I noticed that osquery's code for retrieving a fil...
# core
m
I noticed that osquery's code for retrieving a file's version number on windows is actually accessing the `VS_FIXEDFILEINFO`'s
dwProductVersion*
fields rather than the
dwFileVersion*
fields, just wondering if there was any story behind this? https://github.com/facebook/osquery/blob/992d2d3396aa13ca42cc775fcfae2af5cd008d29/osquery/filesystem/windows/fileops.cpp#L137-L140 https://docs.microsoft.com/en-us/windows/desktop/api/verrsrc/ns-verrsrc-tagvs_fixedfileinfo
👀 1
hey @ryanheffernan , i noticed that it looks like you authored this code in PR 3436 -- any chance you might be able to help me understand this? 🙂