Ejemplo n.º 1
0
QueryData genPlatformInfo(QueryContext& context) {
    auto rom = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/rom");
    if (rom == 0) {
        return {};
    }

    CFMutableDictionaryRef details = nullptr;
    IORegistryEntryCreateCFProperties(
        rom, &details, kCFAllocatorDefault, kNilOptions);
    IOObjectRelease(rom);

    // Success is determined by the details dictionary existence.
    if (details == nullptr) {
        return {};
    }

    Row r;
    r["vendor"] = getIOKitProperty(details, "vendor");
    r["volume_size"] = getIOKitProperty(details, "fv-main-size");
    r["size"] = getIOKitProperty(details, "rom-size");
    r["date"] = getIOKitProperty(details, "release-date");
    r["version"] = getIOKitProperty(details, "version");

    {
        auto address = getIOKitProperty(details, "fv-main-address");
        auto value = boost::lexical_cast<size_t>(address);

        std::stringstream hex_id;
        hex_id << std::hex << std::setw(8) << std::setfill('0') << value;
        r["address"] = "0x" + hex_id.str();
    }

    {
        std::vector<std::string> extra_items;
        auto info = getIOKitProperty(details, "apple-rom-info");
        std::vector<std::string> info_lines;
        iter_split(info_lines, info, boost::algorithm::first_finder("%0a"));
        for (const auto& line : info_lines) {
            std::vector<std::string> details;
            iter_split(details, line, boost::algorithm::first_finder(": "));
            if (details.size() > 1) {
                boost::trim(details[1]);
                if (details[0].find("Revision") != std::string::npos) {
                    r["revision"] = details[1];
                }
                extra_items.push_back(details[1]);
            }
        }
        r["extra"] = osquery::join(extra_items, "; ");
    }

    CFRelease(details);
    return {r};
}
Ejemplo n.º 2
0
 inline SequenceSequenceT& split(
     SequenceSequenceT& Result,
     RangeT& Input,
     PredicateT Pred,
     token_compress_mode_type eCompress=token_compress_off )
 {
     return iter_split(
         Result,
         Input,
         token_finder( Pred, eCompress ) );         
 }
Ejemplo n.º 3
0
 inline SequenceSequenceT& split_regex(
     SequenceSequenceT& Result,
     const RangeT& Input,
     const basic_regex<CharT, RegexTraitsT>& Rx,
     match_flag_type Flags=match_default )
 {
     return iter_split(
         Result,
         Input,
         regex_finder(Rx,Flags) );         
 }