Missing OID_PREFIX will cause crash when opening NTDS database

[william-billaud]

When building the ntds schema index, schema.load will crash if a ClassSchema/attributeSchema has an ATTRTYP 32-bit integer value that could not be mapped to a known OID.

I have patched the

dissect.database/dissect/database/ese/ntds/schema.py

Line 201 in 64ae6d8

def _add_attribute(

and

dissect.database/dissect/database/ese/ntds/schema.py

Line 192 in 64ae6d8

def _add_class(self, dnt: int, id: int, name: str) -> None:

with the following code

print(f"keyError _add_class({dnt}, {id} ({id & 0xFFFF0000}), {name}) : {e}")
print(f"KEY error : _add_attribute(name={name}, type_oid {type_oid}, id={id} ({id & 0xFFFF0000})) : {e}")

Result in PJ (2k5 lines but 9 uniq missing values) : key_errors.txt

I was then able to find the associated OID for some of them (work in progress).

E.g :
1210253312 (0x48230000)-> 1.2.840.113556.1.4.7000.102

But I'm not sure how the (

dissect.database/dissect/database/ese/ntds/util.py

Line 42 in 64ae6d8

OID_PREFIX = {

) was build initially, if the 'die and retry' approach is the more effective (having a key error -> investigate to find associated oid -> add to dict -> repeat), and if this function should be made more fault tolerant to allows opening/working with a database even if loading a schema fail.

not related to #21, but issue came from the same part of the code.

NTDS is from a 2012 R2 server (not shareable) .

[Matthijsy]

Just encounterd this issue with an NTDS which is available on VT, might help in debugging: https://www.virustotal.com/gui/file/a70a135e06ce2cad24b56a479d434e3b834705010b34aa31ccf3437b7fe3da29/detection

[Schamper]

That definitely helped, working on a fix!

[Schamper]

#32 should fix this (at least it works on the provided NTDS). @william-billaud would you be able to try that branch on your NTDS?