Does anyone here have links from where I can download bare p

Question

Does anyone here have links from where I can download bare package of osqueryd for versions 4 8 0 4 7 0

alessandrogario · Answer

<https osquery io downloads official 4 7 0|https osquery io downloads official 4 7 0> then extract the binary from the package you can use 7z for MSI

alessandrogario · Answer

That said use a newer one if possible there are many important fixes inside the latest version

Madhur Jodhwani · Answer

I need the older versions just for testing the fleet update server so i am asking directly for osqueryd exe files

sharvil · Answer

Bare binaries are not an official distribution only packages are You will either have to extract them from packages as Alessandro said above or compile them yourselves

alessandrogario · Answer

< Madhur Jodhwani> here are the binaries for 4 7 0 I ve included a small readme that explains how to extract them

Madhur Jodhwani · Answer

Can you please explain the Payload~ part for macos

Madhur Jodhwani · Answer

like I extracted the folder but couldn t understrand after that

alessandrogario · Answer

1 Extract the pkg file `7z x osquery xxx pkg` This will create a possibly hidden file named `Payload~` 2 Extract the `Payload~` file `7z x Payload~` This will create the standard deployment folders such as `usr` 3 Locate the osqueryd binary under ` usr`

Madhur Jodhwani · Answer

For this I neeed to go into the folder after extracting it right

alessandrogario · Answer

Yes

Madhur Jodhwani · Answer

7 Zip 64 17 04 Copyright c 1999 2021 Igor Pavlov 2017 08 28 p7zip Version 17 04 locale=utf8 Utf16=on HugeFiles=on 64 bits 8 CPUs x64 Scanning the drive for archives ERROR No such file or directory Payload~ System ERROR Unknown error 2147024894

Madhur Jodhwani · Answer

this is the error I got

alessandrogario · Answer

When you extract the ` pkg` archive what new files do you get

alessandrogario · Answer

The command on the ` pkg` file should look like this ```7z x osquery 4 9 0 pkg 7 Zip 64 17 04 Copyright c 1999 2021 Igor Pavlov 2017 08 28 p7zip Version 17 04 locale=en US utf8 Utf16=on HugeFiles=on 64 bits 16 CPUs x64 Scanning the drive for archives 1 file 10864742 bytes 11 MiB Extracting archive osquery 4 9 0 pkg Path = osquery 4 9 0 pkg Type = Xar Physical Size = 10864742 SubType = pkg Headers Size = 4328 Path = Payload Size = 10842254 Packed Size = 10842254 Modified = 2021 06 22 21 04 41 Created = 2021 06 22 21 04 41 Accessed = 2021 06 22 21 04 40 Mode = rw r r User = reed Group = staff Method = octet stream Path = Payload Type = gzip Headers Size = 10 Everything is Ok Size 41235968 Compressed 10864742```

alessandrogario · Answer

It s possible that maybe the file has a different name you can check the `Path` messages in the `7z` output to determine what files have been created

sharvil · Answer

If you have access to a Mac you can also use `pkgutil expand full osquery 4 9 0 pkg temp dir`

Madhur Jodhwani · Answer

Thanks relaxed blush