Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix AttributeError in syscache plugin #913

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

JazzCore
Copy link
Contributor

@JazzCore JazzCore commented Oct 18, 2024

dissect.ntfs changes probably caused regression in syscache plugin that now raises following AttributeError for me:

$ target-query -q -f syscache  DC1.tar
Traceback (most recent call last):
  File "/home/user/test-venv/bin/target-query", line 8, in <module>
    sys.exit(main())
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/utils.py", line 276, in wrapper
    return func(*args, **kwargs)
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/query.py", line 384, in main
    raise e
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/query.py", line 373, in main
    for record_entries in entry:
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/plugins/os/windows/syscache.py", line 78, in syscache
    full_path = self.target.fs.path("\\".join(["sysvol", mft.mft(file_segment).fullpath()]))
AttributeError: 'Mft' object has no attribute 'mft'

Also when MFT record is missing plugin raises following TypeError, PR also fixes this:

Traceback (most recent call last):
  File "/home/user/test-venv/bin/target-query", line 8, in <module>
    sys.exit(main())
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/utils.py", line 276, in wrapper
    return func(*args, **kwargs)
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/query.py", line 384, in main
    raise e
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/query.py", line 373, in main
    for record_entries in entry:
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/plugins/os/windows/syscache.py", line 81, in syscache
    full_path = self.target.fs.path("\\".join(["sysvol", mft.ntfs.mft(file_segment).full_path()]))
TypeError: sequence item 1: expected str instance, NoneType found

@twiggler
Copy link
Contributor

Dear @JazzCore ,

Thank you very much for your contribution to Dissect.
We will assign someone to review.

@@ -75,7 +75,9 @@ def syscache(self):
full_path = None
if mft:
try:
full_path = self.target.fs.path("\\".join(["sysvol", mft.mft(file_segment).fullpath()]))
path = mft.ntfs.mft(file_segment).full_path()
Copy link
Contributor

@twiggler twiggler Oct 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mft already refers to a Mft instance, so I don't think we need the round trip and can shorten to
path = mft(file_segment).full_path().

We can make it even more concise:

Suggested change
path = mft.ntfs.mft(file_segment).full_path()
if path := mft(file_segment).full_path():
full_path = self.target.fs.path("\\".join(["sysvol", path]))

Incidentally, when did you start experiencing this issue? I don't see any recent commits to dissect.ntfs which might cause this. Perhaps it never worked.

@@ -75,7 +75,9 @@ def syscache(self):
full_path = None
if mft:
try:
full_path = self.target.fs.path("\\".join(["sysvol", mft.mft(file_segment).fullpath()]))
path = mft.ntfs.mft(file_segment).full_path()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a unit test to tests/plugins/os/windows/test_syscache.py?

Copy link

codecov bot commented Oct 22, 2024

Codecov Report

Attention: Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.

Project coverage is 76.64%. Comparing base (cb69261) to head (d8da3ce).
Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
dissect/target/plugins/os/windows/syscache.py 0.00% 3 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #913      +/-   ##
==========================================
- Coverage   76.65%   76.64%   -0.01%     
==========================================
  Files         316      316              
  Lines       27101    27103       +2     
==========================================
  Hits        20774    20774              
- Misses       6327     6329       +2     
Flag Coverage Δ
unittests 76.64% <0.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants