Recover from panics on NTFS parsing. (Velocidex#75)

This happens sometimes due to race conditions on the disk.
simiaoxiaoseng · Sep 19, 2019 · b106252 · b106252
1 parent b63d0f1
commit b106252
Show file tree

Hide file tree

Showing 4 changed files with 33 additions and 6 deletions.
diff --git a/artifacts/assets/ab0x.go b/artifacts/assets/ab0x.go
diff --git a/go.mod b/go.mod
@@ -95,7 +95,7 @@ require (
 	gopkg.in/russross/blackfriday.v2 v2.0.1
 	honnef.co/go/tools v0.0.1-2019.2.3 // indirect
 	www.velocidex.com/golang/evtx v0.0.0-20190210013513-b45fe1505163
-	www.velocidex.com/golang/go-ntfs v0.0.0-20190915152010-a30b0daf7439
+	www.velocidex.com/golang/go-ntfs v0.0.0-20190919131212-da25d00fb8f0
 	www.velocidex.com/golang/go-pe v0.1.0
 	www.velocidex.com/golang/go-prefetch v0.0.0-20190703150313-0469fa2f85cf
 	www.velocidex.com/golang/oleparse v0.0.0-20190327031422-34195d413196

diff --git a/go.sum b/go.sum
@@ -429,6 +429,8 @@ www.velocidex.com/golang/go-ntfs v0.0.0-20190915142106-3e8b925490bb h1:+jrfSBco9
 www.velocidex.com/golang/go-ntfs v0.0.0-20190915142106-3e8b925490bb/go.mod h1:/M7UNGTNy2hT6Z+fBwDOPL43DBxMK+IqWjcvdd0wtIE=
 www.velocidex.com/golang/go-ntfs v0.0.0-20190915152010-a30b0daf7439 h1:3YzYziFA9brKyeEktej0VLExQMS/dF6Ra3iIgcNORWM=
 www.velocidex.com/golang/go-ntfs v0.0.0-20190915152010-a30b0daf7439/go.mod h1:PqtikStGr+veDXyoha9wqB/VImxtJDljK2+raRNURzg=
+www.velocidex.com/golang/go-ntfs v0.0.0-20190919131212-da25d00fb8f0 h1:+JY3AJRFRtg9xkPblxQSdanrfWTXm0Sa1/waY5MYgQM=
+www.velocidex.com/golang/go-ntfs v0.0.0-20190919131212-da25d00fb8f0/go.mod h1:PqtikStGr+veDXyoha9wqB/VImxtJDljK2+raRNURzg=
 www.velocidex.com/golang/go-pe v0.1.0 h1:W5oYsEMz1GiBv84CyZzOzTHjLaGLv8oTaDfrRkcDB6E=
 www.velocidex.com/golang/go-pe v0.1.0/go.mod h1:BBNxoooAx/LA/F9rn3QliOCR2FtiDccxX3MVsJ4OX2g=
 www.velocidex.com/golang/go-prefetch v0.0.0-20190703150313-0469fa2f85cf h1:MhCevuCZJLBXoiYjL2W7qy7OugVZm/LBB11D6iKYUMY=

diff --git a/vql/windows/filesystems/ntfs_windows.go b/vql/windows/filesystems/ntfs_windows.go
@@ -26,6 +26,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -264,7 +265,15 @@ func discoverLogicalDisks() ([]glob.FileInfo, error) {
 	return result, nil
 }
 
-func (self *NTFSFileSystemAccessor) ReadDir(path string) ([]glob.FileInfo, error) {
+func (self *NTFSFileSystemAccessor) ReadDir(path string) (res []glob.FileInfo, err error) {
+	defer func() {
+		r := recover()
+		if r != nil {
+			fmt.Printf("PANIC %v\n", r)
+			err, _ = r.(error)
+		}
+	}()
+
 	result := []glob.FileInfo{}
 
 	// The path must start with a valid device, otherwise we list
@@ -357,7 +366,15 @@ func (self *readAdapter) Seek(offset int64, whence int) (int64, error) {
 	return self.pos, nil
 }
 
-func (self *NTFSFileSystemAccessor) Open(path string) (glob.ReadSeekCloser, error) {
+func (self *NTFSFileSystemAccessor) Open(path string) (res glob.ReadSeekCloser, err error) {
+	defer func() {
+		r := recover()
+		if r != nil {
+			fmt.Printf("PANIC %v\n", r)
+			err, _ = r.(error)
+		}
+	}()
+
 	// The path must start with a valid device, otherwise we list
 	// the devices.
 	device, subpath, err := self.GetRoot(path)
@@ -404,7 +421,15 @@ func (self *NTFSFileSystemAccessor) Open(path string) (glob.ReadSeekCloser, erro
 	return nil, errors.New("File not found")
 }
 
-func (self *NTFSFileSystemAccessor) Lstat(path string) (glob.FileInfo, error) {
+func (self *NTFSFileSystemAccessor) Lstat(path string) (res glob.FileInfo, err error) {
+	defer func() {
+		r := recover()
+		if r != nil {
+			fmt.Printf("PANIC %v\n", r)
+			err, _ = r.(error)
+		}
+	}()
+
 	// The path must start with a valid device, otherwise we list
 	// the devices.
 	device, subpath, err := self.GetRoot(path)