How to check the Carbon Black version installed

Update

Thanks to Clay Haynes for pointing out you can get the version more easily by running /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

Back story

In Carbon Black 6.3.0 and 7.0.1, it isn’t super obvious how to check for the version installed.

For example, if you run defaults read /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Info.plist, you’ll see CFBundleInfoDictionaryVersion = "6.0"; (yes, even if you have version 7 installed), and you’ll also see CFBundleShortVersionString = "1.0"; and CFBundleVersion = 1;. Not terribly helpful.

Apparently, though, there is a hidden plist inside of the binary file, so if you run plutil -p /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService | grep "CFBundleShortVersionString", you’ll then see for 7.0.1, for example, "CFBundleShortVersionString" => "7.0.1.16317"

FYI: It doesn’t seem you can get that same info using the plistlib Python library, because the binary isn’t a binary plist, it’s a giant binary file that happens to have plist info inside of it.


Posted

in

by

Comments

5 responses to “How to check the Carbon Black version installed”

  1. Jerold Malone Avatar
    Jerold Malone

    GREAT WORK!

    Wish I had this a year ago. Older versions of CB was crashing our Catalina upgrade pushes and delayed us for 2 months.

    1. alanysiu Avatar
      alanysiu

      Yikes! I hope you got that sorted.

  2. Clay Haynes Avatar

    If you can execute a command, try:

    /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

    It’ll output the correct version each time.

    1. alanysiu Avatar
      alanysiu

      Thanks! Don’t know why the Info.plist can’t just have it in there, but that’s certainly easier than using plutil.

  3. Joel Bruner Avatar

    Since I don’t have Carbon Black to test with, I’d also be curious if the binary has an embedded plist? If so, “launchctl plist” is the very odd mode/verb where it can examine embedded plist in Mach-O binaries (I can’t remember when I used this, but I feel like it was a Xerox print driver)… anyway FYI. Thanks for your random notes! :]

Leave a Reply to alanysiu Cancel reply

Your email address will not be published. Required fields are marked *