rvictl not working on big sur and ios 14 beta 3

This thread has been locked by a moderator; it no longer accepts new replies.
I'm trying to inspect network traffic on an iphone 11 pro, I use:

rvictl -s [UDID]

on terminal and it closes after a couple seconds without any error. I know the UDID is correct because if I use a wrong one it brings up the help . I installed most of the extra tools I found for xcode and such and rvictl is available, it just doesnt work.
Answered by Engineer in 694420022

This issue (81125115) was fixed in Xcode 13.0 (13A233).

Disabling SIP as a workaround is no longer needed, so I recommend enabling SIP (check with csrutil status).

For Apple Silicon Macs, the Reduced Security policy "Allow user management of kernel extensions from identified developers" is still needed, instructions here.

Digging deeper, I also see the messages in the system-log like NickiOtte regarding failing loading a kext by rpmuxd.

Trying to load it manually gives this:

/L/A/u/bin $ sudo kextload /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kext
Password:
Executing: /usr/bin/kmutil load -p /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kext
Error Domain=KMErrorDomain Code=29 "Authenticating extension failed: Kext com.apple.nke.rvi v2.1.0 in executable kext bundle com.apple.nke.rvi at /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kext:

Authenticating extension failed: Bad code signature" UserInfo={NSLocalizedDescription=Authenticating extension failed: Kext com.apple.nke.rvi v2.1.0 in executable kext bundle com.apple.nke.rvi at /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kext:

Authenticating extension failed: Bad code signature}

So, the kernel-extension needs an update or anything like this? @eskimo Or may have this been caused by an faulty upgrade, and there is an updated version of the kernel extension that is only installed on a clean install? (No clean install on this system since I started using it, always upgrading)

remember to open the new extension(setting->Security and privacy) and reboot, it works for me

I'm on Monterey 12.0, on an Intel Mac, with extension v2.1.0, and I have the same kextload 'code signature' error.

bash-3.2# kextload /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kext Executing: /usr/bin/kmutil load -p /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kext Error Domain=KMErrorDomain Code=29 "Authenticating extension failed: Kext com.apple.nke.rvi v2.1.0 in executable kext bundle com.apple.nke.rvi at /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kext:

Authenticating extension failed: Bad code signature" UserInfo={NSLocalizedDescription=Authenticating extension failed: Kext com.apple.nke.rvi v2.1.0 in executable kext bundle com.apple.nke.rvi at /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kext:

Authenticating extension failed: Bad code signature} bash-3.2#

I finally managed to make it work on Intel Mac
That's dirty, but it works : you need to disable SPI.
So in recovery mode, open terminal and type : csrutil disable
Reboot, then try to load the extension manually : sudo kmutil load -p /Library/Apple/System/Library/Extensions/RemoteVirtualInterface.kext
That should popup something that redirect to System Settings where you need to agree on using an extension from à mighty developper called "Apple Inc."
Then reboot.
Then reloading manually the extension will be ok, and rvictl -s UUID also !

Yes, that is dirty, but until this extension signing is solved, I'm afraid I have no other choice ...

This issue (81125115) was fixed in Xcode 13.0 (13A233).

Disabling SIP as a workaround is no longer needed, so I recommend enabling SIP (check with csrutil status).

For Apple Silicon Macs, the Reduced Security policy "Allow user management of kernel extensions from identified developers" is still needed, instructions here.

The rviN device lasts for 20 seconds until the idle timer fires.

I’m not sure what’s going on here but, if you can reproduce this consistently, I’d appreciate you filing a bug against the RVI mechanism. Please attached two sysdiagnose logs, one from the Mac and one from the iOS device, taken immediately after things break down.

And if you can post your bug number, just for the record, that’d be grand.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hi, what helped for me [IOS 11.6 Big Sur - XCode 13.1]

rvictl had 2 locations on 'which' command, one with a double //

$ which -a rvictl
/Library/Apple/usr/bin//rvictl
/Library/Apple/usr/bin/rvictl

removing the '/Library/Apple/usr/bin//rvictl' from the PATH variable helped for me. I hope it works well for you too :-)

#list the PATH variables:
$ echo $PATH
/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Library/Apple/usr/bin/:/usr/local/share/dotnet:/opt/X11/bin:~/.dotnet/tools:/Library/Apple/usr/bin:/Library/Frameworks/Mono.framework/Versions/Current/Commands:/Applications/Wireshark.app/Contents/MacOS

#copy the returned variable and remove the one with //rvictl and overwrite with the new paths:
$ export PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/share/dotnet:/opt/X11/bin:~/.dotnet/tools:/Library/Apple/usr/bin:/Library/Frameworks/Mono.framework/Versions/Current/Commands:/Applications/Wireshark.app/Contents/MacOS

Now the 'which' command should only return a single instance:

$ which -a rvictl
/Library/Apple/usr/bin/rvictl

Folks, I’ve locked this thread. That’s because:

  • There have been significant improvements to RVI in recent releases, as indicated by the Apple Recommended answer.

  • This thread is now 3 pages long which makes it hard to find new posts or comments.

If you continue to have RVI problems, feel free to start a new thread with the details.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

rvictl not working on big sur and ios 14 beta 3
 
 
Q