From 664017ba8111725dd84c75ab2d2fda437f040ad8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Wed, 21 Sep 2022 14:52:07 +0800
Subject: [PATCH] OS: print codename ( macOS )

---
 src/detection/os/os_apple.c | 38 ++++++++++++++++++++++++++++++++++---
 src/modules/os.c            |  8 ++++++++
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/src/detection/os/os_apple.c b/src/detection/os/os_apple.c
index acf7cdd6c..a18870c81 100644
--- a/src/detection/os/os_apple.c
+++ b/src/detection/os/os_apple.c
@@ -3,6 +3,7 @@
 #include "common/sysctl.h"
 
 #include <stdlib.h>
+#include <string.h>
 
 typedef enum PListKey
 {
@@ -12,7 +13,7 @@ typedef enum PListKey
     PLIST_KEY_OTHER
 } PListKey;
 
-static void parseFile(FFOSResult* os)
+static void parseSystemVersion(FFOSResult* os)
 {
     FILE* plist = fopen("/System/Library/CoreServices/SystemVersion.plist", "r");
     if(plist == NULL)
@@ -58,6 +59,33 @@ static void parseFile(FFOSResult* os)
     fclose(plist);
 }
 
+void parseOSXSoftwareLicense(FFOSResult* os)
+{
+    FILE* rtf = fopen("/System/Library/CoreServices/Setup Assistant.app/Contents/Resources/en.lproj/OSXSoftwareLicense.rtf", "r");
+    if(rtf == NULL)
+        return;
+
+    char* line = NULL;
+    size_t len = 0;
+    const char* searchStr = "\\f0\\b SOFTWARE LICENSE AGREEMENT FOR macOS ";
+    const size_t searchLen = strlen(searchStr);
+    while(getline(&line, &len, rtf) != EOF)
+    {
+        if (strncmp(line, searchStr, searchLen) == 0)
+        {
+            ffStrbufAppendS(&os->codename, line + searchLen);
+            ffStrbufTrimRight(&os->codename, '\n');
+            ffStrbufTrimRight(&os->codename, '\\');
+            break;
+        }
+    }
+
+    if(line != NULL)
+        free(line);
+
+    fclose(rtf);
+}
+
 void ffDetectOSImpl(FFOSResult* os, const FFinstance* instance)
 {
     FF_UNUSED(instance);
@@ -76,7 +104,7 @@ void ffDetectOSImpl(FFOSResult* os, const FFinstance* instance)
     ffStrbufInitA(&os->variant, 0);
     ffStrbufInitA(&os->variantID, 0);
 
-    parseFile(os);
+    parseSystemVersion(os);
 
     if(ffStrbufStartsWithIgnCaseS(&os->name, "MacOS"))
         ffStrbufAppendS(&os->id, "macos");
@@ -84,9 +112,13 @@ void ffDetectOSImpl(FFOSResult* os, const FFinstance* instance)
     if(os->version.length == 0)
         ffSysctlGetString("kern.osproductversion", &os->version);
 
-    //TODO map version to pretty name
+    if(os->buildID.length == 0)
+        ffSysctlGetString("kern.osversion", &os->buildID);
+
     ffStrbufAppend(&os->prettyName, &os->name);
     ffStrbufAppend(&os->versionID, &os->version);
     ffSysctlGetString("kern.ostype", &os->systemName);
     ffSysctlGetString("hw.machine", &os->architecture);
+
+    parseOSXSoftwareLicense(os);
 }
diff --git a/src/modules/os.c b/src/modules/os.c
index 39132c3a1..3d110f3a4 100644
--- a/src/modules/os.c
+++ b/src/modules/os.c
@@ -19,6 +19,14 @@ static void buildOutputDefault(const FFOSResult* os, FFstrbuf* result)
     else
         ffStrbufAppend(result, &os->systemName);
 
+    #ifdef __APPLE__
+    if(os->codename.length > 0)
+    {
+        ffStrbufAppendC(result, ' ');
+        ffStrbufAppend(result, &os->codename);
+    }
+    #endif
+
     //Append version if it is missing
     if(os->versionID.length > 0 && ffStrbufFirstIndex(result, &os->versionID) == result->length)
     {