apfelkern
Why make this? Well, have you tried reading the official Apple documentation? To give you an example, try to figure out what mach_vm_map does.
If we look at the header files (no it's not in /usr/include) it turns out that they contain a lot of useful information that their documentation generation system ignores.
If you want me to add more components (Frameworks, XNU kernel parts), feel free to message me.
Guides
Mach
The Mach microkernel interface: tasks, threads, ports, messages, virtual memory, exceptions.
Tasks & threads
Ports & messages
Virtual memory
Host & processors
Exceptions
Vouchers & misc
Architecture
BSD / POSIX
The BSD layer and POSIX system interface: files, processes, signals, sockets, memory, terminals, sysctl, and friends.
Types & conventions
Threads & scheduling
Memory & IPC
Strings & text
Atomics, byte order & libkern
Data structures
Events & kqueue
Files & directories
Processes & signals
Networking
Time
Terminals
Audit (BSM)
Tracing & debugging
Misc
Kernel (KEXT)
The in-kernel API from Kernel.framework, as seen by kernel extensions: kern/ primitives, kernel-side sys/ and mach/, BSD KPIs, libkern, and the C surface of IOKit. Compiled with KERNEL defined, arm64. C++ classes (IOKit/libkern C++) are not yet extracted.
kern/ primitives
Mach (kernel)
BSD (kernel)
Networking KPIs
libkern & os
IOKit
VM & pexpert
Architecture
Mach-O
The Mach-O object file format (load commands, symbol tables, fat binaries, chained fixups) and the dyld runtime interface.
File format
Runtime & dyld
Architecture
XPC
The C XPC API: typed serializable objects, connections, listeners, sessions, and activities.
Hypervisor
Hypervisor.framework: the arm64 virtualization C API — VMs, vCPUs, the GIC, and guest memory.
Dispatch
libdispatch (Grand Central Dispatch): queues, groups, sources, semaphores, workloops, dispatch I/O and data objects.
os/
The os/ userspace primitives: unified logging and signposts, unfair locks, workgroups, clocks, atomics and overflow-checked arithmetic.
EndpointSecurity
The EndpointSecurity C API: subscribing to and authorizing security-relevant kernel events (exec, open, signals, mounts, ...).
CommonCrypto
CommonCrypto: digests, HMAC, symmetric ciphers, key derivation, random bytes and key wrapping.
About & caveats
apfelkern hosts C API documentation generated from the macOS SDK headers installed on my own machine. It is not affiliated with, endorsed by, or reviewed by Apple.
Build environment:
| macOS | 26.4.1 |
| SDK | 26.4 (MacOSX.sdk, Command Line Tools) |
| architecture | arm64; Intel-only headers and preprocessor branches are excluded |
| configuration | userspace corpora: default userspace preprocessor context; Kernel (KEXT) corpus: -DKERNEL |
| compiler | Apple clang version 21.0.0 (clang-2100.0.123.102) |
| xnu source used for verification | apple-oss-distributions/xnu @ f6217f8 (2025-10-16) |
| generated | 2026-09-08 |
Unless specified otherwise, descriptions are extracted from macOS header comments, MIG .defs files and SDK man pages.
CMU/MIT Mach reference: Where applicable, description and notes from the Carnegie Mellon Mach kernel (CMU Mach) interface manual pages (fetched from <web.mit.edu/darwin/src/modules>) are supplied. This data is licensed under the free-use license (© Carnegie Mellon University) and may not apply to XNU.
GNU Mach reference: Where applicable, description and notes from the GNU Mach Reference Manual (fetched from http://gnu.org/software/hurd/gnumach-doc/) are supplied. This data is licensed under the GNU Free Documentation License 1.2+ (© Free Software Foundation) and may not apply to XNU.
LLVM project source: Selected LLDB debugserver source files (https://github.com/llvm/llvm-project). Licensed under the Apache License v2.0 with LLVM Exceptions.
Generated descriptions: Functions with no documentation in any of these sources have an LLM-generated description shown below them showing the XNU source files consulted. These descriptions are unreviewed and may contain errors.