KCLocateSymbol

Description

Search the kernelcache for a symbol by name, across the KEXTs' symbol tables. The tables are read from the cache file, so a KEXT nobody has loaded is searched like any other.

Choosing the action opens a small query prompt: enter a substring — the field keeps a history of past queries — and confirm.

Available from the KC Index context menu, under Locate.

The "Locate > Symbol" entry in the KC Index context menu

The query prompt, with the Options group expanded

Behind the Options group (collapsed by default):

• Ignore case — match the needle whatever its case.

• Search linked collections — also search the collection this one links to, which on a macOS System KC is its Boot KC.

Confirming runs the search and opens the KC symbols panel with the matches. The panel keeps the same query field and Options, so you can refine in place — edit the text and press Enter, or click the Search button.

A modern iOS kernelcache carries no symbol table at all, so no spelling of the needle can match. The prompt says so rather than leave you to read an empty result as a missing symbol.

On a cache with no symbols, the prompt says why nothing can match

Result tree

Hits are grouped by the KEXT that owns them, and under it by the section they sit in. Each leaf marks the part of its text that matched, and carries the address and whether its KEXT is currently loaded.

Double-clicking a leaf jumps to the hit, mapping the owning KEXT first if it is not loaded yet.

See Kernelcache Workflow.