Missing OID_PREFIX will cause crash when opening NTDS database

[william-billaud]

When building the ntds schema index, schema.load will crash if a ClassSchema/attributeSchema has an ATTRTYP 32-bit integer value that could not be mapped to a known OID.

I have patched the

dissect.database/dissect/database/ese/ntds/schema.py

Line 201 in 64ae6d8

def _add_attribute(

and

dissect.database/dissect/database/ese/ntds/schema.py

Line 192 in 64ae6d8

def _add_class(self, dnt: int, id: int, name: str) -> None:

with the following code

print(f"keyError _add_class({dnt}, {id} ({id & 0xFFFF0000}), {name}) : {e}")
print(f"KEY error : _add_attribute(name={name}, type_oid {type_oid}, id={id} ({id & 0xFFFF0000})) : {e}")

Result in PJ (2k5 lines but 9 uniq missing values) : key_errors.txt

I was then able to find the associated OID for some of them (work in progress).

E.g :
1210253312 (0x48230000)-> 1.2.840.113556.1.4.7000.102

But I'm not sure how the (

dissect.database/dissect/database/ese/ntds/util.py

Line 42 in 64ae6d8

OID_PREFIX = {

) was build initially, if the 'die and retry' approach is the more effective (having a key error -> investigate to find associated oid -> add to dict -> repeat), and if this function should be made more fault tolerant to allows opening/working with a database even if loading a schema fail.

not related to #21, but issue came from the same part of the code.

NTDS is from a 2012 R2 server (not shareable) .