Triggered a system crash (by abruptly shutting down the host system running a VM as SUT)
Log back into the VM
Observe that exception_code and module values are empty in the output when windows_crashes table is queried
Locate the crash dump and parse it using windbg
Observe that exception_code and module information is present in the parsed crash dump
What did you expect to see?
exception_code and module values populated when windows_crashes table is queried
What did you see instead?
exception_code and module values empty when windows_crashes table is queried
Additional information
Query:
select
'System Crash' AS event_name,
'complete' AS event_status,
(select logon_domain || '/' || user
from logon_sessions
where user in (
select user from logged_in_users where type='active' LIMIT(1)
)
LIMIT(1)
) as user,
path AS process,
version As version,
module AS module,
exception_code as error,
stack_trace AS stack_trace,
cast((strftime('%s',split(datetime, 'UTC', 0)) * 1000000000) as int) as trigger_time
from windows_crashes
where crash_path in (
select path
from file
where
path like (
select (data || 'windows\\minidump\\%.dmp') as path
from registry
where path='$path1'
)
or path like (
select (data || 'windows\\memory.dmp%') as path
from registry
where path='$path2'
)
);
$path1 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\BootDir"
$path2 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\BootDir"
We should consider refactoring the windows_crashes table. I looked briefly and I see a lot of missing error checking and re-initialization of resources. I do not know enough about windows to do this myself.
Bug report
What operating system and version are you using?
Windows 10 version 1809 build 17763.805
What version of osquery are you using?
4.02
What steps did you take to reproduce the issue?
What did you expect to see?
exception_code and module values populated when windows_crashes table is queried
What did you see instead?
exception_code and module values empty when windows_crashes table is queried
Additional information
Query:
Parsed crash dump: