https://github.com/osquery/osquery logo
#macos
Title
# macos
a

allister

11/16/2021, 8:22 AM
has anyone spelunked into how to perhaps mash up mdls for kMDItemExecutableArchitectures to add a "kind" column to the apps table on Darwin?
and the answer is of course you can mashem up
Copy code
osquery> select count(*) from apps join mdls on mdls.path = apps.path where mdls.key = "kMDItemExecutableArchitectures" and mdls.value not like "arm64%"; 
count(*) = 44
👌 1
s

seph

11/18/2021, 1:59 AM
I wonder how cheap the mdls call is. I wonder if this can be parsed out of Info.plist or something
a

allister

11/18/2021, 2:22 AM
good question, it's not in the first info.plist I'm checking. I need to get better at profiling
s

seph

11/18/2021, 4:15 PM
The really quick way is to
.timer on
in osqueryi and see how different they look. You can also get into queryy planning.