https://github.com/osquery/osquery logo
#general
Title
# general
j

Jordan

06/28/2022, 7:30 PM
Howdy all….on the topic of plugins, I know I can use a custom plugin for config, logger, and distributed queries, but I am having a hard time finding any docs on how to register a custom carve plugin. Can anyone point me to that please? Thanks! (specifically, I am looking to change how the carved file gets exported off the system)
s

Stefano Bonicatti

06/28/2022, 8:05 PM
afaik that’s not possible, https://github.com/osquery/osquery/blob/d2be385d71f401c85872f00d479df8f499164c5a/osquery/carver/carver.cpp there’s no registry involved in the carver operations so it’s hardcoded, with flags to choose some behaviors
j

Jordan

06/28/2022, 8:27 PM
okay….thanks thats how i thought i read it. appreciate the followup!
6 Views