Uploaded from urxvt-gist: d62cb7c152723784c97f843be469531d.txt

d62cb7c152723784c97f843be469531d.txt

[main] burdz@~/code/osquery-zip-table: make osqueryi
echo "/home/burdz/code/osquery-zip-table/build/osquery-zip-table-extension.ext" > /tmp/extensions.load
go build -i -o build/osquery-zip-table-extension.ext .
go: -i flag is deprecated
osqueryi --extension=./build/osquery-zip-table-extension.ext
Using a virtual database. Need help, type '.help'
osquery> select * from zip where zip_file = "/home/burdz/Downloads/scripts.zip";
+-----------------------------------+---------------+---------+---------------------------------+----------+-----------------+--------------------+
| zip_file                          | file_name     | comment | modified                        | non_utf8 | compressed_size | uncommpressed_size |
+-----------------------------------+---------------+---------+---------------------------------+----------+-----------------+--------------------+
| /home/burdz/Downloads/scripts.zip | e2e.sh        |         | 2021-10-15 10:17:20 -0700 -0700 | false    | 1047            | 2329               |
| /home/burdz/Downloads/scripts.zip | update_env.sh |         | 2021-10-05 17:40:07 -0700 -0700 | false    | 1144            | 3052               |
+-----------------------------------+---------------+---------+---------------------------------+----------+-----------------+--------------------+
osquery> select * from zip where zip_file = "/home/burdz/Downloads/scripts.zip" AND file_name = 'e2e.sh';
+-----------------------------------+-----------+---------+---------------------------------+----------+-----------------+--------------------+
| zip_file                          | file_name | comment | modified                        | non_utf8 | compressed_size | uncommpressed_size |
+-----------------------------------+-----------+---------+---------------------------------+----------+-----------------+--------------------+
| /home/burdz/Downloads/scripts.zip | e2e.sh    |         | 2021-10-15 10:17:20 -0700 -0700 | false    | 1047            | 2329               |
+-----------------------------------+-----------+---------+---------------------------------+----------+-----------------+--------------------+