[fix] Cannot open volume, operating string out of bounds

[antwise]

There is bug:

Unable to open volume \\?\Volume{88b8eb89-1df3-11e7-8bc2-000c29c41622} (libvshadow_store_descriptor_read_store_header: operating machine string size value out of bounds.
libvshadow_volume_open_read: unable to read store: 2 header.
libvshadow_volume_open_file_io_handle: unable to read from file IO handle.
libvshadow_volume_open_wide: unable to open volume: \\?\Volume{88b8eb89-1df3-11e7-8bc2-000c29c41622}.)

It appears because libvshadow wrong interpreterpath field with name unknown10

Its null-terminated utf-16 string guid.

[joachimmetz]

@antwise could you describe your issue in a bit more detail.

Based on Unable to open volume \\?\Volume{88b8eb89-1df3-11e7-8bc2-000c29c41622} I assume you're running libvshadow on a live volume? What version of Windows? etc.

[antwise]

@joachimmetz I running libvshadow on live volume in Windows 2008 R2.
There is partitions:

\\?\Volume{88b8eb89-1df3-11e7-8bc2-000c29c41622 is H:

[joachimmetz]

I'll need to double check if your proposed changes are really part of the format or maybe due to the fact you're running on a live volume and volsnap.sys is known to continuously update the VSS information.

[antwise]

@joachimmetz, Ok. What to do with the tests? For Travis Ci - there is https://gist.github.com/entropiae/a899d8a78dc8a38f505e#file-fix_git_sslread_9806-sh.

[joachimmetz]

Let me have a look at the format changes first. I can look at the tests if/when I merge the changes if necessary.

[antwise]

Hm.. Today I catch, that its path of mount of snapshot(Field "Exposed locally as..." in output of vshadow.exe)

[joachimmetz]

@antwise interesting thanks, I'll try to confirm this as soon as time permits and work on integrating your changes

[joachimmetz]

Some related info https://technet.microsoft.com/en-us/library/cc731098.aspx

[joachimmetz]

Small update, did not have the time yet to create representative test data. Trying to get back to it soon

[joachimmetz]

Note to self still pending on creating representative test data

https://github.com/dfirlabs/vss-specimens