How to check the Carbon Black version installed


Update

Thanks to Clay Haynes for pointing out you can get the version more easily by running /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

Back story

In Carbon Black 6.3.0 and 7.0.1, it isn’t super obvious how to check for the version installed.

For example, if you run defaults read /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Info.plist, you’ll see CFBundleInfoDictionaryVersion = "6.0"; (yes, even if you have version 7 installed), and you’ll also see CFBundleShortVersionString = "1.0"; and CFBundleVersion = 1;. Not terribly helpful.

Apparently, though, there is a hidden plist inside of the binary file, so if you run plutil -p /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService | grep "CFBundleShortVersionString", you’ll then see for 7.0.1, for example, "CFBundleShortVersionString" => "7.0.1.16317"

FYI: It doesn’t seem you can get that same info using the plistlib Python library, because the binary isn’t a binary plist, it’s a giant binary file that happens to have plist info inside of it.


5 responses to “How to check the Carbon Black version installed”

  1. GREAT WORK!

    Wish I had this a year ago. Older versions of CB was crashing our Catalina upgrade pushes and delayed us for 2 months.

    • Thanks! Don’t know why the Info.plist can’t just have it in there, but that’s certainly easier than using plutil.

  2. Since I don’t have Carbon Black to test with, I’d also be curious if the binary has an embedded plist? If so, “launchctl plist” is the very odd mode/verb where it can examine embedded plist in Mach-O binaries (I can’t remember when I used this, but I feel like it was a Xerox print driver)… anyway FYI. Thanks for your random notes! :]

Leave a Reply

Your email address will not be published. Required fields are marked *