• b

    Brandon Mesa

    1 month ago
    Hello all, does anyone know what table I can use to get more information on Apple Silicon boot process? for intel I'm using the platform_info table however it appears the booting process for silicon chips is independent of EFI/BIOS/etc. when i run
    SELECT * FROM platform_info;
    on M1 host, i get no results
  • a

    alessandrogario

    1 month ago
    hey Brandon! We have a PR here: https://github.com/osquery/osquery/pull/7660 from @Joe Sweeney
  • b

    Brandon Mesa

    1 month ago
    Ah, thanks @alessandrogario. Should have double checked outstanding PRs!
  • a

    alessandrogario

    1 month ago
    Could you give us some feedback on it if you get a chance to try it out? 😄
  • b

    Brandon Mesa

    1 month ago
    Sure thing! Thanks much @alessandrogario
  • Tried it out, observing the same behavior, no results returned from platform_info
  • a

    alessandrogario

    1 month ago
    We'll take a second look at the PR, thanks so much for the help!
  • Can you share the macbook model this was tested on?
  • b

    Brandon Mesa

    1 month ago
    let me know if you need additional info
    % system_profiler SPHardwareDataType
    Hardware:
    
        Hardware Overview:
    
          Model Name: MacBook Pro
          Model Identifier: MacBookPro17,1
          Chip: Apple M1
          Total Number of Cores: 8 (4 performance and 4 efficiency)
          Memory: 16 GB
          System Firmware Version: 7459.101.3
          OS Loader Version: 7459.101.3
  • % system_profiler SPSoftwareDataType
    Software:
    
        System Software Overview:
    
          System Version: macOS 12.3.1 (21E258)
          Kernel Version: Darwin 21.4.0
          Boot Volume: Macintosh HD
          Boot Mode: Normal
          Secure Virtual Memory: Enabled
          System Integrity Protection: Enabled
          Time since boot: 15 days 16:26
  • j

    Joe Sweeney

    1 month ago
    @Brandon Mesa Hello, I’m trying to reproduce the problem you are having, and I was wondering if IOKit puts the information on your M1 mac in a different place. Would you be able to share the output of
    ioreg -p IODeviceTree -l -t
    with me? Thanks!
  • b

    Brandon Mesa

    1 month ago
    Sure thing, I'll dm you @Joe Sweeney