trailofbits / osquery-extensions

osquery extensions by Trail of Bits
https://blog.trailofbits.com/2017/12/14/announcing-the-trail-of-bits-osquery-extension-repository/
Apache License 2.0
263 stars 36 forks source link

Remove sleuthkit prebuilt library, link with copy built in osquery core #70

Open chouchouzzj opened 3 years ago

chouchouzzj commented 3 years ago

Well , base on https://github.com/trailofbits/osquery-extensions/issues/68

I add this code in file: cmake/flags.cmake set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")

And then cmake --config Release --build . It works well. and this following part works well too. cmake --config RelWithDebInfo --build .

but, when I want to debug the code, errors come. cmake --config Debug --build .

And here are the errors message( Same as https://github.com/trailofbits/osquery-extensions/issues/68) : Libtsk.lib (db_sqlite. Obj) : Error LNK2038: "RuntimeLibrary" mismatch detected:Value "MT_StaticRelease" mismatch value "MTd_StaticDebug" (in osquery_extension_group_main.obj) [D:\build\External\extension_trailofbits\ trailofbits_osquery_extensions.vcxProj] Libcpmt.lib (xstol. Obj) : Error LNK2038: "RuntimeLibrary" mismatch detected:Value "MT_StaticRelease" mismatch value "MTd_StaticDebug" (in osquery_extension_group_main.obj) [D:\build\External\extension_trailofbits\ trailofbits_osquery_extensions.vcxProj]

mike-myers-tob commented 3 years ago

Hi again @chouchouzzj – we think what is happening here is that we provided a precompiled SleuthKit library in our extension, and it was not a debug build binary, so you have linker errors with debug builds.

Since osquery now also builds the SleuthKit library, the fix here is for someone to link our extension(s) to that library rather than the one provided in the trailofbits-extensions repo, and we ought to remove our prebuilt one.

I can't provide a timeframe for when we will get that done, but it seems pretty straightforward.