Rafa Bono
11/14/2024, 10:18 AMioreg -r -c IOHIDDevice -l -w0 -k ReportDescriptor
By using the ioreg
table: https://fleetdm.com/tables/ioreg
Would be this the correct way to write it?
SELECT * FROM ioreg WHERE c='IOHIDDevice' AND k='ReportDescriptor';
When running the command locally I'm getting results but not when running it from Fleet. I'm getting results running select * from ioreg;
but the output is not what I was expecting, as I'd like to get the ReportDescriptor element from it, and the full output is not providing this information.
Devices are running fleetd
, osquery version 5.14.1 and are macOS devices.Rafa Bono
11/14/2024, 10:19 AMioreg
man page:
NAME
ioreg – show I/O Kit registry
SYNOPSIS
ioreg [-abfilrtxy] [-c class] [-d depth] [-k key] [-n name] [-p plane] [-w width]
DESCRIPTION
ioreg displays the I/O Kit registry. It shows the hierarchical registry structure as an inverted tree. The provider-client relationships among those objects is shown as follows:
+-o provider
|
+-o client
By default, object properties are not shown. The use of the -c, -k, -l, or -n options cause ioreg to show properties for objects that match the specified criteria.
By supplying the -r option, the user may specify the object which will appear at the root of the tree with the -c, -k, or -n options. If root matches more than one object, multiple trees will be displayed.
The options are as follows:
-a Archive the output in XML.
-b Show the object name in bold.
-c Show the object properties only if the object is an instance of, or derives from, the specified C++ class (e.g. IOService).
-d Limit tree traversal to the specified depth. The depth limit is applied with respect to each subtree root individually. Therefore, supplying a depth of 1 will cause ioreg to display only (sub)tree
root nodes; children will not be shown.
-f Enable smart formatting. ioreg knows how to format certain properties so that the output is more readable and meaningful, decoding data fields where appropriate. Currently supported are `reg',
`assigned-addresses', `slot-names', `ranges', `interrupt-map', `interrupt-parent`, and `interrupts'.
-i Show the object inheritance.
-k Show the object properties only if the object has the specified key. Substrings do not match; the specified key must be a full property name.
-l Show properties for all displayed objects.
-n Show the object properties only if the object has the specified name. The object location, if any, is considered part of the name, thus pci@f0000000 and pci@f4000000 are distinct names.
-p Traverse the registry over the specified plane. The default plane value is ``IOService''. The other planes, such as ``IODeviceTree'', can be found under the ``IORegistryPlanes'' property of the root
object (ioreg -d 1 -k IORegistryPlanes).
-r Show subtrees rooted by objects that match the specified criteria. If none of -c, -k, or -n are supplied, -r has no effect.
-t Show tree location of each subtree. This option causes ioreg to display all nodes between the I/O Kit Root and the root of the displayed subtree, i.e. the subtree's parent, grandparent, etc.
-w Clip the output to the specified line width. The default width value is the current screen size. A value of 0 specifies an unlimited line width.
-x Show data and numbers as hexadecimal.
Do not consider DriverKit classes with -c.
FG
11/14/2024, 3:12 PMFG
11/14/2024, 3:25 PMSELECT c,fullkey, k,value AS value FROM ioreg WHERE c='IOHIDDevice' AND k='ReportDescriptor' AND fullkey LIKE "%ReportDescriptor%";
FG
11/14/2024, 3:26 PMRafa Bono
11/14/2024, 3:26 PMFG
11/14/2024, 3:27 PMFG
11/14/2024, 3:33 PMSELECT c,fullkey,key,k,HEX(FROM_BASE64(value)) AS value FROM ioreg WHERE c='IOHIDDevice' AND k='ReportDescriptor' AND fullkey LIKE "%ReportDescriptor%" LIMIT 5;