@Phrohdoh so as zach said, the bulk of the work is done by SQLite’s lexer, parser, and planner via the virtual tables api. when you write a new osquery table, the python table specification that you write actually gets generated into C++ which interacts with the underlying C API for vtabs. the generated C++ knows how to call the table generator function (which is why you have to include the name of the table implementation function in the spec).