Identifying 32-bit apps on macOS

Content Authoring
1

Given the impending deprecation of 32-bit Applications on macOS, I became curious if it was possible to identify and report on such apps via BigFix.

This StackExchange post notes multiple ways to figure out the information in the GUI and one from Terminal: https://apple.stackexchange.com/questions/289195/how-can-i-find-out-which-mac-apps-are-32-bit. Of course it would be possible to make that Terminal command output to a file, but it’d sure be nicer to somehow figure this out via relevance.

I’m not able to find this information in any of the .plist files contained within the app bundle, and I’m not sure if there’s a way to query some sort of application registry the way you can query ioreg to get at the information reported by System Report.

Any ideas?

1 Like
2

I’ve been looking into the best way to go about this as well.

The StackExchange Link mentions using this command:

mdfind "(kMDItemExecutableArchitectures == 'i386') && (kMDItemExecutableArchitectures != 'x86_64')"

This seems to be examining metadata of the binaries somehow, which might not be easy without running an actual command like this unless there is an existing inspector for this, or there is an easy way to read it in the binary.

If the info is in IOReg, that would work. It seems like System Report is getting this info stored somewhere specifically. If we knew how to read that location directly, then that would be an option as well.

From here: https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/mdfind.1.html

The mdfind command consults the central metadata store and returns a list of files that match the given metadata query.

What is this “central metadata store”? Does it have something to do with spotlight?

It does seem that mdfind is the command line interface to spotlight: Digging Deeper: Mastering Spotlight in OS X « Super User Blog

Spotlight saves it’s info: macos - Where does Spotlight store its metadata index? - Super User

The location of the newest spotlight index is given in this plist: /.Spotlight-V100/VolumeConfiguration.plist

Which ends up being: /.Spotlight-V100/Store-V2/_SOME_GUID_

I was hopeful that Spotlight saves it’s indexes in SQLite, but that doesn’t seem to be the case: macos - Is it possible for a native OS X app to read and copy the Spotlight search index? - Stack Overflow

3

Seems like this actionscript will work to get the results from the command:

wait bash -c "mdfind \"kMDItemExecutableArchitectures == 'i386' && kMDItemExecutableArchitectures != 'x86_64'\" > /tmp/results_mdfind_i386.log"
1 Like
4

Might work on this more later to have it spit out versions of the apps too, but for now this is a quick and easy way to parse that file into an analysis property (assuming you only care about .apps)

unique values of following texts of lasts "/" of lines containing ".app" of files "/tmp/results_mdfind_i386.log"

Or maybe this is a little better?

unique values of following texts of lasts "/Applications/" of lines containing ".app" of files "/tmp/results_mdfind_i386.log"

TriggerClientUI.app is on the list :eyes:

1 Like
5

It is correct that mdfind and mdls are interfaces to Spotlight. mdls can be particularly instructive for just what is known about a file/bundle/app.

1 Like
6

I don’t think that is the case on the just released version of BigFix, but I haven’t verified that myself. (we are definitely on this)

1 Like