check out this file for most of the osquery code that interacts with the virtual table api: https://github.com/facebook/osquery/blob/master/osquery/sql/virtual_table.cpp