How to check the Carbon Black version installed

Update

Thanks to Clay Haynes for pointing out you can get the version more easily by running /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

Back story

In Carbon Black 6.3.0 and 7.0.1, it isn’t super obvious how to check for the version installed.

For example, if you run defaults read /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Info.plist, you’ll see CFBundleInfoDictionaryVersion = "6.0"; (yes, even if you have version 7 installed), and you’ll also see CFBundleShortVersionString = "1.0"; and CFBundleVersion = 1;. Not terribly helpful.

Apparently, though, there is a hidden plist inside of the binary file, so if you run plutil -p /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService | grep "CFBundleShortVersionString", you’ll then see for 7.0.1, for example, "CFBundleShortVersionString" => "7.0.1.16317"

FYI: It doesn’t seem you can get that same info using the plistlib Python library, because the binary isn’t a binary plist, it’s a giant binary file that happens to have plist info inside of it.

Posted

November 25, 2020

Mac admin’ing

alanysiu

Tags:

carbon black, macos, plist, plutil, python

Comments

5 responses to “How to check the Carbon Black version installed”

Jerold Malone

November 30, 2020

GREAT WORK!

Wish I had this a year ago. Older versions of CB was crashing our Catalina upgrade pushes and delayed us for 2 months.

Reply
1. alanysiu
  
  January 15, 2021
  
  Yikes! I hope you got that sorted.
  
  Reply
Clay Haynes

December 22, 2020

If you can execute a command, try:

/Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

It’ll output the correct version each time.

Reply
1. alanysiu
  
  January 15, 2021
  
  Thanks! Don’t know why the Info.plist can’t just have it in there, but that’s certainly easier than using plutil.
  
  Reply
Joel Bruner

January 27, 2021

Since I don’t have Carbon Black to test with, I’d also be curious if the binary has an embedded plist? If so, “launchctl plist” is the very odd mode/verb where it can examine embedded plist in Mach-O binaries (I can’t remember when I used this, but I feel like it was a Xerox print driver)… anyway FYI. Thanks for your random notes! :]

Reply