How to check the Carbon Black version installed


Posted on November 25, 2020 by alanysiu

Update

Thanks to Clay Haynes for pointing out you can get the version more easily by running /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

Back story

In Carbon Black 6.3.0 and 7.0.1, it isn’t super obvious how to check for the version installed.

For example, if you run defaults read /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Info.plist, you’ll see CFBundleInfoDictionaryVersion = "6.0"; (yes, even if you have version 7 installed), and you’ll also see CFBundleShortVersionString = "1.0"; and CFBundleVersion = 1;. Not terribly helpful.

Apparently, though, there is a hidden plist inside of the binary file, so if you run plutil -p /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService | grep "CFBundleShortVersionString", you’ll then see for 7.0.1, for example, "CFBundleShortVersionString" => "7.0.1.16317"

FYI: It doesn’t seem you can get that same info using the plistlib Python library, because the binary isn’t a binary plist, it’s a giant binary file that happens to have plist info inside of it.


carbon black macos plist plutil python

Mac admin'ing

5

5 thoughts on “How to check the Carbon Black version installed

  1. November 30, 2020 at 09:08:56 PM by Jerold Malone

    GREAT WORK!

    Wish I had this a year ago. Older versions of CB was crashing our Catalina upgrade pushes and delayed us for 2 months.

    Reply

  2. December 22, 2020 at 05:37:18 PM by Clay Haynes

    If you can execute a command, try:

    /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

    It’ll output the correct version each time.

    Reply

    • January 15, 2021 at 06:49:13 PM by alanysiu

      Thanks! Don’t know why the Info.plist can’t just have it in there, but that’s certainly easier than using plutil.

      Reply

  3. January 27, 2021 at 07:20:54 AM by Joel Bruner

    Since I don’t have Carbon Black to test with, I’d also be curious if the binary has an embedded plist? If so, “launchctl plist” is the very odd mode/verb where it can examine embedded plist in Mach-O binaries (I can’t remember when I used this, but I feel like it was a Xerox print driver)… anyway FYI. Thanks for your random notes! :]

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Alan Siu's Blog