{"action":"created","comment":{"url":"https://api.github.com/repos/facebook/osquery/pulls/comments/215200985","pull_request_review_id":152412593,"id":215200985,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIxNTIwMDk4NQ==","diff_hunk":"@@ -0,0 +1,94 @@\n+/**\n+ *  Copyright (c) 2018-present, Facebook, Inc.\n+ *  All rights reserved.\n+ *\n+ *  This source code is licensed under both the Apache 2.0 license (found in the\n+ *  LICENSE file in the root directory of this source tree) and the GPLv2 (found\n+ *  in the COPYING file in the root directory of this source tree).\n+ *  You may select, at your option, one of the above-listed licenses.\n+ */\n+\n+#import <AppKit/NSDocument.h>","path":"osquery/tables/system/darwin/ibridge.h","position":11,"original_position":11,"commit_id":"5e93059d2907a45d5585a2a512dce2a094429eb1","original_commit_id":"5e93059d2907a45d5585a2a512dce2a094429eb1","user":{"login":"guliashvili","id":4594711,"node_id":"MDQ6VXNlcjQ1OTQ3MTE=","avatar_url":"https://avatars3.githubusercontent.com/u/4594711?v=4","gravatar_id":"","url":"https://api.github.com/users/guliashvili","html_url":"https://github.com/guliashvili","followers_url":"https://api.github.com/users/guliashvili/followers","following_url":"https://api.github.com/users/guliashvili/following{/other_user}","gists_url":"https://api.github.com/users/guliashvili/gists{/gist_id}","starred_url":"https://api.github.com/users/guliashvili/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guliashvili/subscriptions","organizations_url":"https://api.github.com/users/guliashvili/orgs","repos_url":"https://api.github.com/users/guliashvili/repos","events_url":"https://api.github.com/users/guliashvili/events{/privacy}","received_events_url":"https://api.github.com/users/guliashvili/received_events","type":"User","site_admin":false},"body":"#pragma once","created_at":"2018-09-05T09:40:18Z","updated_at":"2018-09-05T09:40:18Z","html_url":"https://github.com/facebook/osquery/pull/5166#discussion_r215200985","pull_request_url":"https://api.github.com/repos/facebook/osquery/pulls/5166","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments/215200985"},"html":{"href":"https://github.com/facebook/osquery/pull/5166#discussion_r215200985"},"pull_request":{"href":"https://api.github.com/repos/facebook/osquery/pulls/5166"}}},"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/5166","id":212574315,"node_id":"MDExOlB1bGxSZXF1ZXN0MjEyNTc0MzE1","html_url":"https://github.com/facebook/osquery/pull/5166","diff_url":"https://github.com/facebook/osquery/pull/5166.diff","patch_url":"https://github.com/facebook/osquery/pull/5166.patch","issue_url":"https://api.github.com/repos/facebook/osquery/issues/5166","number":5166,"state":"open","locked":false,"title":"Add iBridge table to report on macOS controller","user":{"login":"terracatta","id":315873,"node_id":"MDQ6VXNlcjMxNTg3Mw==","avatar_url":"https://avatars0.githubusercontent.com/u/315873?v=4","gravatar_id":"","url":"https://api.github.com/users/terracatta","html_url":"https://github.com/terracatta","followers_url":"https://api.github.com/users/terracatta/followers","following_url":"https://api.github.com/users/terracatta/following{/other_user}","gists_url":"https://api.github.com/users/terracatta/gists{/gist_id}","starred_url":"https://api.github.com/users/terracatta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/terracatta/subscriptions","organizations_url":"https://api.github.com/users/terracatta/orgs","repos_url":"https://api.github.com/users/terracatta/repos","events_url":"https://api.github.com/users/terracatta/events{/privacy}","received_events_url":"https://api.github.com/users/terracatta/received_events","type":"User","site_admin":false},"body":"### What is this change?\r\n\r\nThis PR implements a new Virtual Table called `ibridge` which will report on the iBridge controller on new Macs. \r\n\r\nThis Virtual Table was requested in #4967.\r\n\r\nHere is the example output of the table on my local machine, a Macbook Pro\r\n\r\n```\r\n+-----------+---------------+------------------+\r\n| boot_uuid | model_name    | firmware_version |\r\n+-----------+---------------+------------------+\r\n|           | Apple T1 chip | 14Y664           |\r\n+-----------+---------------+------------------+\r\n``` \r\n\r\n### Implementation information\r\nTo create this table, I disassembled the `system_profiler` binary that Issue #4967 references. After analyzing the executable, it appeared that the binary simply included `<SPSupport/SPDocument.h>` (a Private macOS framework) and calls the `reportForDataType` method with `SPiBridgeDataType` as the sole argument.\r\n\r\nIf you follow this deeper, I believe this method actually ends up executing the binary in `/System/Library/SystemProfiler/SPiBridgeReporter.spreporter` which appears to make some low level calls through `NSXPCInterface`. This looked too low-level for us to actually reproduce in Osquery.\r\n\r\nFor my implementation, I simply ape what `system_profiler` does at a high-level.\r\n\r\n### Concerns/Considerations\r\n\r\nI'm not sure if this is the best way to get this data. My implementation requires us to link against a private framework (which I specify the absolute path for in the CMAKE file, not sure if that will fly) and required me to dump the headers using `class-dump` utility that I manually include in the `ibridge.h` file.\r\n\r\nHappy to approach this in a better way if anyone has suggestions.\r\n\r\nAdditionally, I only included three columns in this table despite the fact the `SPiBridgeDataType` actually defines a dozen other properties. In my testing on various newer Macbook Pros (and even an iMac Pro which has a T2 chip) I couldn't find any machines that had any other fields populated than the ones in the table definition. I felt it would be a poor UX if the majority of the columns returned by the table were blank, so I only included the three that were populated in my testing.","created_at":"2018-09-02T03:36:27Z","updated_at":"2018-09-05T09:40:18Z","closed_at":null,"merged_at":null,"merge_commit_sha":"fc1dc9a2ae72f9aa7404d0d73e979d37897d28f1","assignee":{"login":"guliashvili","id":4594711,"node_id":"MDQ6VXNlcjQ1OTQ3MTE=","avatar_url":"https://avatars3.githubusercontent.com/u/4594711?v=4","gravatar_id":"","url":"https://api.github.com/users/guliashvili","html_url":"https://github.com/guliashvili","followers_url":"https://api.github.com/users/guliashvili/followers","following_url":"https://api.github.com/users/guliashvili/following{/other_user}","gists_url":"https://api.github.com/users/guliashvili/gists{/gist_id}","starred_url":"https://api.github.com/users/guliashvili/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guliashvili/subscriptions","organizations_url":"https://api.github.com/users/guliashvili/orgs","repos_url":"https://api.github.com/users/guliashvili/repos","events_url":"https://api.github.com/users/guliashvili/events{/privacy}","received_events_url":"https://api.github.com/users/guliashvili/received_events","type":"User","site_admin":false},"assignees":[{"login":"guliashvili","id":4594711,"node_id":"MDQ6VXNlcjQ1OTQ3MTE=","avatar_url":"https://avatars3.githubusercontent.com/u/4594711?v=4","gravatar_id":"","url":"https://api.github.com/users/guliashvili","html_url":"https://github.com/guliashvili","followers_url":"https://api.github.com/users/guliashvili/followers","following_url":"https://api.github.com/users/guliashvili/following{/other_user}","gists_url":"https://api.github.com/users/guliashvili/gists{/gist_id}","starred_url":"https://api.github.com/users/guliashvili/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guliashvili/subscriptions","organizations_url":"https://api.github.com/users/guliashvili/orgs","repos_url":"https://api.github.com/users/guliashvili/repos","events_url":"https://api.github.com/users/guliashvili/events{/privacy}","received_events_url":"https://api.github.com/users/guliashvili/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":196858822,"node_id":"MDU6TGFiZWwxOTY4NTg4MjI=","url":"https://api.github.com/repos/facebook/osquery/labels/cla%20signed","name":"cla signed","color":"ededed","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/facebook/osquery/pulls/5166/commits","review_comments_url":"https://api.github.com/repos/facebook/osquery/pulls/5166/comments","review_comment_url":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/5166/comments","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/5e93059d2907a45d5585a2a512dce2a094429eb1","head":{"label":"terracatta:jem_add_controller_table","ref":"jem_add_controller_table","sha":"5e93059d2907a45d5585a2a512dce2a094429eb1","user":{"login":"terracatta","id":315873,"node_id":"MDQ6VXNlcjMxNTg3Mw==","avatar_url":"https://avatars0.githubusercontent.com/u/315873?v=4","gravatar_id":"","url":"https://api.github.com/users/terracatta","html_url":"https://github.com/terracatta","followers_url":"https://api.github.com/users/terracatta/followers","following_url":"https://api.github.com/users/terracatta/following{/other_user}","gists_url":"https://api.github.com/users/terracatta/gists{/gist_id}","starred_url":"https://api.github.com/users/terracatta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/terracatta/subscriptions","organizations_url":"https://api.github.com/users/terracatta/orgs","repos_url":"https://api.github.com/users/terracatta/repos","events_url":"https://api.github.com/users/terracatta/events{/privacy}","received_events_url":"https://api.github.com/users/terracatta/received_events","type":"User","site_admin":false},"repo":{"id":96726952,"node_id":"MDEwOlJlcG9zaXRvcnk5NjcyNjk1Mg==","name":"osquery","full_name":"terracatta/osquery","owner":{"login":"terracatta","id":315873,"node_id":"MDQ6VXNlcjMxNTg3Mw==","avatar_url":"https://avatars0.githubusercontent.com/u/315873?v=4","gravatar_id":"","url":"https://api.github.com/users/terracatta","html_url":"https://github.com/terracatta","followers_url":"https://api.github.com/users/terracatta/followers","following_url":"https://api.github.com/users/terracatta/following{/other_user}","gists_url":"https://api.github.com/users/terracatta/gists{/gist_id}","starred_url":"https://api.github.com/users/terracatta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/terracatta/subscriptions","organizations_url":"https://api.github.com/users/terracatta/orgs","repos_url":"https://api.github.com/users/terracatta/repos","events_url":"https://api.github.com/users/terracatta/events{/privacy}","received_events_url":"https://api.github.com/users/terracatta/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/terracatta/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":true,"url":"https://api.github.com/repos/terracatta/osquery","forks_url":"https://api.github.com/repos/terracatta/osquery/forks","keys_url":"https://api.github.com/repos/terracatta/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/terracatta/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/terracatta/osquery/teams","hooks_url":"https://api.github.com/repos/terracatta/osquery/hooks","issue_events_url":"https://api.github.com/repos/terracatta/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/terracatta/osquery/events","assignees_url":"https://api.github.com/repos/terracatta/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/terracatta/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/terracatta/osquery/tags","blobs_url":"https://api.github.com/repos/terracatta/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/terracatta/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/terracatta/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/terracatta/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/terracatta/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/terracatta/osquery/languages","stargazers_url":"https://api.github.com/repos/terracatta/osquery/stargazers","contributors_url":"https://api.github.com/repos/terracatta/osquery/contributors","subscribers_url":"https://api.github.com/repos/terracatta/osquery/subscribers","subscription_url":"https://api.github.com/repos/terracatta/osquery/subscription","commits_url":"https://api.github.com/repos/terracatta/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/terracatta/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/terracatta/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/terracatta/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/terracatta/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/terracatta/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/terracatta/osquery/merges","archive_url":"https://api.github.com/repos/terracatta/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/terracatta/osquery/downloads","issues_url":"https://api.github.com/repos/terracatta/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/terracatta/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/terracatta/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/terracatta/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/terracatta/osquery/labels{/name}","releases_url":"https://api.github.com/repos/terracatta/osquery/releases{/id}","deployments_url":"https://api.github.com/repos/terracatta/osquery/deployments","created_at":"2017-07-10T02:17:26Z","updated_at":"2017-07-10T02:17:30Z","pushed_at":"2018-09-05T02:11:57Z","git_url":"git://github.com/terracatta/osquery.git","ssh_url":"git@github.com:terracatta/osquery.git","clone_url":"https://github.com/terracatta/osquery.git","svn_url":"https://github.com/terracatta/osquery","homepage":"https://osquery.io","size":16228,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"facebook:master","ref":"master","sha":"1a7e241483d026a47b8ab56d83c19366fca4a547","user":{"login":"facebook","id":69631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY5NjMx","avatar_url":"https://avatars3.githubusercontent.com/u/69631?v=4","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"repo":{"id":22394357,"node_id":"MDEwOlJlcG9zaXRvcnkyMjM5NDM1Nw==","name":"osquery","full_name":"facebook/osquery","owner":{"login":"facebook","id":69631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY5NjMx","avatar_url":"https://avatars3.githubusercontent.com/u/69631?v=4","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/facebook/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":false,"url":"https://api.github.com/repos/facebook/osquery","forks_url":"https://api.github.com/repos/facebook/osquery/forks","keys_url":"https://api.github.com/repos/facebook/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/facebook/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/facebook/osquery/teams","hooks_url":"https://api.github.com/repos/facebook/osquery/hooks","issue_events_url":"https://api.github.com/repos/facebook/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/facebook/osquery/events","assignees_url":"https://api.github.com/repos/facebook/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/facebook/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/facebook/osquery/tags","blobs_url":"https://api.github.com/repos/facebook/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/facebook/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/facebook/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/facebook/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/facebook/osquery/languages","stargazers_url":"https://api.github.com/repos/facebook/osquery/stargazers","contributors_url":"https://api.github.com/repos/facebook/osquery/contributors","subscribers_url":"https://api.github.com/repos/facebook/osquery/subscribers","subscription_url":"https://api.github.com/repos/facebook/osquery/subscription","commits_url":"https://api.github.com/repos/facebook/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/facebook/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/facebook/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/facebook/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/facebook/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/facebook/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/facebook/osquery/merges","archive_url":"https://api.github.com/repos/facebook/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/facebook/osquery/downloads","issues_url":"https://api.github.com/repos/facebook/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/facebook/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/facebook/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/facebook/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/facebook/osquery/labels{/name}","releases_url":"https://api.github.com/repos/facebook/osquery/releases{/id}","deployments_url":"https://api.github.com/repos/facebook/osquery/deployments","created_at":"2014-07-29T20:27:33Z","updated_at":"2018-09-05T09:39:41Z","pushed_at":"2018-09-05T02:11:58Z","git_url":"git://github.com/facebook/osquery.git","ssh_url":"git@github.com:facebook/osquery.git","clone_url":"https://github.com/facebook/osquery.git","svn_url":"https://github.com/facebook/osquery","homepage":"https://osquery.io","size":16266,"stargazers_count":13050,"watchers_count":13050,"language":"C++","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":1548,"mirror_url":null,"archived":false,"open_issues_count":448,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":1548,"open_issues":448,"watchers":13050,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/5166"},"html":{"href":"https://github.com/facebook/osquery/pull/5166"},"issue":{"href":"https://api.github.com/repos/facebook/osquery/issues/5166"},"comments":{"href":"https://api.github.com/repos/facebook/osquery/issues/5166/comments"},"review_comments":{"href":"https://api.github.com/repos/facebook/osquery/pulls/5166/comments"},"review_comment":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/facebook/osquery/pulls/5166/commits"},"statuses":{"href":"https://api.github.com/repos/facebook/osquery/statuses/5e93059d2907a45d5585a2a512dce2a094429eb1"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"guliashvili"}}