Skip to content

fix(windows): report the WMI error code and warn on an empty os_version #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mikhailm-coder merged 1 commit into from
Oct 5, 2026
Merged

fix(windows): report the WMI error code and warn on an empty os_version #111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 24 additions & 6 deletions osquery/core/windows/wmi.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
*/

#include <locale>
#include <sstream>
#include <string>

#include <osquery/core/windows/wmi.h>
Expand All @@ -16,6 +17,16 @@

namespace osquery {

namespace {

std::string hresultToHex(HRESULT hr) {
std::ostringstream stream;
stream << "0x" << std::hex << hr;
return stream.str();
}

} // namespace

WmiMethodArgs::WmiMethodArgs(WmiMethodArgs&& src) {
std::swap(arguments, src.arguments);
}
Expand Down Expand Up @@ -375,7 +386,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
(LPVOID*)&locator);
if (hr != S_OK) {
return createError(WmiError::ConstructionError)
<< "WmiRequest creation failed after CoCreateInstance";
<< "WmiRequest creation failed after CoCreateInstance: "
<< hresultToHex(hr);
}
WmiRequest wmi_request;
wmi_request.locator_.reset(locator);
Expand All @@ -399,7 +411,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(

if (hr != S_OK) {
return createError(WmiError::ConstructionError)
<< "WmiRequest creation failed to connect to server";
<< "WmiRequest creation failed to connect to server: "
<< hresultToHex(hr);
}

// We need to set specific authentication information on the IWbemServices
Expand All @@ -410,7 +423,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
hr = services->QueryInterface(IID_IClientSecurity, (LPVOID*)&pSecurity);
if (FAILED(hr) || !pSecurity) {
return createError(WmiError::ConstructionError)
<< "WmiRequest creation failed in IClientSecurity interface query";
<< "WmiRequest creation failed in IClientSecurity interface query: "
<< hresultToHex(hr);
}

// Querying the current authentication information
Expand All @@ -435,7 +449,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
pSecurity->Release();

return createError(WmiError::ConstructionError)
<< "WmiRequest creation failed in QueryBlanket call";
<< "WmiRequest creation failed in QueryBlanket call: "
<< hresultToHex(hr);
}

// Setting authentication information on proxy interface
Expand All @@ -452,7 +467,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(

if (FAILED(hr)) {
return createError(WmiError::ConstructionError)
<< "WmiRequest creation failed in SetBlanket call";
<< "WmiRequest creation failed in SetBlanket call: "
<< hresultToHex(hr);
}

wmi_request.services_.reset(services);
Expand All @@ -479,7 +495,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
SysFreeString(language_str);
if (hr != S_OK) {
return createError(WmiError::ConstructionError)
<< "WmiRequest creation failed in ExecQuery";
<< "WmiRequest creation failed in ExecQuery: "
<< hresultToHex(hr);
}

wmi_request.enum_.reset(wbem_enum);
Expand All @@ -494,6 +511,7 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
wmi_request.results_.emplace_back(result);
}
}
wmi_request.enum_result_ = hr;

wmi_request.status_ = Status(0);
return wmi_request;
Expand Down
6 changes: 6 additions & 0 deletions osquery/core/windows/wmi.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,6 +247,11 @@ class WmiRequest {
return status_;
}

/// Code that ended result enumeration; WBEM_S_FALSE when all rows were read.
HRESULT getEnumerationResult() const {
return enum_result_;
}

/**
* @brief Windows WMI Helper function to execute a WMI method call on
* the given object (wrapped in a result)
Expand All @@ -261,6 +266,7 @@ class WmiRequest {
private:
WmiRequest() = default;
Status status_;
HRESULT enum_result_{S_OK};
std::vector<WmiResultItem> results_;

std::unique_ptr<IEnumWbemClassObject, impl::WmiObjectDeleter> enum_{nullptr};
Expand Down
8 changes: 8 additions & 0 deletions osquery/tables/system/windows/os_version.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,14 @@ QueryData genOSVersion(QueryContext& context) {
const std::vector<WmiResultItem>& wmiResults = wmiRequest->results();

if (wmiResults.empty()) {
const auto enumResult = wmiRequest->getEnumerationResult();
if (FAILED(enumResult)) {
LOG(WARNING) << "WMI query on Win32_OperatingSystem failed while "
"reading results: 0x"
<< std::hex << enumResult;
} else {
LOG(WARNING) << "WMI query on Win32_OperatingSystem returned no results";
}
return {};
}

Expand Down
Loading