mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 18:33:54 +00:00
93 lines
2.8 KiB
C++
93 lines
2.8 KiB
C++
/*
|
|
* Copyright (c) 2014, Facebook, Inc.
|
|
* All rights reserved.
|
|
*
|
|
* This source code is licensed under the BSD-style license found in the
|
|
* LICENSE file in the root directory of this source tree. An additional grant
|
|
* of patent rights can be found in the PATENTS file in the same directory.
|
|
*
|
|
*/
|
|
|
|
#include <CoreFoundation/CoreFoundation.h>
|
|
#include <IOKit/IOKitLib.h>
|
|
|
|
#include <osquery/core.h>
|
|
#include <osquery/logger.h>
|
|
#include <osquery/tables.h>
|
|
|
|
#include "osquery/core/conversions.h"
|
|
|
|
namespace osquery {
|
|
namespace tables {
|
|
|
|
#define kIODTOptionsPath_ "IODeviceTree:/options"
|
|
|
|
void genVariable(const void *key, const void *value, void *results) {
|
|
if (key == nullptr || value == nullptr || results == nullptr) {
|
|
// Paranoia: don't expect the callback application to yield nullptrs.
|
|
return;
|
|
}
|
|
|
|
// Variable name is the dictionary key.
|
|
Row nvram_row;
|
|
nvram_row["name"] = stringFromCFString((CFStringRef)key);
|
|
|
|
// Variable type will be defined by the CF type.
|
|
CFTypeID type_id = CFGetTypeID(value);
|
|
CFStringRef type_description = CFCopyTypeIDDescription(type_id);
|
|
nvram_row["type"] = stringFromCFString(type_description);
|
|
CFRelease(type_description);
|
|
|
|
// Based on the type, get a texual representation of the variable.
|
|
std::string value_string;
|
|
if (type_id == CFBooleanGetTypeID()) {
|
|
value_string = (CFBooleanGetValue((CFBooleanRef)value)) ? "true" : "false";
|
|
} else if (type_id == CFNumberGetTypeID()) {
|
|
value_string = stringFromCFNumber((CFDataRef)value);
|
|
} else if (type_id == CFStringGetTypeID()) {
|
|
value_string = stringFromCFString((CFStringRef)value);
|
|
} else if (type_id == CFDataGetTypeID()) {
|
|
value_string = stringFromCFData((CFDataRef)value);
|
|
} else {
|
|
// Unknown result type, do not attempt to decode/format.
|
|
value_string = "<INVALID>";
|
|
}
|
|
|
|
// Finally, add the variable value to the row.
|
|
nvram_row["value"] = value_string;
|
|
((QueryData *)results)->push_back(nvram_row);
|
|
}
|
|
|
|
QueryData genNVRAM(QueryContext &context) {
|
|
QueryData results;
|
|
|
|
mach_port_t master_port;
|
|
auto kr = IOMasterPort(bootstrap_port, &master_port);
|
|
if (kr != KERN_SUCCESS) {
|
|
VLOG(1) << "Could not get the IOMaster port";
|
|
return {};
|
|
}
|
|
|
|
// NVRAM registry entry is :/options.
|
|
auto options = IORegistryEntryFromPath(master_port, kIODTOptionsPath_);
|
|
if (options == 0) {
|
|
VLOG(1) << "NVRAM is not supported on this system";
|
|
return {};
|
|
}
|
|
|
|
CFMutableDictionaryRef options_dict;
|
|
kr = IORegistryEntryCreateCFProperties(options, &options_dict, 0, 0);
|
|
if (kr != KERN_SUCCESS) {
|
|
VLOG(1) << "Could not get NVRAM properties";
|
|
} else {
|
|
CFDictionaryApplyFunction(options_dict, &genVariable, &results);
|
|
}
|
|
|
|
// Cleanup (registry entry context).
|
|
CFRelease(options_dict);
|
|
IOObjectRelease(options);
|
|
return results;
|
|
}
|
|
}
|
|
}
|