Fetching information using osquery from C++

258 Views Asked by At

I want to retrieve some OS information using osquery through a C++ client. i have seen python binding for the same but doesnt see any sample in c++ to use osquery. any idea how this can be done?

i don't want to extend the osquery functionality hence extension will not help. want to just fetch some information.

1

There are 1 best solutions below

0
On

osquery has a couple of ways to talk to other things.

The common way, is through the TLS api. This is commonly used to talk to remote servers, but could just as well be a local process over tcp.

But, it sounds like you're asking about the local socket.

osquery's opens a socket, and uses the thrift protocol on it. On posix systems, this is a named pipe, on windows it's over in the pipe system. While this is most commonly used for extensions expanding osquery's functionality, it can also be used for distributed read/write. (eg: you can talk thrift and issue queries and get their responses)

The go and python SDKs are language specific, opinionated, SDKs built on top of the simple thrift API. I don't remember what we distribute for c++, that's normally very tangled in the rest of osquery.

If you want to talk to an osquery process over the socket, I would recommend you use the thrift definition https://github.com/osquery/osquery/blob/master/osquery/extensions/thrift/osquery.thrift to generate classes to talk to it.