Take a look at the open-source WavTap, which is a simplified fork of the open-source SoundFlower virtual sound card driver. It is a .kext that I believe does substantially what you want.
For reference, here is how some popular commercial closed-source options work:
Rogue Amoeba’s Audio Hijack Pro
-Captures system audio via code based off of the open-source SoundFlower .kext
-Captures an application’s audio by substituting a “patch” framework for the normal CoreAudio.framework when launching the application
-Captures an already-running application’s audio with the help of the haxie “Application Enhancer” (APE) from Unsanity
These features are branded as their “Instant On” feature (InstantOn.kext).
Ambrosia Software’s WireTap Studio
-Captures system audio and application audio via an in-house developed .kext
Telestream’s ScreenFlow
-Captures system audio via an in-house developed .kext. (Version 2.x uses varaudio.kext; Version 3.x uses TelestreamAudio.kext)
Macsome’s Audio Recorder
-Unknown method
Araelium Group’s Screenflick
-Captures system audio using the SoundFlower .kext
UPDATE #1
After reading the author’s comments, it appears the underlying goal is to be able to capture the system sound without publishing the virtual audio driver as a device (that would appear in the System Preference’s list) and without changing the current default output device (or at least the appearance that the device has changed).
SoundFlower: Adds a sound device to the list upon installation
WavTap: Adds a sound device to the list upon installation; auto-selects the device when the WavTap application is started; auto-deselects the device when the application is shutdown and reselects the previous device
Audio Hijack Pro: Adds a sound device only when audio capture of the default system sound is selected; removes the sound device when audio capture is no longer selected and reselects the previous device
WireTap Studio: Unknown
ScreenFlow: Captures the system sound without changing the current default output device and without publishing the virtual audio driver as a device
UPDATE #2
A quote from Jeff Moore, a CoreAudio Apple engineer, in reference to applications such as WireTap and Audio Hijack Pro:
“There are no APIs on the system that will give you the output of any specific app or the whole mix going to the hardware…[Capturing System Sound] isn’t supported by the System and those folks had to be clever. There’s nothing stopping you from doing the same thing except how willing you are to get your hands dirty.
The fact is, Mac OS X’s audio system was designed first and foremost for performance. This lead us to a design where it is not easy to support the functionality you want without imposing performance penalties. So, we have opted for better performance at the cost of not being able to provide this feature.”
If you want to read more on the subject, check out these threads on the CoreAudio API mailing list:
“WireTap, CoreAudio’s API, and system capture, and kexts…”
“Another question on capturing audio played back by a software”
“Capturing currently played audio using CoreAudio on Mac”
“‘audio hijack'”
“monitoring system audio output like wire tap”
“Capturing audio output to a file”
“Mirroring Audio Output”
“Recording system audio”
Relevant SO Questions:
Hide Audio device using codeless kext
So long story short, you’re not likely to find examples from Apple that accomplish this, and you’re not likely to find open source code that accomplishes this either, unless someone is feeling very generous. It appears to be too valuable of information.