VoodooHDABootloaderInjector
Since Big Sur, VoodooHDA.kext can't be injected straight from the bootloader. This tool makes it work anyway — one script, two patched kexts, zero SIP compromises. Clone it, run it, drop both kexts in your EFI.
https://github.com/chris1111/VoodooHDA-Bootloader-Injector.git
VoodooHDA Injector.tool
↳ the failure every VoodooHDA user knows — explained in §01, fixed by this tool.
Why direct injection fails
Since macOS Big Sur (11), injecting VoodooHDA.kext directly from the bootloader fails. The booter — OpenCore and Clover alike, they share the same injection engine — cannot link VoodooHDA because its parent classes live in Apple's IOAudioFamily.kext, which is not in the boot kernel collection (BootKernelExtensions.kc). The result, every single boot:
The script solves this automatically. Here is exactly what it does, step by step.
The idea, in one sentence
Ship a renamed copy of Apple's IOAudioFamily.kext alongside VoodooHDA — and make VoodooHDA link against the renamed copy. The booter then resolves everything at prelink time.
everything else on this page is the careful execution of that sentence
Step by step
Safety guards exits early if anything is wrong
VoodooHDA.kext is installed in /Library/Extensions — bootloader injection and an installed kext cannot coexist. The script prints the removal + rebuild commands for you.
VoodooHDA.kext is already patched (previous run) — prevents double-patching a distributed kext.
The script uses the kext provided in the ORIG-2.6.2 folder (unpatched VoodooHDA.kext) — it systematically regenerates the functional kext from this base.
Get a real IOAudioFamily.kext
Apple increasingly ships IOAudioFamily as a hollow stub — no binary inside (verified on Ventura 13 and Tahoe 26). The script finds a real one, in this order:
/System/Library/Extensions — used only if the binary is really there.
Kernel Debug Kit — auto-downloaded from Dortania's KdkSupportPkg:
- matches your exact running build (sw_vers)
- no exact match? it asks you: closest build (risky) or abort
- mounts the .dmg in /private/tmp
- expands the .pkg inside — yes, the dmg contains a pkg
- extracts IOAudioFamily.kext from the payload
- deletes the dmg + temp files automatically
Only KDK (or a real /S/L/E) binary is in the required pre-link state. Extracting from SystemKernelExtensions.kc does not work — those binaries are pre-relocated by Apple and hang the boot.
Patch the copy — the alias trick
The copy is modified so it can coexist with Apple's stock IOAudioFamily:
- binary thinned to x86_64 (arm64e slice removed)
- identifier renamed everywhere — inside the Mach-O binary and in Info.plist
Without the rename, the duplicate identifier stalls early boot (DriverKit stage). With it, the kernel loads both stacks happily — tested and verified.
Patch VoodooHDA.kext
Its OSBundleLibraries is rewritten:
Sign both kexts ad-hoc
Both kexts are re-signed after patching, so signatures verify cleanly.
Installation
Two kexts come out of the script — IOAudioFamily.kext (the renamed alias) and VoodooHDA.kext (patched). Both go into your EFI.
Clover
| Step | Action | Detail |
|---|---|---|
| 1 | Copy BOTH kexts | EFI/CLOVER/kexts/Other/ |
| 2 | Kernel → Block | No entries needed |
| 3 | SIP | No changes — works fully enabled |
| 4 | Reboot | that's it |
OpenCore
Kernel → Add — required order. The array order is the link order; wrong order = Invalid Parameter — see the live demo in §06.
| Step | Action | Detail |
|---|---|---|
| 1 | Copy BOTH kexts | EFI/OC/Kexts/ |
| 2 | OC config: Kernel → Add | Array order = link order — wrong order = Invalid Parameter (table below) |
| 3 | Kernel → Addorder-critical | IOAudioFamily.kext TOP — must be first |
| 4 | Kernel → Addorder-critical | VoodooHDA.kext BELOW IOAudioFamily |
| 5 | SIP | No changes — works fully enabled |
| 6 | Reboot | that's it |
SIP verified: macOS Tahoe 26.7.1 · OpenCore 1.0.7 · csr-active-config = 00000000 — fully enabled, no changes required.
Verify
Order decides everything
The booter resolves each injected kext's imports against the kexts injected before it in the Kernel → Add array. IOAudioFamily first = VoodooHDA's classes resolve. VoodooHDA first = nothing to resolve against = Invalid Parameter.
Try both orders below — the simulator runs the exact prelink sequence your bootloader performs.
Two kexts, one binary, zero collision
Two kexts with the same identifier cannot coexist. The stock IOAudioFamily (lives in the SystemKC) plus our injected copy = collision at early userspace. Renaming ours to net.voodoo.IOAudioFamily makes the kernel treat them as two different kexts — AppleHDA keeps its family, VoodooHDA gets its own.
Pre-link, or not at all
A kext binary extracted from a kernel collection has its relocations already applied by Apple's kcgen. The booter needs pre-link binaries (relocations intact) to place them at a new address. KDK ships pristine pre-link binaries — that is why the script refuses to use anything else.
SystemKernelExtensions.kc
relocations already applied by kcgen — binary is pre-relocated. The booter cannot place it at a new address → boot hangs.
Kernel Debug Kit
pristine pre-link binaries — relocations intact. The booter resolves and places them at prelink time → boot succeeds.