Feature request

What new feature do you want?

Parse the new plist where login items are stored, so the startup_items table is not empty in macOS >=10.13.1

How is this new feature useful?

This will allow for enumeration of login items on the newest versions of macOS (helpful since this is a malware persistence technique).

How can this be implemented?

Similar to how the com.apple.loginitems.plist is parsed for startup_items currently,
since 10.13.1 login items live here:
~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm
(which is a binary plist with some.... interestingly encoded data).

It should be possible to use the CoreFoundation APIs to parse/understand this.

Additional information with further resource links:
https://objective-see.com/blog/blog_0x31.md.html

EDIT:
currently, the path for login items is hardcoded. I would tend to do a version check for the os, and then set the string based on that, or simply set two different strings, which the genStartupItems function could check each against null:

const std::string kLoginItemsPlistPath =
    "Library/Preferences/com.apple.loginitems.plist";
const std::string kNewLoginItemsPlistPath =
    "Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm";