7 ms·

What is AppleAVD? Audio video decode?

by WatchDog 5y ago

tlokas 5y ago
This is a shot in the dark, but could it be Azure Virtual Desktop for iOS?
bobabob 5y ago
It's a kernel extension for audio and video decoding. /System/Library/Extensions/AppleAVD.kext/
- SeanDMiddleton 5y ago
  Thanks for answering the question bobabob.
saagarjha 5y ago
It's a kext for decoding HEVC, H.264, and VP9.
- LeoNatan25 5y ago
  Sounds to me like a terrible OS design, to have such arbitrary things as video decoding, require a kernel extension. Microsoft move drivers, such as GPU, to user space, to escape exactly issues like these. This is likely done for the sake of DRM, which is even worse. But SiDeLoADiNg is what is threatening users’ security.
  - thetinguy 5y ago
    > Sounds to me like a terrible OS design, to have such arbitrary things as video decoding, require a kernel extension Why?
    - deleted 5y ago
      [deleted]
    - LeoNatan25 5y ago
      For exactly the reason they have to patch it. For exactly the same reason they are now disallowing custom kernel extensions. Apple engineers are not perfect machines, writing perfect code without issues. And so, here we are. Years in the wild exploit in a kernel extension for decoding h264. Ridiculous.
  - ocdtrekkie 5y ago
    You realize it's common for PCs to have entire dedicated hardware circuitry for this, right? The HEVC support for Windows 10 depends on hardware support, for instance. And the decoding for 4K Blu-rays is actually being dropped by Intel chips, which means desktop platforms are losing the ability to decide their encryption.
  - gjsman-1000 5y ago
    This is how macOS is designed. macOS has over 100 kexts in a fresh install (IIRC) to keep the main kernel as small and error-free as reasonably possible without being a full microkernel and taking the performance hit that causes. This makes it a Hybrid kernel, neither a full microkernel (safety at cost of performance) or monolithic kernel (performance at cost of safety). Other hybrid kernels include Windows and BeOS, though on Windows the kernel/extension separation is less clearly defined. https://en.wikipedia.org/wiki/Hybrid_kernel https://en.wikipedia.org/wiki/Hybrid_kernel > "Microsoft move drivers, such as GPU, to user space, to escape exactly issues like these. This is likely done for the sake of DRM, which is even worse." Heck... NO. Drivers are still in kernel space like ever. I don't know where you got that impression. Windows isn't a microkernel, it's got plenty of kernel drivers for everything. Only UMDF Drivers are userspace, and while there are many of them, none of them are as complex as a GPU. A GPU Driver in userspace on Windows would be massively performance bottlenecked. Microsoft even states in their documentation "File system drivers, display drivers (for full display devices, not display-only display devices), and print drivers cannot be UMDF drivers." https://docs.microsoft.com/en-us/windows-hardware/drivers/wdf/overview-of-the-umdf https://docs.microsoft.com/en-us/windows-hardware/drivers/wd...
    - LeoNatan25 5y ago
      Yes, and display drivers are in large part in user mode too: https://docs.microsoft.com/en-us/windows-hardware/drivers/display/user-mode-display-drivers https://docs.microsoft.com/en-us/windows-hardware/drivers/di... This has been the case since Windows Vista WDDM.
      - my123 5y ago
        So they are on Linux, macOS and other platforms. In fact the DirectX in kernel model used by Windows XP and earlier was the anomaly by modern terms.
        LeoNatan25 5y ago
        I don’t understand why you argue with me. Moving the user-space is good. My point is that the direction should be moving to user-space, not tacking more and more on the kernel, especially for silly things such as DRM.
  - soraminazuki 5y ago
    Which OS kernel doesn't provide video decoding capabilities nowadays? At least Linux does, and most likely Windows too. > This is likely done for the sake of DRM The reason is hardware acceleration. No sane OS vendor is going to place every single piece of code in the kernel where DRM is involved. > But SiDeLoADiNg Not disagreeing, but do you have to bring it up on every single issue? I don't see the connection here.

What is AppleAVD? Audio video decode?

tlokas 5y ago

This is a shot in the dark, but could it be Azure Virtual Desktop for iOS?

bobabob 5y ago

It's a kernel extension for audio and video decoding. /System/Library/Extensions/AppleAVD.kext/

SeanDMiddleton 5y ago
Thanks for answering the question bobabob.

saagarjha 5y ago

It's a kext for decoding HEVC, H.264, and VP9.

LeoNatan25 5y ago
Sounds to me like a terrible OS design, to have such arbitrary things as video decoding, require a kernel extension. Microsoft move drivers, such as GPU, to user space, to escape exactly issues like these. This is likely done for the sake of DRM, which is even worse. But SiDeLoADiNg is what is threatening users’ security.
- thetinguy 5y ago
  > Sounds to me like a terrible OS design, to have such arbitrary things as video decoding, require a kernel extension Why?
  - deleted 5y ago
    [deleted]
  - LeoNatan25 5y ago
    For exactly the reason they have to patch it. For exactly the same reason they are now disallowing custom kernel extensions. Apple engineers are not perfect machines, writing perfect code without issues. And so, here we are. Years in the wild exploit in a kernel extension for decoding h264. Ridiculous.
- ocdtrekkie 5y ago
  You realize it's common for PCs to have entire dedicated hardware circuitry for this, right? The HEVC support for Windows 10 depends on hardware support, for instance. And the decoding for 4K Blu-rays is actually being dropped by Intel chips, which means desktop platforms are losing the ability to decide their encryption.
- gjsman-1000 5y ago
  This is how macOS is designed. macOS has over 100 kexts in a fresh install (IIRC) to keep the main kernel as small and error-free as reasonably possible without being a full microkernel and taking the performance hit that causes. This makes it a Hybrid kernel, neither a full microkernel (safety at cost of performance) or monolithic kernel (performance at cost of safety). Other hybrid kernels include Windows and BeOS, though on Windows the kernel/extension separation is less clearly defined. https://en.wikipedia.org/wiki/Hybrid_kernel https://en.wikipedia.org/wiki/Hybrid_kernel > "Microsoft move drivers, such as GPU, to user space, to escape exactly issues like these. This is likely done for the sake of DRM, which is even worse." Heck... NO. Drivers are still in kernel space like ever. I don't know where you got that impression. Windows isn't a microkernel, it's got plenty of kernel drivers for everything. Only UMDF Drivers are userspace, and while there are many of them, none of them are as complex as a GPU. A GPU Driver in userspace on Windows would be massively performance bottlenecked. Microsoft even states in their documentation "File system drivers, display drivers (for full display devices, not display-only display devices), and print drivers cannot be UMDF drivers." https://docs.microsoft.com/en-us/windows-hardware/drivers/wdf/overview-of-the-umdf https://docs.microsoft.com/en-us/windows-hardware/drivers/wd...
  - LeoNatan25 5y ago
    Yes, and display drivers are in large part in user mode too: https://docs.microsoft.com/en-us/windows-hardware/drivers/display/user-mode-display-drivers https://docs.microsoft.com/en-us/windows-hardware/drivers/di... This has been the case since Windows Vista WDDM.
    - my123 5y ago
      So they are on Linux, macOS and other platforms. In fact the DirectX in kernel model used by Windows XP and earlier was the anomaly by modern terms.
      - LeoNatan25 5y ago
        I don’t understand why you argue with me. Moving the user-space is good. My point is that the direction should be moving to user-space, not tacking more and more on the kernel, especially for silly things such as DRM.
- soraminazuki 5y ago
  Which OS kernel doesn't provide video decoding capabilities nowadays? At least Linux does, and most likely Windows too. > This is likely done for the sake of DRM The reason is hardware acceleration. No sane OS vendor is going to place every single piece of code in the kernel where DRM is involved. > But SiDeLoADiNg Not disagreeing, but do you have to bring it up on every single issue? I don't see the connection here.