How to check the Carbon Black version installed

Update

Thanks to Clay Haynes for pointing out you can get the version more easily by running /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

Back story

In Carbon Black 6.3.0 and 7.0.1, it isn’t super obvious how to check for the version installed.

For example, if you run defaults read /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Info.plist, you’ll see CFBundleInfoDictionaryVersion = "6.0"; (yes, even if you have version 7 installed), and you’ll also see CFBundleShortVersionString = "1.0"; and CFBundleVersion = 1;. Not terribly helpful.

Apparently, though, there is a hidden plist inside of the binary file, so if you run plutil -p /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService | grep "CFBundleShortVersionString", you’ll then see for 7.0.1, for example, "CFBundleShortVersionString" => "7.0.1.16317"

FYI: It doesn’t seem you can get that same info using the plistlib Python library, because the binary isn’t a binary plist, it’s a giant binary file that happens to have plist info inside of it.

5 thoughts on “How to check the Carbon Black version installed”

November 30, 2020 at 09:08:56 PM by Jerold Malone

GREAT WORK!

Wish I had this a year ago. Older versions of CB was crashing our Catalina upgrade pushes and delayed us for 2 months.

January 15, 2021 at 06:51:18 PM by alanysiu

Yikes! I hope you got that sorted.
Reply

December 22, 2020 at 05:37:18 PM by Clay Haynes

If you can execute a command, try:

/Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

It’ll output the correct version each time.

January 15, 2021 at 06:49:13 PM by alanysiu

Thanks! Don’t know why the Info.plist can’t just have it in there, but that’s certainly easier than using plutil.
Reply

January 27, 2021 at 07:20:54 AM by Joel Bruner

Since I don’t have Carbon Black to test with, I’d also be curious if the binary has an embedded plist? If so, “launchctl plist” is the very odd mode/verb where it can examine embedded plist in Mach-O binaries (I can’t remember when I used this, but I feel like it was a Xerox print driver)… anyway FYI. Thanks for your random notes! :]