Hello, every one!
I am writing a file hook driver(kext) for virus scan, I need delete some vnode files in the kext source code. But I can not find some api that the kernel has provided. I checked the "/System/Library/Extensions/System.kext/PlugIns/BSDKernel.kext" with "nm" command, and tried several suspicious api but failed. I also tried "vnop_remove" and but not load the driver because this symbol can not be found.
Does anyone know something about this? Or have some other ways to delete file in kernel?
Thanks a lot~
I am writing a file hook driver(kext) for virus scan, I need delete some vnode files in the kext source code. But I can not find some api that the kernel has provided. I checked the "/System/Library/Extensions/System.kext/PlugIns/BSDKernel.kext" with "nm" command, and tried several suspicious api but failed. I also tried "vnop_remove" and but not load the driver because this symbol can not be found.
Does anyone know something about this? Or have some other ways to delete file in kernel?
Thanks a lot~