9

I have a 2014 MacBook Pro experiencing this issue. Catalina does not allow kexts to be deleted via this method. Unless I am able to delete or disable this kext my laptop will shut down randomly. Anyone know how to remove kexts in Catalina?

alfwhfwef
  • 117
  • Are you trying to modify system kernel extensions so this needs to involve system integrity protection as well as the read only system volume or just removing third party extensions? – bmike Jun 13 '20 at 11:38
  • I need to remove the AppleThunderboltNHI.kext because it causes constant crashing of my laptop. – alfwhfwef Jun 14 '20 at 16:30
  • 1
    Aah - so you’re disabling parts of the system to work around failing / failed hardware. You might edit this to put the full path to that if you want more answers. If you’re good, no need to edit of course. – bmike Jun 14 '20 at 16:48
  • 1
    @bmike: The issue is not failing hardware, it's well-known MacOS breakage since 10.12 with AppleThunderboltNHI.kext on 2014 MBP, which Apple have refused to fix for several years. – smci Jan 27 '23 at 02:10

4 Answers4

11

1. Check for System Integrity Protection (SIP)

Open Terminal and type

csrutil status

if it says

System Integrity Protection status: enabled.

continue to step 2. Else, skip to step 3.

2. Defeat SIP by Rebooting into macOS Recovery mode

  1. Turn off Mac; turn back on while hodling ⌘ and R.
  2. Open Terminal from the Utilities menu.
  3. Type csrutil disable
  4. Reboot (reboot)

3. Unload, then delete kext

In Terminal,

  1. Unload Extension
sudo kextunload /System/Library/Extensions/AppleThunderboltNHI.kext
  1. Delete Extension
sudo mount -rw / # mount root as RW
sudo rm -rf /System/Library/Extensions/AppleThunderboltNHI.kext

4. Re-enable SIP (if turned off)

Follow the steps for 2. except type csrutil enable on step 2.3.

ijoseph
  • 1,717
  • 1
    This answer worked for me. SIP was preventing me. My kext was not showing up in the directory listing in recovery mode, so I couldn't rm it from there. This is a great answer. – Scot Nery Oct 29 '20 at 17:58
8

For Mac OS Big Sur

  1. Reboot in rescue mode (reboot while "Cmd + R")

  2. Utilities -> Terminal

  3. csrutil disable

  4. csrutil authenticated-root disable

  5. mount -uw /Volumes/[MacOS ]

  6. delete (or rename, or move elsewhere) the AppleThunderboltNHI.kext directory (I've moved all thunderbolt kext directories since I have no needs about this interface, but I think it works only by disabling AppleThunderboltNHI)

cd /Volumes/Macos (Enter WHATEVER YOUR MACOS DRIVE NAME IS, my macOS drive name is Macos)/System/Library/Extensions

rm -rf AppleThunderboltNHI.kext

  1. Remove cache

rm -rf /System/Library/Caches/*

  1. REBUILD the extensions cache ! (new has-to-do in Big Sur...)

kmutil install -u --force --volume-root /Volumes/[MacOS ]

  1. DON'T FORGET to create another system snapshot to take these modifications under account at next reboot

bless --folder /Volumes/[MacOS ]/System/Library/CoreServices --bootefi --create-snapshot

  1. reboot (in rescue mode). This step may be unnecessary, not tested straight to
  2. csrutil enable
  3. Reboot
Waqas Ahmed
  • 191
  • 1
    Thank you. I will try this and see if it works! – alfwhfwef Dec 04 '20 at 11:03
  • 2
    Had to reference my root volume as '/Volumes/[Mac OS]\ 1' for some reason. It worked. Thanks! – alfwhfwef Jan 06 '21 at 02:54
  • 2
    Unfortunately csrutil authenticated-root disable doesn’t work with FileVault enabled… Will have to disable it somehow maybe in the safe mode. And you cannot enable SSV again once you’ve disabled it. – xji Jul 02 '21 at 11:50
2

  1. Open Terminal and enter the following command:

    sudo kextunload /System/Library/Extensions/AppleThunderboltNHI.kext

  2. If that fails to work, you can also just force-delete the kext using

    Use the following Terminal command to remove the kext file:

    sudo rm -rf /System/Library/Extensions/AppleThunderboltNHI.kext

  3. Restart your MAC

Udhy
  • 6,697
  • 6
    RE: 2, i.e, sudo rm -rf /System/Library/Extensions/AppleThunderboltNHI.kext. By default, all this will do is return the error "Operation not permitted" Because in macOS Catalina, by default and aside from any SIP restrictions, the e.g. Macintosh HD is mounted at / as read-only and nothing can be modified on this volume unless one boots to macOS Recovery and then either makes modifications from there, or disables SIP and then reboot and mount / as rw. – user3439894 Oct 16 '19 at 13:03
  • @user3439894 I tried to mount and perform these actions in Recovery and with SIP disabled. I was still unable to delete the kext. – alfwhfwef Oct 17 '19 at 23:53
  • 1
    @user3439894 so how did an app install its kext there? – minseong Jan 24 '20 at 22:26
  • @theonlygusti In macOS Catalina, files in /System/Library/Extensions/ are part of the Core.pkg in Install macOS Catalina.app/Contents/SharedSupport/InstallESD.dmg and put there by Apple on a, by default, read-only filesystem (when booted normally). – user3439894 Jan 25 '20 at 01:43
0

In Terminal, enter sudo mount -rw /. Then run either of the commands:

  1. to rename - cd /Volumes/Macintosh\ HD/System/Library/Extensions ; mv -v AppleThunderboltNHI.kext AppleThunderboltNHI.kext.original
  2. sudo kextunload /System/Library/Extensions/AppleThunderboltNHI.kext
  3. sudo rm -rf /System/Library/Extensions/AppleThunderboltNHI.kext

Thanks to @Udhy and @user3439894 for the tips that led me to the answer. I also found out how to mount and change drive permissions here.

alfwhfwef
  • 117
  • 5
    When booted to macOS Recovery the Macintosh HD is not protected and you do not need to disable SIP! Simple boot to macOS Recovery, open Terminal from the Utilities menu and use the following command: rm -r /Volumes/Macintosh\ HD/System/Library/Extensions/AppleThunderboltNHI.kext -- It's gone! Reboot... Done! That said, I would have just renamed it, e.g. : cd /Volumes/Macintosh\ HD/System/Library/Extensions ; mv -v AppleThunderboltNHI.kext AppleThunderboltNHI.kext.original That way, then if need be it can easily be renamed back to AppleThunderboltNHI.kext. – user3439894 Oct 18 '19 at 01:06
  • 2
    The rigamarole of rebooting to macOS Recovery, disabling SIP, rebooting back to normal mode, doing something (that actually can be done the first time booted to macOS Recovery without disabling SIP), rebooting again the macOS Recovery, enabling SIP, rebooting again back to normal mode it a totally needless dance and a utter waste of time! – user3439894 Oct 18 '19 at 01:12
  • 4
    @user3439894 you should've posted that as an answer rather than a comment. – alfwhfwef Oct 18 '19 at 21:46