Use of usb plane of iokit registry for Mac OS X

Content Authoring
1

Listing the USB devices attached to a Mac is possible with this relevance… https://bigfix.me/relevance/details/2997178

But I am wondering why the usb plane of iokit registry can’t be used instead of calling out the entire node/node/node of using the service plane? Seems like it would be more efficient to access the data directly with the usb plane, but I can’t for the life of me look into any of the nodes inside of the usb plane. Here’s what I tried (and does not work)

This gets the list of items in the root of iousb:

keys of dictionaries of usb plane of iokit registry

This gets nothing… but should in theory (at least in my mind)…

keys of dictionaries of nodes of usb plane of iokit registry

Thoughts? Has anybody been able to use the usb plane to get info on USB devices?

1 Like
2

Try:

names of nodes of usb plane of iokit registry

iokit and plist relevance is odd. If it gives an error stating The operator "string" is not defined, then it is not returning nothing, it is in fact returning something, it just doesn’t know how to display a string representation of it.

It took me a while to figure out where QnA is located in OS X. I was on a new machine that didn’t have the old app version of QnA installed, so I created this relevance to help:

https://bigfix.me/relevance/details/3006012

pathnames of (files "/Library/BESAgent/BESAgent.app/Contents/MacOS/QnA"; files "/usr/local/bin/QnA"; files "/opt/BESClient/bin/qna")

Related:

3

Right, but this returns no answer.

4

Not for me, it returns HubDevice

Q: names of nodes of usb plane of iokit registry
A: HubDevice
T: 1290

This is the good kind of error:

Q: nodes of nodes of usb plane of iokit registry
E: The operator "string" is not defined.

The names of them:

Q: names of nodes of nodes of usb plane of iokit registry
A: FaceTime HD Camera (Display)
A: Apple Thunderbolt Display
A: Display Audio
T: 152

Q: unique values of keys of dictionaries of nodes of nodes of usb plane of iokit registry
A: Bus Power Available
A: Device Speed
A: DisplayRouting
A: ExtendedData
A: IOAudioDeviceLocalizedBundle
A: IOCFPlugInTypes
A: IOGeneralInterest
A: IOUserClientClass
A: Low Power Displayed
A: PortNum
A: Requested Power
A: USB Address
A: USB Product Name
A: USB Serial Number
A: USB Vendor Name
A: bDeviceClass
A: bDeviceProtocol
A: bDeviceSubClass
A: bMaxPacketSize0
A: bNumConfigurations
A: bcdDevice
A: bcdUSB
A: iManufacturer
A: iProduct
A: iSerialNumber
A: idProduct
A: idVendor
A: kSuspendPort
A: locationID
A: non-removable
A: sessionID
T: 573

FYI: @hansen_m @rustymyers @alexk

1 Like
5

When I run these commands nothing comes up…

Q: names of nodes of usb plane of iokit registry
T: 74

Q: names of nodes of nodes of usb plane of iokit registry
T: 119

Q: unique values of keys of dictionaries of nodes of nodes of usb plane of iokit registry
T: 86
6
  • What version of QnA are you running?
  • What version of OS X are you on?
  • What version of the client do you have installed?

I’m doing this on 10.10.5

7

Here is a big dump of info:

Q: (names of it, (key of it & "=" & (unique value of (strings of it; booleans of it as string; integers of it as string; datas of it as string; dates of it as string) of values of it | "<unknown_type>") ) of entries of dictionaries of it ) of nodes of nodes of usb plane of iokit registry
A: FaceTime HD Camera (Display), USB Address=3
A: FaceTime HD Camera (Display), PortNum=5
A: FaceTime HD Camera (Display), Device Speed=2
A: FaceTime HD Camera (Display), iSerialNumber=3
A: FaceTime HD Camera (Display), Requested Power=250
A: FaceTime HD Camera (Display), Bus Power Available=250
A: FaceTime HD Camera (Display), non-removable=yes
A: FaceTime HD Camera (Display), IOGeneralInterest=IOCommand is not serializable
A: FaceTime HD Camera (Display), bDeviceClass=239
A: FaceTime HD Camera (Display), USB Product Name=FaceTime HD Camera (Display)
A: FaceTime HD Camera (Display), bNumConfigurations=1
A: FaceTime HD Camera (Display), USB Serial Number=<redacted>
A: FaceTime HD Camera (Display), bcdUSB=512
A: FaceTime HD Camera (Display), iManufacturer=1
A: FaceTime HD Camera (Display), USB Vendor Name=Apple Inc.
A: FaceTime HD Camera (Display), bDeviceSubClass=2
A: FaceTime HD Camera (Display), IOCFPlugInTypes=<unknown_type>
A: FaceTime HD Camera (Display), iProduct=2
A: FaceTime HD Camera (Display), bcdDevice=29024
A: FaceTime HD Camera (Display), bMaxPacketSize0=64
A: FaceTime HD Camera (Display), sessionID=<redacted>
A: FaceTime HD Camera (Display), locationID=<redacted>
A: FaceTime HD Camera (Display), kSuspendPort=True
A: FaceTime HD Camera (Display), Low Power Displayed=False
A: FaceTime HD Camera (Display), idProduct=4370
A: FaceTime HD Camera (Display), IOUserClientClass=IOUSBDeviceUserClientV2
A: FaceTime HD Camera (Display), bDeviceProtocol=1
A: FaceTime HD Camera (Display), idVendor=1452
A: Apple Thunderbolt Display, USB Address=4
A: Apple Thunderbolt Display, PortNum=7
A: Apple Thunderbolt Display, ExtendedData=<unknown_type>
A: Apple Thunderbolt Display, Device Speed=1
A: Apple Thunderbolt Display, iSerialNumber=3
A: Apple Thunderbolt Display, Requested Power=1
A: Apple Thunderbolt Display, Bus Power Available=250
A: Apple Thunderbolt Display, non-removable=yes
A: Apple Thunderbolt Display, IOGeneralInterest=IOCommand is not serializable
A: Apple Thunderbolt Display, bDeviceClass=0
A: Apple Thunderbolt Display, USB Product Name=Apple Thunderbolt Display
A: Apple Thunderbolt Display, bNumConfigurations=1
A: Apple Thunderbolt Display, USB Serial Number=<redacted>
A: Apple Thunderbolt Display, bcdUSB=272
A: Apple Thunderbolt Display, iManufacturer=1
A: Apple Thunderbolt Display, USB Vendor Name=Apple Inc.
A: Apple Thunderbolt Display, bDeviceSubClass=0
A: Apple Thunderbolt Display, IOCFPlugInTypes=<unknown_type>
A: Apple Thunderbolt Display, iProduct=2
A: Apple Thunderbolt Display, bcdDevice=312
A: Apple Thunderbolt Display, bMaxPacketSize0=64
A: Apple Thunderbolt Display, sessionID=<unknown_type>
A: Apple Thunderbolt Display, locationID=<redacted>
A: Apple Thunderbolt Display, Low Power Displayed=False
A: Apple Thunderbolt Display, idProduct=<redacted>
A: Apple Thunderbolt Display, IOUserClientClass=IOUSBDeviceUserClientV2
A: Apple Thunderbolt Display, bDeviceProtocol=0
A: Apple Thunderbolt Display, idVendor=1452
A: Display Audio, USB Address=5
A: Display Audio, PortNum=4
A: Display Audio, IOAudioDeviceLocalizedBundle=IOUSBFamily.kext/Contents/PlugIns/AppleUSBMergeNub.kext
A: Display Audio, Device Speed=1
A: Display Audio, iSerialNumber=3
A: Display Audio, Requested Power=1
A: Display Audio, Bus Power Available=250
A: Display Audio, non-removable=yes
A: Display Audio, IOGeneralInterest=IOCommand is not serializable
A: Display Audio, DisplayRouting=0
A: Display Audio, bDeviceClass=0
A: Display Audio, USB Product Name=Display Audio
A: Display Audio, bNumConfigurations=1
A: Display Audio, USB Serial Number=<redacted>
A: Display Audio, bcdUSB=512
A: Display Audio, iManufacturer=1
A: Display Audio, USB Vendor Name=Apple Inc.
A: Display Audio, bDeviceSubClass=0
A: Display Audio, IOCFPlugInTypes=<unknown_type>
A: Display Audio, iProduct=2
A: Display Audio, bcdDevice=521
A: Display Audio, bMaxPacketSize0=8
A: Display Audio, sessionID=<unknown_type>
A: Display Audio, locationID=<redacted>
A: Display Audio, Low Power Displayed=False
A: Display Audio, idProduct=4359
A: Display Audio, IOUserClientClass=IOUSBDeviceUserClientV2
A: Display Audio, bDeviceProtocol=0
A: Display Audio, idVendor=1452
T: 4641

This doesn’t seem to contain all of my devices, because I am definitely using a USB keyboard and mouse. Not sure why this is just a limited set of results.

1 Like
8

So here is an odd thing. I’ve got two Mac OS 10.10.5 Machines, both running 9.2.6 client (and running qna through /Library/BESAgent/BESAgent.app/Contents/MacOS/qna as root).

One of them shows no results (as previously shown), but the other one shows

A: Card Reader

But when I plugged in a USB mouse, nothing changes. The mouse never shows up.

Well, I guess we see why we should be using the service plane of iokit registry… inconsistent results otherwise.

1 Like
9

It seems like only certain devices show up under the usb plane of iokit registry … perhaps it is only external devices other than standard keyboards and mice?

Not sure why only certain devices show up. If I didn’t have a thunderbolt display connected to the Mac Mini I ran this on, then I wouldn’t have any results either.

This may still be useful in an analysis property:

names of nodes of nodes of usb plane of iokit registry

Even if it doesn’t include everything, it might be useful to have the limited list.

10

This is interesting:

Q: keys of dictionaries of iokit registry
A: OSPrelinkKextCount
A: IOConsoleLocked
A: IOKitBuildVersion
A: OSKernelCPUSubtype
A: OS Build Version
A: IOConsoleUsers
A: OSKernelCPUType
A: IORegistryPlanes
A: IOKitDiagnostics
T: 5238

Q: keys of dictionaries of firewire plane of iokit registry
A: FireWire Speed
A: IOCFPlugInTypes
A: GUID
A: FireWire Device ROM
A: FireWire Self IDs
A: IOUserClientClass
A: FireWire Node ID
T: 283

Q: keys of dictionaries of power plane of iokit registry
A: IOPowerManagement
T: 189

Q: names of nodes of power plane of iokit registry
A: IOPowerConnection
T: 109

Q: names of nodes of devicetree plane of iokit registry
A: chosen
A: efi
A: cpus
A: memory
A: rom
A: PCI0
A: MEM2
A: LNKA
A: LNKB
A: LNKC
A: LNKD
A: LNKE
A: LNKF
A: LNKG
A: LNKH
A: PWRB
A: SLPB
A: options
T: 306

Q: keys of dictionaries of devicetree plane of iokit registry
A: IOBusyInterest
A: system-type
A: IOConsoleSecurityInterest
A: IOInterruptControllers
A: product-name
A: IOPlatformUUID
A: board-id
A: IOPlatformSerialNumber
A: version
A: IOPolledInterface
A: IOInterruptSpecifiers
A: model
A: manufacturer
A: name
A: clock-frequency
A: compatible
A: serial-number
A: platform-feature
A: IOPlatformSystemSleepPolicy
T: 261
11

Try this when examining IOKit: https://www.bigfix.me/fixlet/details/20254

12

Could the difference be running QnA with sudo/root vs running as a user?

1 Like