From 810112cb265f50d278d05b5615972ad128c78687 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Fri, 5 Jan 2024 16:29:38 +0800
Subject: [PATCH] Host (macOS): detect serial number and uuid

---
 src/detection/host/host.h       |  2 ++
 src/detection/host/host_apple.c | 25 ++++++++++++++++++++++---
 src/modules/host/host.c         | 18 ++++++++++++++++--
 3 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/src/detection/host/host.h b/src/detection/host/host.h
index 1957e9c6b..23462f824 100644
--- a/src/detection/host/host.h
+++ b/src/detection/host/host.h
@@ -8,6 +8,8 @@ typedef struct FFHostResult
     FFstrbuf productName;
     FFstrbuf productVersion;
     FFstrbuf productSku;
+    FFstrbuf productSerial;
+    FFstrbuf productUuid;
     FFstrbuf sysVendor;
 } FFHostResult;
 
diff --git a/src/detection/host/host_apple.c b/src/detection/host/host_apple.c
index 07f1cd102..74d4cbe74 100644
--- a/src/detection/host/host_apple.c
+++ b/src/detection/host/host_apple.c
@@ -180,10 +180,29 @@ const char* getProductNameWithIokit(FFstrbuf* result)
     return ffCfStrGetString(productName, result);
 }
 
+const char* getOthersByIokit(FFHostResult* host)
+{
+    FF_IOOBJECT_AUTO_RELEASE io_registry_entry_t registryEntry = IOServiceGetMatchingService(MACH_PORT_NULL, IOServiceMatching("IOPlatformExpertDevice"));
+    if (!registryEntry)
+        return "IOServiceGetMatchingService() failed";
+
+    FF_CFTYPE_AUTO_RELEASE CFStringRef serialNumber = IORegistryEntryCreateCFProperty(registryEntry, CFSTR(kIOPlatformSerialNumberKey), kCFAllocatorDefault, kNilOptions);
+    if (serialNumber)
+        ffCfStrGetString(serialNumber, &host->productSerial);
+
+    FF_CFTYPE_AUTO_RELEASE CFStringRef uuid = IORegistryEntryCreateCFProperty(registryEntry, CFSTR(kIOPlatformUUIDKey), kCFAllocatorDefault, kNilOptions);
+    if (uuid)
+        ffCfStrGetString(uuid, &host->productUuid);
+
+    FF_CFTYPE_AUTO_RELEASE CFStringRef manufacturer = IORegistryEntryCreateCFProperty(registryEntry, CFSTR("manufacturer"), kCFAllocatorDefault, kNilOptions);
+    if (manufacturer)
+        ffCfStrGetString(manufacturer, &host->sysVendor);
+
+    return NULL;
+}
+
 const char* ffDetectHost(FFHostResult* host)
 {
-    ffStrbufSetStatic(&host->sysVendor, "Apple");
-
     const char* error = ffSysctlGetString("hw.model", &host->productFamily);
     if (error) return error;
 
@@ -192,6 +211,6 @@ const char* ffDetectHost(FFHostResult* host)
         getProductNameWithIokit(&host->productName);
     if (host->productName.length == 0)
         ffStrbufSet(&host->productName, &host->productFamily);
-
+    getOthersByIokit(host);
     return NULL;
 }
diff --git a/src/modules/host/host.c b/src/modules/host/host.c
index aeafd7118..b6e5151ad 100644
--- a/src/modules/host/host.c
+++ b/src/modules/host/host.c
@@ -4,7 +4,7 @@
 #include "modules/host/host.h"
 #include "util/stringUtils.h"
 
-#define FF_HOST_NUM_FORMAT_ARGS 5
+#define FF_HOST_NUM_FORMAT_ARGS 7
 
 void ffPrintHost(FFHostOptions* options)
 {
@@ -13,6 +13,8 @@ void ffPrintHost(FFHostOptions* options)
     ffStrbufInit(&host.productName);
     ffStrbufInit(&host.productVersion);
     ffStrbufInit(&host.productSku);
+    ffStrbufInit(&host.productSerial);
+    ffStrbufInit(&host.productUuid);
     ffStrbufInit(&host.sysVendor);
     const char* error = ffDetectHost(&host);
 
@@ -51,7 +53,9 @@ void ffPrintHost(FFHostOptions* options)
             {FF_FORMAT_ARG_TYPE_STRBUF, &host.productName},
             {FF_FORMAT_ARG_TYPE_STRBUF, &host.productVersion},
             {FF_FORMAT_ARG_TYPE_STRBUF, &host.productSku},
-            {FF_FORMAT_ARG_TYPE_STRBUF, &host.sysVendor}
+            {FF_FORMAT_ARG_TYPE_STRBUF, &host.sysVendor},
+            {FF_FORMAT_ARG_TYPE_STRBUF, &host.productSerial},
+            {FF_FORMAT_ARG_TYPE_STRBUF, &host.productUuid},
         });
     }
 
@@ -60,6 +64,8 @@ exit:
     ffStrbufDestroy(&host.productName);
     ffStrbufDestroy(&host.productVersion);
     ffStrbufDestroy(&host.productSku);
+    ffStrbufDestroy(&host.productSerial);
+    ffStrbufDestroy(&host.productUuid);
     ffStrbufDestroy(&host.sysVendor);
 }
 
@@ -105,6 +111,8 @@ void ffGenerateHostJsonResult(FF_MAYBE_UNUSED FFHostOptions* options, yyjson_mut
     ffStrbufInit(&host.productName);
     ffStrbufInit(&host.productVersion);
     ffStrbufInit(&host.productSku);
+    ffStrbufInit(&host.productSerial);
+    ffStrbufInit(&host.productUuid);
     ffStrbufInit(&host.sysVendor);
     const char* error = ffDetectHost(&host);
 
@@ -125,6 +133,8 @@ void ffGenerateHostJsonResult(FF_MAYBE_UNUSED FFHostOptions* options, yyjson_mut
     yyjson_mut_obj_add_strbuf(doc, obj, "name", &host.productName);
     yyjson_mut_obj_add_strbuf(doc, obj, "version", &host.productVersion);
     yyjson_mut_obj_add_strbuf(doc, obj, "sku", &host.productSku);
+    yyjson_mut_obj_add_strbuf(doc, obj, "serial", &host.productSerial);
+    yyjson_mut_obj_add_strbuf(doc, obj, "uuid", &host.productUuid);
     yyjson_mut_obj_add_strbuf(doc, obj, "sysVender", &host.sysVendor);
 
 exit:
@@ -132,6 +142,8 @@ exit:
     ffStrbufDestroy(&host.productName);
     ffStrbufDestroy(&host.productVersion);
     ffStrbufDestroy(&host.productSku);
+    ffStrbufDestroy(&host.productSerial);
+    ffStrbufDestroy(&host.productUuid);
     ffStrbufDestroy(&host.sysVendor);
 }
 
@@ -142,6 +154,8 @@ void ffPrintHostHelpFormat(void)
         "product name",
         "product version",
         "product sku",
+        "product serial number",
+        "product uuid",
         "sys vendor"
     });
 }