osquery-1/osquery/devtools/shell.cpp

/*
** 2001 September 15
**
** The author disclaims copyright to this source code.  In place of
** a legal notice, here is a blessing:
**
**    May you do good and not evil.
**    May you find forgiveness for yourself and forgive others.
**    May you share freely, never taking more than you give.
**
*************************************************************************
** This file contains code to implement the "sqlite" command line
** utility for accessing SQLite databases.
*/

#include <signal.h>
#include <stdio.h>

#ifdef WIN32
#define WIN32_LEAN_AND_MEAN
#include <windows.h>

#include <io.h>
#include <linenoise.h>
#else
#include <sys/resource.h>
#include <sys/time.h>

#include <readline/history.h>
#include <readline/readline.h>
#endif

#include <sqlite3.h>

#include <boost/algorithm/string/predicate.hpp>

#include <osquery/config.h>
#include <osquery/database.h>
#include <osquery/filesystem.h>
#include <osquery/flags.h>
#include <osquery/packs.h>

#include "osquery/devtools/devtools.h"
#include "osquery/filesystem/fileops.h"
#include "osquery/sql/virtual_table.h"

#if defined(SQLITE_ENABLE_WHERETRACE)
extern int sqlite3WhereTrace;
#endif

namespace fs = boost::filesystem;

namespace osquery {

/// Define flags used by the shell. They are parsed by the drop-in shell.
SHELL_FLAG(bool, csv, false, "Set output mode to 'csv'");
SHELL_FLAG(bool, json, false, "Set output mode to 'json'");
SHELL_FLAG(bool, line, false, "Set output mode to 'line'");
SHELL_FLAG(bool, list, false, "Set output mode to 'list'");
SHELL_FLAG(string, separator, "|", "Set output field separator, default '|'");
SHELL_FLAG(bool, header, true, "Toggle column headers true/false");
SHELL_FLAG(string, pack, "", "Run all queries in a pack");

/// Define short-hand shell switches.
SHELL_FLAG(bool, L, false, "List all table names");
SHELL_FLAG(string, A, "", "Select all from a table");

DECLARE_string(nullvalue);
DECLARE_string(extensions_socket);
}

static char zHelp[] =
    "Welcome to the osquery shell. Please explore your OS!\n"
    "You are connected to a transient 'in-memory' virtual database.\n"
    "\n"
    ".all [TABLE]       Select all from a table\n"
    ".bail ON|OFF       Stop after hitting an error; default OFF\n"
    ".echo ON|OFF       Turn command echo on or off\n"
    ".exit              Exit this program\n"
    ".header(s) ON|OFF  Turn display of headers on or off\n"
    ".help              Show this message\n"
    ".mode MODE         Set output mode where MODE is one of:\n"
    "                     csv      Comma-separated values\n"
    "                     column   Left-aligned columns.  (See .width)\n"
    "                     line     One value per line\n"
    "                     list     Values delimited by .separator string\n"
    "                     pretty   Pretty printed SQL results (default)\n"
    ".nullvalue STR     Use STRING in place of NULL values\n"
    ".print STR...      Print literal STRING\n"
    ".quit              Exit this program\n"
    ".schema [TABLE]    Show the CREATE statements\n"
    ".separator STR     Change separator used by output mode and .import\n"
    ".socket            Show the osquery extensions socket path\n"
    ".show              Show the current values for various settings\n"
    ".tables [TABLE]    List names of tables\n"
    ".trace FILE|off    Output each SQL statement as it is run\n"
    ".width [NUM1]+     Set column widths for \"column\" mode\n";

static char zTimerHelp[] =
    ".timer ON|OFF      Turn the CPU timer measurement on or off\n";

// Allowed modes
#define MODE_Line 0 // One column per line.  Blank line between records
#define MODE_Column 1 // One record per line in neat columns
#define MODE_List 2 // One record per line with a separator
#define MODE_Semi 3 // Same as MODE_List but append ";" to each line
#define MODE_Csv 4 // Quote strings, numbers are plain
#define MODE_Pretty 5 // Pretty print the SQL results

static const char* modeDescr[] = {
    "line", "column", "list", "semi", "csv", "pretty",
};

// ctype macros that work with signed characters
#define IsSpace(X) isspace((unsigned char)X)
#define IsDigit(X) isdigit((unsigned char)X)

// True if the timer is enabled
static int enableTimer = 0;

// Return the current wall-clock time
static sqlite3_int64 timeOfDay(void) {
  static sqlite3_vfs* clockVfs = 0;
  sqlite3_int64 t;
  if (clockVfs == 0) {
    clockVfs = sqlite3_vfs_find(0);
  }
  if (clockVfs->iVersion >= 1 && clockVfs->xCurrentTimeInt64 != 0) {
    clockVfs->xCurrentTimeInt64(clockVfs, &t);
  } else {
    double r;
    clockVfs->xCurrentTime(clockVfs, &r);
    t = (sqlite3_int64)(r * 86400000.0);
  }
  return t;
}

// Saved resource information for the beginning of an operation
#ifdef WIN32
struct rusage {
  FILETIME ru_utime;
  FILETIME ru_stime;
};
#endif

static struct rusage sBegin; // CPU time at start
static sqlite3_int64 iBegin; // Wall-clock time at start

static void beginTimer(void) {
  if (enableTimer) {
#ifdef WIN32
    FILETIME ftCreation, ftExit;
    ::GetProcessTimes(::GetCurrentProcess(),
                      &ftCreation,
                      &ftExit,
                      &sBegin.ru_stime,
                      &sBegin.ru_utime);
#else
    getrusage(RUSAGE_SELF, &sBegin);
#endif

    iBegin = timeOfDay();
  }
}

// Return the difference of two time_structs in seconds
#ifdef WIN32
static double timeDiff(FILETIME* pStart, FILETIME* pEnd) {
  ULARGE_INTEGER start, end;

  start.HighPart = pStart->dwHighDateTime;
  start.LowPart = pStart->dwLowDateTime;

  end.HighPart = pEnd->dwHighDateTime;
  end.LowPart = pEnd->dwLowDateTime;

  // start, end are in units of 100 nanoseconds
  return (end.QuadPart - start.QuadPart) * 0.0000001;
}
#else
static double timeDiff(struct timeval* pStart, struct timeval* pEnd) {
  return (pEnd->tv_usec - pStart->tv_usec) * 0.000001 +
         (double)(pEnd->tv_sec - pStart->tv_sec);
}
#endif

// End the timer and print the results.
static void endTimer(void) {
  if (enableTimer) {
    sqlite3_int64 iEnd = timeOfDay();
    struct rusage sEnd;

#ifdef WIN32
    FILETIME ftCreation, ftExit;
    ::GetProcessTimes(::GetCurrentProcess(),
                      &ftCreation,
                      &ftExit,
                      &sEnd.ru_stime,
                      &sEnd.ru_utime);
#else
    getrusage(RUSAGE_SELF, &sEnd);
#endif

    printf("Run Time: real %.3f user %f sys %f\n",
           (iEnd - iBegin) * 0.001,
           timeDiff(&sBegin.ru_utime, &sEnd.ru_utime),
           timeDiff(&sBegin.ru_stime, &sEnd.ru_stime));
  }
}

#define BEGIN_TIMER beginTimer()
#define END_TIMER endTimer()
#define HAS_TIMER 1

// If the following flag is set, then command execution stops
// at an error if we are not interactive.
static int bail_on_error = 0;

// Treat stdin as an interactive input if the following variable
// is true.  Otherwise, assume stdin is connected to a file or pipe.
static bool stdin_is_interactive = true;

// True if an interrupt (Control-C) has been received.
static volatile int seenInterrupt = 0;

static char mainPrompt[20]; // First line prompt. default: "sqlite> "
static char continuePrompt[20]; // Continuation prompt. default: "   ...> "

// A global char* and an SQL function to access its current value
// from within an SQL statement. This program used to use the
// sqlite_exec_printf() API to substitue a string into an SQL statement.
// The correct way to do this with sqlite3 is to use the bind API, but
// since the shell is built around the callback paradigm it would be a lot
// of work. Instead just use this hack, which is quite harmless.
static const char* zShellStatic = 0;
void shellstaticFunc(sqlite3_context* context,
                     int argc,
                     sqlite3_value** /* argv */) {
  assert(0 == argc);
  assert(zShellStatic);
  sqlite3_result_text(context, zShellStatic, -1, SQLITE_STATIC);
}

/*
** This routine reads a line of text from FILE in, stores
** the text in memory obtained from malloc() and returns a pointer
** to the text.  NULL is returned at end of file, or if malloc()
** fails.
**
** If zLine is not NULL then it is a malloced buffer returned from
** a previous call to this routine that may be reused.
*/
static char* local_getline(char* zLine, FILE* in) {
  int nLine = ((zLine == nullptr) ? 0 : 100);
  int n = 0;

  while (1) {
    if (n + 100 > nLine) {
      nLine = nLine * 2 + 100;
      auto zLine_new = (char*)realloc(zLine, nLine);
      if (zLine_new == nullptr) {
        free(zLine);
        return nullptr;
      }
      zLine = zLine_new;
    }
    if (fgets(&zLine[n], nLine - n, in) == 0) {
      if (n == 0) {
        free(zLine);
        return nullptr;
      }
      zLine[n] = 0;
      break;
    }
    while (zLine[n]) {
      n++;
    }
    if (n > 0 && zLine[n - 1] == '\n') {
      n--;
      if (n > 0 && zLine[n - 1] == '\r') {
        n--;
      }
      zLine[n] = 0;
      break;
    }
  }
  return zLine;
}

/*
** Retrieve a single line of input text.
**
** If in==0 then read from standard input and prompt before each line.
** If isContinuation is true, then a continuation prompt is appropriate.
** If isContinuation is zero, then the main prompt should be used.
**
** If zPrior is not NULL then it is a buffer from a prior call to this
** routine that can be reused.
**
** The result is stored in space obtained from malloc() and must either
** be freed by the caller or else passed back into this routine via the
** zPrior argument for reuse.
*/
static char* one_input_line(FILE* in, char* zPrior, int isContinuation) {
  char* zResult;
  if (in != 0) {
    zResult = local_getline(zPrior, in);
  } else {
    char* zPrompt = isContinuation ? continuePrompt : mainPrompt;
    free(zPrior);
#ifdef WIN32
    zResult = linenoise(zPrompt);
#else
    zResult = readline(zPrompt);
#endif
    if (zResult && *zResult) {
#ifdef WIN32
      linenoiseHistoryAdd(zResult);
#else
      add_history(zResult);
#endif
    }
  }
  return zResult;
}

/*
** Pretty print structure
 */
struct prettyprint_data {
  osquery::QueryData results;
  std::vector<std::string> columns;
  std::map<std::string, size_t> lengths;
};

/*
** An pointer to an instance of this structure is passed from
** the main program to the callback.  This is used to communicate
** state and mode information.
*/
struct callback_data {
  int echoOn; /* True to echo input commands */
  int cnt; /* Number of records displayed so far */
  FILE* out; /* Write results here */
  FILE* traceOut; /* Output for sqlite3_trace() */
  int mode; /* An output mode setting */
  int showHeader; /* True to show column names in List or Column mode */
  char* zDestTable; /* Name of destination table when MODE_Insert */
  char separator[20]; /* Separator character for MODE_List */
  int colWidth[100]; /* Requested width of each column when in column mode*/
  int actualWidth[100]; /* Actual width of each column */
  char nullvalue[20]; /* The text to print when a NULL comes back from
                      ** the database */
  char outfile[FILENAME_MAX]; /* Filename for *out */
  char* zFreeOnClose; /* Filename to free when closing */
  sqlite3_stmt* pStmt; /* Current statement if any. */
  FILE* pLog; /* Write log output here */
  int* aiIndent; /* Array of indents used in MODE_Explain */
  int nIndent; /* Size of array aiIndent[] */
  int iIndent; /* Index of current op in aiIndent[] */

  /* Additional attributes to be used in pretty mode */
  struct prettyprint_data* prettyPrint;
};

// Number of elements in an array
#define ArraySize(X) (int)(sizeof(X) / sizeof(X[0]))

/*
** Compute a string length that is limited to what can be stored in
** lower 30 bits of a 32-bit signed integer.
*/
static int strlen30(const char* z) {
  const char* z2 = z;
  while (*z2) {
    z2++;
  }
  return 0x3fffffff & (int)(z2 - z);
}

/*
** A callback for the sqlite3_log() interface.
*/
static void shellLog(void* pArg, int iErrCode, const char* zMsg) {
  struct callback_data* p = (struct callback_data*)pArg;
  if (p->pLog == 0) {
    return;
  }
  fprintf(p->pLog, "(%d) %s\n", iErrCode, zMsg);
  fflush(p->pLog);
}

/*
** Output the given string as a quoted according to C or TCL quoting rules.
*/
static void output_c_string(FILE* out, const char* z) {
  unsigned int c;
  fputc('"', out);
  while ((c = *(z++)) != 0) {
    if (c == '\\') {
      fputc(c, out);
      fputc(c, out);
    } else if (c == '"') {
      fputc('\\', out);
      fputc('"', out);
    } else if (c == '\t') {
      fputc('\\', out);
      fputc('t', out);
    } else if (c == '\n') {
      fputc('\\', out);
      fputc('n', out);
    } else if (c == '\r') {
      fputc('\\', out);
      fputc('r', out);
    } else if (!isprint(c & 0xff)) {
      fprintf(out, "\\%03o", c & 0xff);
    } else {
      fputc(c, out);
    }
  }
  fputc('"', out);
}

/*
** If a field contains any character identified by a 1 in the following
** array, then the string must be quoted for CSV.
*/
static const char needCsvQuote[] = {
    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
    1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
};

/*
** Output a single term of CSV.  Actually, p->separator is used for
** the separator, which may or may not be a comma.  p->nullvalue is
** the null value.  Strings are quoted if necessary.
*/
static void output_csv(struct callback_data* p, const char* z, int bSep) {
  FILE* out = p->out;
  if (z == 0) {
    fprintf(out, "%s", p->nullvalue);
  } else {
    int i;
    int nSep = strlen30(p->separator);
    for (i = 0; z[i]; i++) {
      if (needCsvQuote[((unsigned char*)z)[i]] ||
          (z[i] == p->separator[0] &&
           (nSep == 1 || memcmp(z, p->separator, nSep) == 0))) {
        i = 0;
        break;
      }
    }
    if (i == 0) {
      putc('"', out);
      for (i = 0; z[i]; i++) {
        if (z[i] == '"') {
          putc('"', out);
        }
        putc(z[i], out);
      }
      putc('"', out);
    } else {
      fprintf(out, "%s", z);
    }
  }
  if (bSep) {
    fprintf(p->out, "%s", p->separator);
  }
}

#ifdef SIGINT
/*
** This routine runs when the user presses Ctrl-C
*/
static void interrupt_handler(int signal) {
  if (signal == SIGINT) {
    seenInterrupt = 1;
  }
}
#endif

/*
** This is the callback routine that the shell
** invokes for each row of a query result.
*/
static int shell_callback(
    void* pArg, int nArg, char** azArg, char** azCol, int* aiType) {
  int i;
  struct callback_data* p = (struct callback_data*)pArg;

  switch (p->mode) {
  case MODE_Pretty: {
    if (p->prettyPrint->columns.size() == 0) {
      for (i = 0; i < nArg; i++) {
        p->prettyPrint->columns.push_back(std::string(azCol[i]));
      }
    }

    osquery::Row r;
    for (i = 0; i < nArg; ++i) {
      if (azCol[i] != nullptr) {
        r[std::string(azCol[i])] = (azArg[i] == nullptr)
                                       ? osquery::FLAGS_nullvalue
                                       : std::string(azArg[i]);
      }
    }
    osquery::computeRowLengths(r, p->prettyPrint->lengths);
    p->prettyPrint->results.push_back(r);
    break;
  }
  case MODE_Line: {
    int w = 5;
    if (azArg == 0) {
      break;
    }
    for (i = 0; i < nArg; i++) {
      int len = strlen30(azCol[i] ? azCol[i] : "");
      if (len > w) {
        w = len;
      }
    }
    if (p->cnt++ > 0) {
      fprintf(p->out, "\n");
    }
    for (i = 0; i < nArg; i++) {
      fprintf(p->out,
              "%*s = %s\n",
              w,
              azCol[i],
              azArg[i] ? azArg[i] : p->nullvalue);
    }
    break;
  }
  case MODE_Column: {
    if (p->cnt++ == 0) {
      for (i = 0; i < nArg; i++) {
        int w;
        if (i < ArraySize(p->colWidth)) {
          w = p->colWidth[i];
        } else {
          w = 0;
        }
        if (w == 0) {
          w = strlen30(azCol[i] ? azCol[i] : "");
          if (w < 10) {
            w = 10;
          }
          int n = strlen30(azArg && azArg[i] ? azArg[i] : p->nullvalue);
          if (w < n) {
            w = n;
          }
        }
        if (i < ArraySize(p->actualWidth)) {
          p->actualWidth[i] = w;
        }
        if (p->showHeader) {
          if (w < 0) {
            fprintf(p->out,
                    "%*.*s%s",
                    -w,
                    -w,
                    azCol[i],
                    i == nArg - 1 ? "\n" : "  ");
          } else {
            fprintf(p->out,
                    "%-*.*s%s",
                    w,
                    w,
                    azCol[i],
                    i == nArg - 1 ? "\n" : "  ");
          }
        }
      }
      if (p->showHeader) {
        for (i = 0; i < nArg; i++) {
          int w;
          if (i < ArraySize(p->actualWidth)) {
            w = p->actualWidth[i];
            if (w < 0) {
              w = -w;
            }
          } else {
            w = 10;
          }
          fprintf(p->out,
                  "%-*.*s%s",
                  w,
                  w,
                  "-----------------------------------"
                  "----------------------------------------------------------",
                  i == nArg - 1 ? "\n" : "  ");
        }
      }
    }
    if (azArg == 0) {
      break;
    }
    for (i = 0; i < nArg; i++) {
      int w;
      if (i < ArraySize(p->actualWidth)) {
        w = p->actualWidth[i];
      } else {
        w = 10;
      }
      if (i == 1 && p->aiIndent && p->pStmt) {
        if (p->iIndent < p->nIndent) {
          fprintf(p->out, "%*.s", p->aiIndent[p->iIndent], "");
        }
        p->iIndent++;
      }
      if (w < 0) {
        fprintf(p->out,
                "%*.*s%s",
                -w,
                -w,
                azArg[i] ? azArg[i] : p->nullvalue,
                i == nArg - 1 ? "\n" : "  ");
      } else {
        fprintf(p->out,
                "%-*.*s%s",
                w,
                w,
                azArg[i] ? azArg[i] : p->nullvalue,
                i == nArg - 1 ? "\n" : "  ");
      }
    }
    break;
  }
  case MODE_Semi:
  case MODE_List: {
    if (p->cnt++ == 0 && p->showHeader) {
      for (i = 0; i < nArg; i++) {
        fprintf(p->out, "%s%s", azCol[i], i == nArg - 1 ? "\n" : p->separator);
      }
    }
    if (azArg == 0) {
      break;
    }
    for (i = 0; i < nArg; i++) {
      char* z = azArg[i];
      if (z == 0) {
        z = p->nullvalue;
      }
      fprintf(p->out, "%s", z);
      if (i < nArg - 1) {
        fprintf(p->out, "%s", p->separator);
      } else if (p->mode == MODE_Semi) {
        fprintf(p->out, ";\n");
      } else {
        fprintf(p->out, "\n");
      }
    }
    break;
  }
  case MODE_Csv: {
    if (p->cnt++ == 0 && p->showHeader) {
      for (i = 0; i < nArg; i++) {
        output_csv(p, azCol[i] ? azCol[i] : "", i < nArg - 1);
      }
      fprintf(p->out, "\n");
    }
    if (azArg == 0) {
      break;
    }
    for (i = 0; i < nArg; i++) {
      output_csv(p, azArg[i], i < nArg - 1);
    }
    fprintf(p->out, "\n");
    break;
  }
  }
  return 0;
}

/*
** Set the destination table field of the callback_data structure to
** the name of the table given.  Escape any quote characters in the
** table name.
*/
static void set_table_name(struct callback_data* p, const char* zName) {
  int i, n;
  int needQuote;
  char* z;

  if (p->zDestTable) {
    free(p->zDestTable);
    p->zDestTable = 0;
  }

  if (zName == 0) {
    return;
  }

  needQuote = !isalpha((unsigned char)*zName) && *zName != '_';
  for (i = n = 0; zName[i]; i++, n++) {
    if (!isalnum((unsigned char)zName[i]) && zName[i] != '_') {
      needQuote = 1;
      if (zName[i] == '\'') {
        n++;
      }
    }
  }
  if (needQuote) {
    n += 2;
  }
  z = p->zDestTable = (char*)malloc(n + 1);
  if (z == 0) {
    fprintf(stderr, "Error: out of memory\n");
    exit(1);
  }
  n = 0;
  if (needQuote) {
    z[n++] = '\'';
  }
  for (i = 0; zName[i]; i++) {
    z[n++] = zName[i];
    if (zName[i] == '\'') {
      z[n++] = '\'';
    }
  }
  if (needQuote) {
    z[n++] = '\'';
  }
  z[n] = 0;
}

/*
** Allocate space and save off current error string.
*/
static char* save_err_msg(sqlite3* db) {
  int nErrMsg = 1 + strlen30(sqlite3_errmsg(db));
  char* zErrMsg = (char*)sqlite3_malloc(nErrMsg);
  if (zErrMsg) {
    memcpy(zErrMsg, sqlite3_errmsg(db), nErrMsg);
  }
  return zErrMsg;
}

/*
** Execute a statement or set of statements.  Print
** any result rows/columns depending on the current mode
** set via the supplied callback.
**
** This is very similar to SQLite's built-in sqlite3_exec()
** function except it takes a slightly different callback
** and callback data argument.
*/
static int shell_exec(
    const char* zSql, /* SQL to be evaluated */
    int (*xCallback)(void*, int, char**, char**, int*), /* Callback function */
    /* (not the same as sqlite3_exec) */
    struct callback_data* pArg, /* Pointer to struct callback_data */
    char** pzErrMsg /* Error msg written here */
    ) {
  // Grab a lock on the managed DB instance.
  auto dbc = osquery::SQLiteDBManager::get();
  auto db = dbc->db();

  sqlite3_stmt* pStmt = nullptr; /* Statement to execute. */
  int rc = SQLITE_OK; /* Return Code */
  int rc2;
  const char* zLeftover; /* Tail of unprocessed SQL */

  if (pzErrMsg) {
    *pzErrMsg = nullptr;
  }

  while (zSql[0] && (SQLITE_OK == rc)) {
    rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, &zLeftover);
    if (SQLITE_OK != rc) {
      if (pzErrMsg) {
        *pzErrMsg = save_err_msg(db);
      }
    } else {
      if (!pStmt) {
        /* this happens for a comment or white-space */
        zSql = zLeftover;
        while (IsSpace(zSql[0])) {
          zSql++;
        }
        continue;
      }

      /* save off the prepared statment handle and reset row count */
      if (pArg) {
        pArg->pStmt = pStmt;
        pArg->cnt = 0;
      }

      /* echo the sql statement if echo on */
      if (pArg && pArg->echoOn) {
        const char* zStmtSql = sqlite3_sql(pStmt);
        fprintf(pArg->out, "%s\n", zStmtSql ? zStmtSql : zSql);
      }

      /* perform the first step.  this will tell us if we
      ** have a result set or not and how wide it is.
      */
      rc = sqlite3_step(pStmt);
      /* if we have a result set... */
      if (SQLITE_ROW == rc) {
        /* if we have a callback... */
        if (xCallback) {
          /* allocate space for col name ptr, value ptr, and type */
          int nCol = sqlite3_column_count(pStmt);
          void* pData = sqlite3_malloc(3 * nCol * sizeof(const char*) + 1);
          if (!pData) {
            rc = SQLITE_NOMEM;
          } else {
            char** azCols = (char**)pData; /* Names of result columns */
            char** azVals = &azCols[nCol]; /* Results */
            int* aiTypes = (int*)&azVals[nCol]; /* Result types */
            int i;
            assert(sizeof(int) <= sizeof(char*));
            /* save off ptrs to column names */
            for (i = 0; i < nCol; i++) {
              azCols[i] = (char*)sqlite3_column_name(pStmt, i);
            }
            do {
              /* extract the data and data types */
              for (i = 0; i < nCol; i++) {
                aiTypes[i] = sqlite3_column_type(pStmt, i);
                azVals[i] = (char*)sqlite3_column_text(pStmt, i);
                if (!azVals[i] && (aiTypes[i] != SQLITE_NULL)) {
                  rc = SQLITE_NOMEM;
                  break; /* from for */
                }
              } /* end for */

              /* if data and types extracted successfully... */
              if (SQLITE_ROW == rc) {
                /* call the supplied callback with the result row data */
                if (xCallback(pArg, nCol, azVals, azCols, aiTypes)) {
                  rc = SQLITE_ABORT;
                } else {
                  rc = sqlite3_step(pStmt);
                }
              }
            } while (SQLITE_ROW == rc);
            sqlite3_free(pData);
          }
        } else {
          do {
            rc = sqlite3_step(pStmt);
          } while (rc == SQLITE_ROW);
        }
      }

      /* Finalize the statement just executed. If this fails, save a
      ** copy of the error message. Otherwise, set zSql to point to the
      ** next statement to execute. */
      rc2 = sqlite3_finalize(pStmt);
      if (rc != SQLITE_NOMEM) {
        rc = rc2;
      }
      if (rc == SQLITE_OK) {
        zSql = zLeftover;
        while (IsSpace(zSql[0])) {
          zSql++;
        }
      } else if (pzErrMsg) {
        *pzErrMsg = save_err_msg(db);
      }

      /* clear saved stmt handle */
      if (pArg) {
        pArg->pStmt = nullptr;
      }
    }
  } /* end while */
  dbc->clearAffectedTables();

  if (pArg && pArg->mode == MODE_Pretty) {
    if (osquery::FLAGS_json) {
      osquery::jsonPrint(pArg->prettyPrint->results);
    } else {
      osquery::prettyPrint(pArg->prettyPrint->results,
                           pArg->prettyPrint->columns,
                           pArg->prettyPrint->lengths);
    }
    pArg->prettyPrint->results.clear();
    pArg->prettyPrint->columns.clear();
    pArg->prettyPrint->lengths.clear();
  }

  return rc;
}

/* Forward reference */
static int process_input(struct callback_data* p, FILE* in);

/*
** Do C-language style dequoting.
**
**    \t    -> tab
**    \n    -> newline
**    \r    -> carriage return
**    \"    -> "
**    \NNN  -> ascii character NNN in octal
**    \\    -> backslash
*/
static void resolve_backslashes(char* z) {
  int i, j;
  char c;
  for (i = j = 0; (c = z[i]) != 0; i++, j++) {
    if (c == '\\') {
      c = z[++i];
      if (c == 'n') {
        c = '\n';
      } else if (c == 't') {
        c = '\t';
      } else if (c == 'r') {
        c = '\r';
      } else if (c == '\\') {
        c = '\\';
      } else if (c >= '0' && c <= '7') {
        c -= '0';
        if (z[i + 1] >= '0' && z[i + 1] <= '7') {
          i++;
          c = (c << 3) + z[i] - '0';
          if (z[i + 1] >= '0' && z[i + 1] <= '7') {
            i++;
            c = (c << 3) + z[i] - '0';
          }
        }
      }
    }
    z[j] = c;
  }
  z[j] = 0;
}

/*
** Return the value of a hexadecimal digit.  Return -1 if the input
** is not a hex digit.
*/
static int hexDigitValue(char c) {
  if (c >= '0' && c <= '9') {
    return c - '0';
  }
  if (c >= 'a' && c <= 'f') {
    return c - 'a' + 10;
  }
  if (c >= 'A' && c <= 'F') {
    return c - 'A' + 10;
  }
  return -1;
}

/*
** Interpret zArg as an integer value, possibly with suffixes.
*/
static sqlite3_int64 integerValue(const char* zArg) {
  sqlite3_int64 v = 0;
  static const struct {
    char* zSuffix;
    int iMult;
  } aMult[] = {
      {(char*)"KiB", 1024},
      {(char*)"MiB", 1024 * 1024},
      {(char*)"GiB", 1024 * 1024 * 1024},
      {(char*)"KB", 1000},
      {(char*)"MB", 1000000},
      {(char*)"GB", 1000000000},
      {(char*)"K", 1000},
      {(char*)"M", 1000000},
      {(char*)"G", 1000000000},
  };
  int i;
  int isNeg = 0;
  if (zArg[0] == '-') {
    isNeg = 1;
    zArg++;
  } else if (zArg[0] == '+') {
    zArg++;
  }
  if (zArg[0] == '0' && zArg[1] == 'x') {
    int x;
    zArg += 2;
    while ((x = hexDigitValue(zArg[0])) >= 0) {
      v = (v << 4) + x;
      zArg++;
    }
  } else {
    while (IsDigit(zArg[0])) {
      v = v * 10 + zArg[0] - '0';
      zArg++;
    }
  }
  for (i = 0; i < ArraySize(aMult); i++) {
    if (sqlite3_stricmp(aMult[i].zSuffix, zArg) == 0) {
      v *= aMult[i].iMult;
      break;
    }
  }
  return isNeg ? -v : v;
}

/*
** Interpret zArg as either an integer or a boolean value.  Return 1 or 0
** for TRUE and FALSE.  Return the integer value if appropriate.
*/
static int booleanValue(char* zArg) {
  int i;
  if (zArg[0] == '0' && zArg[1] == 'x') {
    for (i = 2; hexDigitValue(zArg[i]) >= 0; i++) {
    }
  } else {
    for (i = 0; zArg[i] >= '0' && zArg[i] <= '9'; i++) {
    }
  }
  if (i > 0 && zArg[i] == 0) {
    return (int)(integerValue(zArg) & 0xffffffff);
  }
  if (sqlite3_stricmp(zArg, "on") == 0 || sqlite3_stricmp(zArg, "yes") == 0) {
    return 1;
  }
  if (sqlite3_stricmp(zArg, "off") == 0 || sqlite3_stricmp(zArg, "no") == 0) {
    return 0;
  }
  fprintf(
      stderr, "ERROR: Not a boolean value: \"%s\". Assuming \"no\".\n", zArg);
  return 0;
}

/*
** Close an output file, assuming it is not stderr or stdout
*/
static void output_file_close(FILE* f) {
  if (f && f != stdout && f != stderr) {
    fclose(f);
  }
}

/*
** Try to open an output file.   The names "stdout" and "stderr" are
** recognized and do the right thing.  NULL is returned if the output
** filename is "off".
*/
static FILE* output_file_open(const char* zFile) {
  FILE* f;
  if (strcmp(zFile, "stdout") == 0) {
    f = stdout;
  } else if (strcmp(zFile, "stderr") == 0) {
    f = stderr;
  } else if (strcmp(zFile, "off") == 0) {
    f = 0;
  } else {
    boost::optional<FILE*> fp = osquery::platformFopen(zFile, "wb");
    if (!fp.is_initialized()) {
      fprintf(stderr, "Error: cannot open \"%s\"\n", zFile);
      f = 0;
    } else {
      f = *fp;
    }
  }
  return f;
}

inline void meta_tables(int nArg, char** azArg) {
  auto tables = osquery::Registry::names("table");
  std::sort(tables.begin(), tables.end());
  for (const auto& table_name : tables) {
    if (nArg == 1 || table_name.find(azArg[1]) == 0) {
      printf("  => %s\n", table_name.c_str());
    }
  }
}

inline void meta_schema(int nArg, char** azArg) {
  for (const auto& table_name : osquery::Registry::names("table")) {
    if (nArg > 1 && table_name.find(azArg[1]) != 0) {
      continue;
    }

    osquery::PluginRequest request = {{"action", "definition"}};
    osquery::PluginResponse response;
    osquery::Registry::call("table", table_name, request, response);
    fprintf(stdout,
            "CREATE TABLE %s%s;\n",
            table_name.c_str(),
            response[0].at("definition").c_str());
  }
}

/*
** If an input line begins with "." then invoke this routine to
** process that line.
**
** Return 1 on error, 2 to exit, and 0 otherwise.
*/
static int do_meta_command(char* zLine, struct callback_data* p) {
  int i = 1;
  int nArg = 0;
  int n, c;
  int rc = 0;
  char* azArg[50];

  /* Parse the input line into tokens.
  */
  while (zLine[i] && nArg < ArraySize(azArg)) {
    while (IsSpace(zLine[i])) {
      i++;
    }
    if (zLine[i] == 0) {
      break;
    }
    if (zLine[i] == '\'' || zLine[i] == '"') {
      int delim = zLine[i++];
      azArg[nArg++] = &zLine[i];
      while (zLine[i] && zLine[i] != delim) {
        if (zLine[i] == '\\' && delim == '"' && zLine[i + 1] != 0) {
          i++;
        }
        i++;
      }
      if (zLine[i] == delim) {
        zLine[i++] = 0;
      }
      if (delim == '"') {
        resolve_backslashes(azArg[nArg - 1]);
      }
    } else {
      azArg[nArg++] = &zLine[i];
      while (zLine[i] && !IsSpace(zLine[i])) {
        i++;
      }
      if (zLine[i]) {
        zLine[i++] = 0;
      }
      resolve_backslashes(azArg[nArg - 1]);
    }
  }

  /* Process the input line.
  */
  if (nArg == 0) {
    return 0; /* no tokens, no error */
  }
  n = strlen30(azArg[0]);
  c = azArg[0][0];
  if (c == 'a' && strncmp(azArg[0], "all", n) == 0 && nArg == 2) {
    struct callback_data data;
    memcpy(&data, p, sizeof(data));
    auto query = std::string("SELECT * FROM ") + azArg[1];
    rc = shell_exec(query.c_str(), shell_callback, &data, nullptr);
    if (rc != SQLITE_OK) {
      fprintf(stderr, "Error querying table: %s\n", azArg[1]);
    }
    return rc;
  }

  if (c == 's' && strncmp(azArg[0], "socket", n) == 0 && nArg == 1) {
    fprintf(p->out, "%s\n", osquery::FLAGS_extensions_socket.c_str());
    return rc;
  }

  // A meta command may act on the database, grab a lock and instance.
  auto dbc = osquery::SQLiteDBManager::get();
  auto db = dbc->db();

  if (c == 'b' && n >= 3 && strncmp(azArg[0], "bail", n) == 0 && nArg > 1 &&
      nArg < 3) {
    bail_on_error = booleanValue(azArg[1]);
  } else if (c == 'e' && strncmp(azArg[0], "echo", n) == 0 && nArg > 1 &&
             nArg < 3) {
    p->echoOn = booleanValue(azArg[1]);
  } else if (c == 'e' && strncmp(azArg[0], "exit", n) == 0) {
    if (nArg > 1 && (rc = (int)integerValue(azArg[1])) != 0) {
      exit(rc);
    }
    rc = 2;
  } else if (c == 'h' && (strncmp(azArg[0], "header", n) == 0 ||
                          strncmp(azArg[0], "headers", n) == 0) &&
             nArg > 1 && nArg < 3) {
    p->showHeader = booleanValue(azArg[1]);
  } else if (c == 'h' && strncmp(azArg[0], "help", n) == 0) {
    fprintf(stderr, "%s", zHelp);
    if (HAS_TIMER) {
      fprintf(stderr, "%s", zTimerHelp);
    }
  } else if (c == 'l' && strncmp(azArg[0], "log", n) == 0 && nArg >= 2) {
    const char* zFile = azArg[1];
    output_file_close(p->pLog);
    p->pLog = output_file_open(zFile);
  } else if (c == 'm' && strncmp(azArg[0], "mode", n) == 0 && nArg == 2) {
    int n2 = strlen30(azArg[1]);
    if ((n2 == 4 && strncmp(azArg[1], "line", n2) == 0) ||
        (n2 == 5 && strncmp(azArg[1], "lines", n2) == 0)) {
      p->mode = MODE_Line;
    } else if ((n2 == 6 && strncmp(azArg[1], "column", n2) == 0) ||
               (n2 == 7 && strncmp(azArg[1], "columns", n2) == 0)) {
      p->mode = MODE_Column;
    } else if (n2 == 4 && strncmp(azArg[1], "list", n2) == 0) {
      p->mode = MODE_List;
    } else if (n2 == 6 && strncmp(azArg[1], "pretty", n2) == 0) {
      p->mode = MODE_Pretty;
    } else if (n2 == 3 && strncmp(azArg[1], "csv", n2) == 0) {
      p->mode = MODE_Csv;
      sqlite3_snprintf(sizeof(p->separator), p->separator, ",");
    } else {
      fprintf(stderr,
              "Error: mode should be one of: "
              "column csv line list pretty\n");
      rc = 1;
    }
  } else if (c == 'n' && strncmp(azArg[0], "nullvalue", n) == 0 && nArg == 2) {
    sqlite3_snprintf(sizeof(p->nullvalue),
                     p->nullvalue,
                     "%.*s",
                     ArraySize(p->nullvalue) - 1,
                     azArg[1]);
  } else if (c == 'p' && n >= 3 && strncmp(azArg[0], "print", n) == 0) {
    int i;
    for (i = 1; i < nArg; i++) {
      if (i > 1) {
        fprintf(p->out, " ");
      }
      fprintf(p->out, "%s", azArg[i]);
    }
    fprintf(p->out, "\n");
  } else if (c == 'q' && strncmp(azArg[0], "quit", n) == 0 && nArg == 1) {
    rc = 2;
  } else if (c == 's' && strncmp(azArg[0], "schema", n) == 0 && nArg < 3) {
    meta_schema(nArg, azArg);
  } else if (c == 's' && strncmp(azArg[0], "separator", n) == 0 && nArg == 2) {
    sqlite3_snprintf(sizeof(p->separator),
                     p->separator,
                     "%.*s",
                     (int)sizeof(p->separator) - 1,
                     azArg[1]);
  } else if (c == 's' && strncmp(azArg[0], "show", n) == 0 && nArg == 1) {
    int i;
    fprintf(p->out, "%9.9s: %s\n", "echo", p->echoOn ? "on" : "off");
    fprintf(p->out, "%9.9s: %s\n", "headers", p->showHeader ? "on" : "off");
    fprintf(p->out, "%9.9s: %s\n", "mode", modeDescr[p->mode]);
    fprintf(p->out, "%9.9s: ", "nullvalue");
    output_c_string(p->out, p->nullvalue);
    fprintf(p->out, "\n");
    fprintf(p->out,
            "%9.9s: %s\n",
            "output",
            strlen30(p->outfile) ? p->outfile : "stdout");
    fprintf(p->out, "%9.9s: ", "separator");
    output_c_string(p->out, p->separator);
    fprintf(p->out, "\n");
    fprintf(p->out, "%9.9s: ", "width");
    for (i = 0; i < ArraySize(p->colWidth) && p->colWidth[i] != 0; i++) {
      fprintf(p->out, "%d ", p->colWidth[i]);
    }
    fprintf(p->out, "\n");
  } else if (c == 't' && n > 1 && strncmp(azArg[0], "tables", n) == 0 &&
             nArg < 3) {
    meta_tables(nArg, azArg);
  } else if (c == 'l' && n > 1 && strncmp(azArg[0], "list", n) == 0 &&
             nArg < 3) {
    meta_tables(nArg, azArg);
  } else if (c == 't' && n > 4 && strncmp(azArg[0], "timeout", n) == 0 &&
             nArg == 2) {
    sqlite3_busy_timeout(db, (int)integerValue(azArg[1]));
  } else if (HAS_TIMER && c == 't' && n >= 5 &&
             strncmp(azArg[0], "timer", n) == 0 && nArg == 2) {
    enableTimer = booleanValue(azArg[1]);
  } else if (c == 't' && strncmp(azArg[0], "trace", n) == 0 && nArg > 1) {
    output_file_close(p->traceOut);
    p->traceOut = output_file_open(azArg[1]);
  } else if (c == 'v' && strncmp(azArg[0], "version", n) == 0) {
    fprintf(p->out, "osquery %s\n", osquery::kVersion.c_str());
    fprintf(p->out, "using SQLite %s\n", sqlite3_libversion());
  } else if (c == 'w' && strncmp(azArg[0], "width", n) == 0 && nArg > 1) {
    int j;
    assert(nArg <= ArraySize(azArg));
    for (j = 1; j < nArg && j < ArraySize(p->colWidth); j++) {
      p->colWidth[j - 1] = (int)integerValue(azArg[j]);
    }
  } else {
    fprintf(stderr,
            "Error: unknown command or invalid arguments: "
            " \"%s\". Enter \".help\" for help\n",
            azArg[0]);
    rc = 1;
  }

  return rc;
}

/*
** Return TRUE if a semicolon occurs anywhere in the first N characters
** of string z[].
*/
static int line_contains_semicolon(const char* z, int N) {
  if (z == nullptr) {
    return 0;
  }

  for (int i = 0; i < N; i++) {
    if (z[i] == ';') {
      return 1;
    }
  }
  return 0;
}

/*
** Test to see if a line consists entirely of whitespace.
*/
static int _all_whitespace(const char* z) {
  if (z == nullptr) {
    return 0;
  }

  for (; *z; z++) {
    if (IsSpace(z[0])) {
      continue;
    }

    if (*z == '/' && z[1] == '*') {
      z += 2;
      while (*z && (*z != '*' || z[1] != '/')) {
        z++;
      }
      if (*z == 0) {
        return 0;
      }
      z++;
      continue;
    }
    if (*z == '-' && z[1] == '-') {
      z += 2;
      while (*z && *z != '\n') {
        z++;
      }
      if (*z == 0) {
        return 1;
      }
      continue;
    }
    return 0;
  }
  return 1;
}

/*
** Read input from *in and process it.  If *in==0 then input
** is interactive - the user is typing it it.  Otherwise, input
** is coming from a file or device.  A prompt is issued and history
** is saved only if input is interactive.  An interrupt signal will
** cause this routine to exit immediately, unless input is interactive.
**
** Return the number of errors.
*/
static int process_input(struct callback_data* p, FILE* in) {
  char* zLine = 0; /* A single input line */
  char* zSql = 0; /* Accumulated SQL text */
  int nLine; /* Length of current line */
  int nSql = 0; /* Bytes of zSql[] used */
  int nAlloc = 0; /* Allocated zSql[] space */
  int nSqlPrior = 0; /* Bytes of zSql[] used by prior line */
  char* zErrMsg; /* Error message returned */
  int rc; /* Error code */
  int errCnt = 0; /* Number of errors seen */
  int lineno = 0; /* Current line number */
  int startline = 0; /* Line number for start of current input */

  while (errCnt == 0 || !bail_on_error || (in == 0 && stdin_is_interactive)) {
    fflush(p->out);
    zLine = one_input_line(in, zLine, nSql > 0);
    if (zLine == 0) {
      /* End of input */
      if (stdin_is_interactive) {
        printf("\n");
      }
      break;
    }
    if (seenInterrupt) {
      if (in != 0) {
        break;
      }
      seenInterrupt = 0;
    }
    lineno++;
    if (nSql == 0 && _all_whitespace(zLine)) {
      if (p->echoOn) {
        printf("%s\n", zLine);
      }
      continue;
    }
    if (zLine && zLine[0] == '.' && nSql == 0) {
      if (p->echoOn) {
        printf("%s\n", zLine);
      }
      rc = do_meta_command(zLine, p);
      if (rc == 2) { /* exit requested */
        break;
      } else if (rc) {
        errCnt++;
      }
      continue;
    }
    nLine = strlen30(zLine);
    if (nSql + nLine + 2 >= nAlloc) {
      nAlloc = nSql + nLine + 100;
      zSql = (char*)realloc(zSql, nAlloc);
      if (zSql == 0) {
        fprintf(stderr, "Error: out of memory\n");
        exit(1);
      }
    }
    nSqlPrior = nSql;
    if (nSql == 0) {
      int i;
      for (i = 0; zLine[i] && IsSpace(zLine[i]); i++) {
      }
      assert(nAlloc > 0 && zSql != nullptr);
      if (zSql != nullptr) {
        memcpy(zSql, zLine + i, nLine + 1 - i);
      }
      startline = lineno;
      nSql = nLine - i;
    } else {
      zSql[nSql++] = '\n';
      memcpy(zSql + nSql, zLine, nLine + 1);
      nSql += nLine;
    }
    if (nSql && line_contains_semicolon(&zSql[nSqlPrior], nSql - nSqlPrior) &&
        sqlite3_complete(zSql)) {
      p->cnt = 0;
      BEGIN_TIMER;
      rc = shell_exec(zSql, shell_callback, p, &zErrMsg);
      END_TIMER;
      if (rc || zErrMsg) {
        char zPrefix[100];
        if (in != 0 || !stdin_is_interactive) {
          sqlite3_snprintf(
              sizeof(zPrefix), zPrefix, "Error: near line %d:", startline);
        } else {
          sqlite3_snprintf(sizeof(zPrefix), zPrefix, "Error:");
        }
        if (zErrMsg != 0) {
          fprintf(stderr, "%s %s\n", zPrefix, zErrMsg);
          sqlite3_free(zErrMsg);
          zErrMsg = 0;
        }
        errCnt++;
      }
      nSql = 0;
    } else if (nSql && _all_whitespace(zSql)) {
      if (p->echoOn) {
        printf("%s\n", zSql);
      }
      nSql = 0;
    }
  }
  if (nSql) {
    if (!_all_whitespace(zSql)) {
      fprintf(stderr, "Error: incomplete SQL: %s\n", zSql);
    }
    free(zSql);
  }
  free(zLine);
  return errCnt > 0;
}

/*
** Initialize the state information in data
*/
static void main_init(struct callback_data* data) {
  memset(data, 0, sizeof(struct callback_data));
  data->prettyPrint = new struct prettyprint_data();
  data->mode = MODE_Pretty;
  data->showHeader = 1;
  data->separator[0] = '|';

  sqlite3_config(SQLITE_CONFIG_URI, 1);
  sqlite3_config(SQLITE_CONFIG_LOG, shellLog, data);
  sqlite3_snprintf(sizeof(mainPrompt), mainPrompt, "osquery> ");
  sqlite3_snprintf(sizeof(continuePrompt), continuePrompt, "    ...> ");
  sqlite3_config(SQLITE_CONFIG_SINGLETHREAD);
}

/*
** Output text to the console in a font that attracts extra attention.
*/
static void printBold(const char* zText) {
  printf("\033[1m%s\033[0m", zText);
}

namespace osquery {

int launchIntoShell(int argc, char** argv) {
  struct callback_data data;
  main_init(&data);

#if defined(SQLITE_ENABLE_WHERETRACE)
  sqlite3WhereTrace = 0xffffffff;
#endif

  // Move the attach function method into the osquery SQL implementation.
  // This allow simple/straightforward control of concurrent DB access.
  osquery::attachFunctionInternal("shellstatic", shellstaticFunc);
  stdin_is_interactive = platformIsatty(stdin);

  // SQLite: Make sure we have a valid signal handler early
  signal(SIGINT, interrupt_handler);

  data.out = stdout;

  // Set modes and settings from CLI flags.
  data.showHeader = FLAGS_header;
  if (FLAGS_list) {
    data.mode = MODE_List;
  } else if (FLAGS_line) {
    data.mode = MODE_Line;
  } else if (FLAGS_csv) {
    data.mode = MODE_Csv;
    data.separator[0] = ',';
  } else {
    data.mode = MODE_Pretty;
  }

  sqlite3_snprintf(
      sizeof(data.separator), data.separator, "%s", FLAGS_separator.c_str());
  sqlite3_snprintf(
      sizeof(data.nullvalue), data.nullvalue, "%s", FLAGS_nullvalue.c_str());

  auto runQuery = [&data](const char* query) {
    char* error = 0;
    int rc = shell_exec(query, shell_callback, &data, &error);
    if (error != 0) {
      fprintf(stderr, "Error: %s\n", error);
      return (rc != 0) ? rc : 1;
    } else if (rc != 0) {
      fprintf(stderr, "Error: unable to process SQL \"%s\"\n", query);
    }
    return rc;
  };

  int rc = 0;
  if (FLAGS_L || FLAGS_A.size() > 0) {
    // Helper meta commands from shell switches.
    std::string query = (FLAGS_L) ? ".tables" : ".all " + FLAGS_A;
    char* cmd = new char[query.size() + 1];
    memset(cmd, 0, query.size() + 1);
    std::copy(query.begin(), query.end(), cmd);
    rc = do_meta_command(cmd, &data);
  } else if (FLAGS_pack.size() > 0) {
    // Check every pack for a name matching the requested --pack flag.
    Config::getInstance().packs([&runQuery, &rc](std::shared_ptr<Pack>& pack) {
      if (pack->getName() != FLAGS_pack) {
        return;
      }

      for (const auto& query : pack->getSchedule()) {
        rc = runQuery(query.second.query.c_str());
        if (rc != 0) {
          fprintf(stderr,
                  "Could not execute query %s: %s\n",
                  query.first.c_str(),
                  query.second.query.c_str());
          return;
        }
      }
    });
    if (rc != 0) {
      return rc;
    }
  } else if (argc > 1 && argv[1] != nullptr) {
    // Run a command or statement from CLI
    char* query = argv[1];
    if (query[0] == '.') {
      rc = do_meta_command(query, &data);
      rc = (rc == 2) ? 0 : rc;
    } else {
      rc = runQuery(query);
      if (rc != 0) {
        return rc;
      }
    }
  } else {
    // Run commands received from standard input
    if (stdin_is_interactive) {
      printBold("osquery");
      printf(
          " - being built, with love, at Facebook\n"
          "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
      printf("Using a ");
      printBold("virtual database");
      printf(". Need help, type '.help'\n");

      auto history_file =
          (fs::path(osquery::osqueryHomeDirectory()) / ".history")
              .make_preferred()
              .string();
#ifdef WIN32
      linenoiseHistorySetMaxLen(100);
      linenoiseHistoryLoad(history_file.c_str());
#else
      read_history(history_file.c_str());
#endif
      rc = process_input(&data, 0);

#ifdef WIN32
      linenoiseHistorySave(history_file.c_str());
#else
      stifle_history(100);
      write_history(history_file.c_str());
#endif
    } else {
      rc = process_input(&data, stdin);
    }
  }

  set_table_name(&data, 0);
  sqlite3_free(data.zFreeOnClose);

  if (data.prettyPrint != nullptr) {
    delete data.prettyPrint;
  }
  return rc;
}
}