Lnk plugin bug "Invalid MFT reference: None" #1359
Description
Hi guys!
While testing a windows11.vmdk, using the lnk plugin i encountered the following issue:
command:
target-query -f lnk ./Windows11.vmdk -Kv XXXX-XXX-XXX-XXX
Error:
Traceback (most recent call last):
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/helpers/compat/path_312.py", line 162, in get
return self._entry
^^^^^^^^^^^
AttributeError: 'TargetPath' object has no attribute '_entry'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/home/nari/dev/.venv/bin/target-query", line 8, in <module>
sys.exit(main())
^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/tools/utils.py", line 394, in wrapper
return func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/tools/query.py", line 246, in main
for record in record_generator:
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/plugins/os/windows/lnk.py", line 168, in lnk
for entry in self.lnk_entries(path):
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/plugins/os/windows/lnk.py", line 189, in lnk_entries
yield from self.target.fs.path("sysvol").joinpath(folder).rglob("*.lnk")
File "/usr/lib/python3.12/pathlib.py", line 1111, in rglob
for p in selector.select_from(self):
File "/usr/lib/python3.12/pathlib.py", line 236, in _select_from
for p in successor_select(starting_point, scandir):
File "/usr/lib/python3.12/pathlib.py", line 203, in _select_from
with scandir(parent_path) as scandir_it:
^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/helpers/compat/path_312.py", line 220, in _scandir
return path_common.scandir(self)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/helpers/compat/path_common.py", line 95, in scandir
return _DissectScandirIterator(path.get().scandir())
^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/helpers/compat/path_312.py", line 164, in get
self._entry = self._fs.get(str(self))
^^^^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/filesystem.py", line 1628, in get
entry = super().get(path, relentry)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/filesystem.py", line 1470, in get
entries.append(self._get_from_entry(path, sub_entry))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/filesystem.py", line 1496, in _get_from_entry
entry = entry.get(part)
^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/filesystems/ntfs.py", line 83, in get
self.fs._get_record(path, self.dereference()),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/target/filesystems/ntfs.py", line 54, in _get_record
return self.ntfs.mft.get(path, root=root)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/ntfs/mft.py", line 120, in get
return self._get_path(ref, root)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/ntfs/mft.py", line 81, in _get_path
node = node.reparse_point_record
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/functools.py", line 995, in __get__
val = self.func(instance)
^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/ntfs/mft.py", line 367, in reparse_point_record
return self.ntfs.mft.get(target_name)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/nari/dev/.venv/lib/python3.12/site-packages/dissect/ntfs/mft.py", line 122, in get
raise TypeError(f"Invalid MFT reference: {ref!r}")
TypeError: Invalid MFT reference: None
Also if you need an image to reproduce this, contact me 💌