title: Reverse Engineering an Apple Kext - Reconstructing the Class
body: <p>Greetings!</p>
  
  <p>I am currently attempting to extend the functionality of the Magic Mouse. To do this, I am hoping to write a kext that intercepts events from the multitouch driver, AppleMultitouchDriver.kext, interprets them, and either dispatches new events or forwards the actual event. This approach is similar to the approach used by <a href="http://github.com/mbaltaks/doublecommand" rel="noreferrer">DoubleCommand</a>. </p>
  
  <p>I have already created a small test kext that intercepts the mouse events (click, motion, etc) as that will be needed also.</p>
  
  <p>The problem I am having now is that I am unable to intercept the events from the AppleMultitouchDevice and/or AppleMultitouchHIDEventDriver objects because there is no class definition for them. I need to be able to reassign the pointer to the callback function as I do in the mouse interceptor and as is done in DoubleCommand. As far as I know, this means I need to reconstruct the AppleMultitouchDevice class. I already am able to get a reference to the instance of the AppleMultitouchDevice object, so I just need to be able to cast it and use it.</p>
  
  <p>Now that you have the background, here are my direct questions:  </p>
  
  <ul>
  <li>What methods do I need to use in order to reverse engineer the kext or reconstruct the classes in question?</li>
  <li>What programs are available that will assist me in this effort?</li>
  <li>Are there any tutorials or e-books that focus on this particular topic that you know of?</li>
  <li>Is it possible for me to reassign the callback pointer without actually reconstructing the entire class?</li>
  <li>Anything else I may have missed as I am so very new to this.</li>
  </ul>
  
  <p>Thanks in advance for any advice or assistance!!</p>