I must admit I didn't understand the original sample with "headphones" as "48 65 61 64 70 68 6F 6E 65 73 00" and the actual search for the string <data>SGVhZHBob25lcwA=</data>
A+ JJ
Edit : one more question : Could it be possible with clover to replace a whole kext ie: put my applehda.kext in the kext folder and have it to replace the original one ? (or is it only a folder to load non existent kext)