Why is kernel debugging fun?

Just look at this:

kernel fun

I just got Little Snitch to keep working even with network filter being off (that should be equivalent to expired 3 hour trial). The game is still not over because only the Once button is working but it seems I have my entry point ๐Ÿ˜„.

Little Snitch works by using a socket filter (Apple document here) installed when kernel module starts (Correction: Little Snitch kernel module is an IOKit driver and not a simple kernel extension). This filter is not removed when the we stop/start Little Snitch network filter so we can abuse itโ€™s condition check (thatโ€™s what I did here).

Thatโ€™s it… for now!

P.S.: Buy it if you really use it ๐Ÿ˜‰.