Is there a table that includes macOS information s...
# generals
Shawn Maddock
05/03/2024, 5:13 PMIs there a table that includes macOS information similar to
sfltool dumpbtms
sharvil
05/03/2024, 5:16 PMunfortunately not, the BTM apis are in a private BackgroundTaskManagement.framework
sharvil
05/03/2024, 5:16 PMeasiest would be to write an extension that shells out
s
Shawn Maddock
05/03/2024, 5:17 PMThank you 💙
s
sharvil
05/03/2024, 5:20 PMalso if you are writing/scraping that, it now shows info per uid (just a minor gotcha, I spun my wheels a bit on it when I did this last year)
s
Shawn Maddock
05/03/2024, 5:21 PMYeah, it's definitely "friendly" output, not easily parsed
Shawn Maddock
05/03/2024, 5:22 PMThat Apple article says MEU can display similar information, which might be more parse-able.
s
sharvil
05/03/2024, 5:23 PMIt’s basically reading the db file in
/private/var/db/com.apple.backgroundtaskmanagement/g
grahamgilbert
05/04/2024, 2:06 AMThis sounds like a good table for the macadmins extension https://github.com/macadmins/osquery-extension
9 Views