puffycid
03/19/2021, 2:26 AMPS C:\Users\bob\Projects\osquery\build> radare2.exe .\osquery\RelWithDebInfo\osqueryd.exe
-- Error: There's a missing space before the opening parenthesis '('
[0x1417b1910]> il
[Linked libraries]
shlwapi.dll
rpcrt4.dll
kernel32.dll
user32.dll
shell32.dll
ole32.dll
oleaut32.dll
advapi32.dll
ntdll.dll
ws2_32.dll
iphlpapi.dll
netapi32.dll
version.dll
wtsapi32.dll
secur32.dll
dbghelp.dll
dbgeng.dll
bcrypt.dll
crypt32.dll
wintrust.dll
setupapi.dll
userenv.dll
wevtapi.dll
23 libraries
sadly im not an expert in cmakelistsโน๏ธ, do I need to modify additional cmakelist files (or other files) in order for cabinet.dll/lib/header to be included in the final binary?
thanks!manu
03/20/2021, 7:54 AMflags.cmake
should get the linker to pick cabinet.lib
. Here is the output of build log command line output cabinet.lib
LINK_FLAGS = /machine:X86 /debug /INCREMENTAL /subsystem:console /SUBSYSTEM:CONSOLE /INCREMENTAL:NO ntdll.lib ole32.lib oleaut32.lib ws2_32.lib iphlpapi.lib netapi32.lib rpcrt4.lib shlwapi.lib version.lib wtsapi32.lib wbemuuid.lib secur32.lib taskschd.lib dbghelp.lib dbgeng.lib bcrypt.lib crypt32.lib wintrust.lib setupapi.lib advapi32.lib userenv.lib wevtapi.lib shell32.lib gdi32.lib mswsock.lib cabinet.lib /WHOLEARCHIVE:J:/osquery/build/osquery/sql/osquery_sql.lib /WHOLEARCHIVE:J:/osquery/build/osquery/database/osquery_database_ephemeral.lib /WHOLEARCHIVE:
WIN32_LEAN_AND_FLAG
and few other macros that get passed from top level. You might want to supress them to from the relevant project cmake file. e.g. Here is what i had to do in example extension.
In this case ,i actually ended up not defining in the top level cmake but from the extension project.
J:\osquery\external>gd CMakeLists.txt
diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
index 7b1c9de5..31c00ab4 100644
--- a/external/CMakeLists.txt
+++ b/external/CMakeLists.txt
@@ -18,10 +18,16 @@ set(EXTERNALS_DIR "${CMAKE_SOURCE_DIR}/external")
add_library(external_options INTERFACE)
target_compile_options(external_options INTERFACE -DOSQUERY_EXTERNAL)
+message("removing definition WIN32_LEAN_AND_MEAN")
+remove_definitions(-DWIN32_LEAN_AND_MEAN)
+remove_definitions(-DWIN32_WINNT)
+add_definitions(-D_WIN32_WINNT=_WIN32_WINNT_WIN8)
+add_definitions(-DNTDDI_VERSION=NTDDI_WIN8)
target_link_libraries(external_options INTERFACE
osquery_cxx_settings
osquery_sdk_pluginsdk
osquery_extensions_implthrift
+ cabinet.lib
)
Dump of file J:\osquery\build\external\examples\read_only_table\read_only_table_extension.ext.exe
File Type: EXECUTABLE IMAGE
Section contains the following imports:
Cabinet.dll
8F0078 Import Address Table
9D572C Import Name Table
0 time date stamp
0 Index of first forwarder reference
Ordinal 43
Ordinal 45
Ordinal 40
puffycid
03/23/2021, 6:23 AMfritz
04/02/2021, 5:09 PMprograms
story on Windows, compared to what is available for macOS apps
puffycid
04/02/2021, 5:42 PMfritz
04/02/2021, 6:17 PMpuffycid
04/16/2021, 2:26 AMalessandrogario
04/16/2021, 1:29 PMRtlDecompressBufferEx
function with LoadLibrary/GetProcAddress to avoid a hard dependency on the wdkpuffycid
04/16/2021, 1:33 PMfritz
04/19/2021, 6:14 PMpuffycid
04/24/2021, 11:43 PMfritz
04/25/2021, 2:21 PMprefetch
table to return results, it just keeps choking:
PS C:\osquery\build\osquery\Debug> .\osqueryd.exe -S --verbose
I0428 15:39:55.243664 80768 init.cpp:342] osquery initialized [version=4.8.0-24-g69586fde5]
I0428 15:39:55.246650 80768 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: \Program Files\osquery\extensions.load
I0428 15:39:55.247650 80768 dispatcher.cpp:78] Adding new service: ExtensionWatcher (000001F234277990) to thread: 77380 (000001F23425C830) in process 73144
I0428 15:39:55.247650 80768 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (000001F234281DF0) to thread: 70328 (000001F23425BF70) in process 73144
I0428 15:39:55.248647 70328 interface.cpp:270] Extension manager service starting: \\.\pipe\shell.em
I0428 15:39:55.248647 80768 auto_constructed_tables.cpp:97] Removing stale ATC entries
Using a [1mvirtual database[0m. Need help, type '.help'
osquery> SELECT * FROM prefetch WHERE path = 'C:\Windows\Prefetch\<http://7ZG.EXE-F49B3D46.pf|7ZG.EXE-F49B3D46.pf>';
W0428 15:40:44.938586 80768 prefetch.cpp:253] Unsupported prefetch file: C:\Windows\Prefetch\<http://CHROME.EXE-AED7BA3D.pf|CHROME.EXE-AED7BA3D.pf>
W0428 15:40:45.093174 80768 prefetch.cpp:253] Unsupported prefetch file: C:\Windows\Prefetch\<http://CHROME.EXE-AED7BA44.pf|CHROME.EXE-AED7BA44.pf>
WHERE filename
, a WHERE path
, it just always hangs on those Chrome prefetch files, even if I scope the query to not touch them.puffycid
04/28/2021, 8:08 PMfritz
04/28/2021, 8:13 PM+-----------------+--------------------------+
| Column | Value |
+-----------------+--------------------------+
| Build | 19042 |
| Codename | Microsoft Windows 10 Pro |
| Display Version | 20H2 |
| First Set Up On | |
| Major | 10 |
| Minor | 0 |
| Name | Microsoft Windows 10 Pro |
| Patch | (NULL) |
| Platform | windows |
| Platform Like | windows |
| Release ID | 2009 |
| UBR | 928 |
| Version | 10.0.19042 |
+-----------------+--------------------------+
PS C:\Windows\Prefetch> C:\Users\kolide-razer\Downloads\Get-ZimmermanTools\PECmd.exe -f C:\Windows\Prefetch\<http://CHROME.EXE-AED7BA3D.pf|CHROME.EXE-AED7BA3D.pf>
PECmd version 1.4.0.0
Author: Eric Zimmerman (<mailto:saericzimmerman@gmail.com|saericzimmerman@gmail.com>)
<https://github.com/EricZimmerman/PECmd>
Command line: -f C:\Windows\Prefetch\<http://CHROME.EXE-AED7BA3D.pf|CHROME.EXE-AED7BA3D.pf>
Keywords: temp, tmp
Processing 'C:\Windows\Prefetch\<http://CHROME.EXE-AED7BA3D.pf|CHROME.EXE-AED7BA3D.pf>'
Error opening 'C:\Windows\Prefetch\<http://CHROME.EXE-AED7BA3D.pf|CHROME.EXE-AED7BA3D.pf>'. Message: Invalid signature! Should be 'SCCA'