https://github.com/osquery/osquery logo
Title
d

Daniel Bretón Suárez

12/01/2022, 11:48 AM
I'm trying to send a post message to a server from an extension using
http_client
, somehow like this:
osquery::http::Client client;
client.setOptions(getOptions()); /* Local function to fill options */
<http://client.post|client.post>(request, params); /* crashes on Windows */
Works fine on Ubuntu, but it crashes on Windows. https://github.com/osquery/osquery/blob/a5bc1a33f2ad5eecb1a814d472c00a30c410d394/osquery/remote/http_client.cpp#L119 There's also a comment that says there is a leak, Is there any way to avoid this?
It crashes when calling
boost::asio::async_connect
. It causes a segmentation fault
s

Stefano Bonicatti

12/01/2022, 1:54 PM
If you can build in RelWithDebInfo and then run under the debugger, a stack trace would help understanding what’s happening. Not sure otherwise. As for the leak, there’s no leak in theory now, the comment should say “we could resolve async, but there is a handle leak in Windows”. It’s not resolved async, the call is synchronous.
If it were async, it would use the
async_resolve
function
d

Daniel Bretón Suárez

12/02/2022, 12:53 PM
The extension has the symbols generated in the folder
PS C:\projects\osquery\build> ls .\external\extension_devo_wevent_logger\RelWithDebInfo\


    Directory: C:\projects\osquery\build\external\extension_devo_wevent_logger\RelWithDebInfo


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        12/2/2022  10:49 AM       10084352 devo_wevent_logger.ext.exe
-a----        12/2/2022  10:49 AM      116379648 devo_wevent_logger.ext.pdb
But I cannot open them with
gdb
is there a way to avoid using
Microsoft Visual Studio
?
s

Stefano Bonicatti

12/02/2022, 12:56 PM
You can’t use gdb, that’s for Linux only and the dwarf format. You can use Visual Studio Code, or WinDBG
d

Daniel Bretón Suárez

12/02/2022, 12:57 PM
I see, thanks!
Seems that it reaches
target_executor.hpp:629
and the pointer
target_fns_
is not initialized
I don't know a good way to share this