has anyone spelunked into how to perhaps mash up mdls for kM

Question

has anyone spelunked into how to perhaps mash up mdls for kMDItemExecutableArchitectures to add a kind column to the apps table on Darwin

allister · Answer

this is in response to <https www alansiu net 2021 11 16 script to find application architectures on your mac >

allister · Answer

and the answer is of course you can mashem up ```osquery gt select count from apps join mdls on mdls path = apps path where mdls key = kMDItemExecutableArchitectures and mdls value not like arm64 count = 44```

seph · Answer

I wonder how cheap the mdls call is I wonder if this can be parsed out of Info plist or something

allister · Answer

good question it s not in the first info plist I m checking I need to get better at profiling

seph · Answer

The really quick way is to ` timer on` in osqueryi and see how different they look You can also get into queryy planning