valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-08 02:18:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1472 from theopolis/usb_osx

Browse Source 
[Fix #1432] Improve OS X USB device reporting
This commit is contained in:
Teddy Reed 2015-08-28 10:10:23 -07:00
commit 14ee346eea
1 changed files with 31 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
osquery/tables/system/darwin/usb_devices.cpp
View File

@ -8,6 +8,9 @@
*
*/
#include <iomanip>
#include <sstream>
#include <IOKit/IOKitLib.h>
#include <IOKit/usb/IOUSBLib.h>
@ -37,6 +40,13 @@ std::string getUSBProperty(const CFMutableDictionaryRef& details,
return "";
}
inline void idToHex(std::string& id) {
int base = AS_LITERAL(int, id);
std::stringstream hex_id;
hex_id << std::hex << std::setw(4) << std::setfill('0') << (base & 0xFFFF);
id = hex_id.str();
}
void genUSBDevice(const io_service_t& device, QueryData& results) {
Row r;
@ -49,15 +59,34 @@ void genUSBDevice(const io_service_t& device, QueryData& results) {
r["usb_port"] = getUSBProperty(details, "PortNum");
r["model"] = getUSBProperty(details, "USB Product Name");
if (r.at("model").size() == 0) {
// Could not find the model name from IOKit, use the label.
io_name_t name;
if (IORegistryEntryGetName(device, name) == KERN_SUCCESS) {
r["model"] = std::string(name);
}
}
r["model_id"] = getUSBProperty(details, "idProduct");
r["vendor"] = getUSBProperty(details, "USB Vendor Name");
r["vendor_id"] = getUSBProperty(details, "idVendor");
r["serial"] = getUSBProperty(details, "iSerialNumber");
r["serial"] = getUSBProperty(details, "USB Serial Number");
if (r.at("serial").size() == 0) {
r["serial"] = getUSBProperty(details, "iSerialNumber");
}
auto non_removable = getUSBProperty(details, "non-removable");
r["removable"] = (non_removable == "yes") ? "0" : "1";
results.push_back(r);
if (r.at("vendor_id").size() > 0 && r.at("model_id").size() > 0) {
// Only add the USB device on OS X if it contains a Vendor and Model ID.
// On OS X 10.11 the simulation hubs are PCI devices within IOKit and
// lack the useful USB metadata.
idToHex(r["vendor_id"]);
idToHex(r["model_id"]);
results.push_back(r);
}
CFRelease(details);
}