57 AM) *
At one point I actually removed the AppleUSBBluetoothHCIController.kext but then I totally lost Bluetooth. Feels like a bug Apple hasn't squashed yet. The real problem is that since Snow Leopard I've lost the "Let this device wake computer option" in the preferences. Bluetooth works fine I just can't wake my computer with my new Magic Mouse.

You also bring up another good topic. You should describe how to make a disabler kext in your tutorial.

Old topic, but interesting. This does assume that the driver software is in the kext in /S/L/E, right? OTherwise, it doesn't matter what you inject.

Also, Clover (and Chameleon?) have kext injection. Does this work the same way?
ASUS ZENBOOK Prime UX21A
Core i7-3517U [1.9GHz/3.0GHz (Turbo) CPU/Bus Ratio=19] on C216 Chipset Family
4GB DDR3 160MHz - ADATA SATA III SSD 256GB
Intel HD4000 - 11.6" IPD (1920 x 1080)
Centrino 6235 (802.11 a/b/g/n + BT 4.0) - ASIX AX88772B (USB 2.0 to Fast Ethernet LAN Adapter)
apianti
post Nov 30 2012, 05:40 PM
Post #6
QUOTE (cyf @ Nov 30 2012, 01:00 AM) *
Old topic, but interesting. This does assume that the driver software is in the kext in /S/L/E, right? OTherwise, it doesn't matter what you inject.

Also, Clover (and Chameleon?) have kext injection. Does this work the same way?

No they do not work the same way. Kext injection injects the kext files into the OS filesystem. Device injection injects the device properties into IODeviceTree.
Gigabyte GA-Z68XP-UD3P Firmware U1g, Intel Core i5-2500K, Corsair Vengeance 4x4GB (16GB) DDR3 1600, XFX Radeon 6870 2GB,
Western Digital Caviar Black 1TB, LG Rewritable BluRay Disc Burner, D-Link DWA-556 Wireless N Xtreme PCIe

Windows 8.1 Pro, Mac OS X 10.9 Mavericks, Ubuntu 13.10, LinuxMINT 15 Cinnamon, Fedora 19, openSUSE 12.3

Add Reply Start a new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members: