Loki icon indicating copy to clipboard operation
Loki copied to clipboard

Scanner unable to handle NTFS Junction Points?

Open stumpyuk1 opened this issue 2 years ago • 0 comments

I am testing Loki V 0.44.2 on a test system. The scan appears to hang indefinitely or not complete. It looks to be borking when it hits NTFS junction points associated with WSL. Test system is Win 10 with WSL (Ubuntu).

Command Line invocation: loki.exe -p C:\ --noprocscan --pesieveshellc --rootkit --intense --onlyrelevant --csv --logfolder D:\scanout --debug

Last line of the debug log is: File "\vboxsvr\workspace\Loki\loki.py", line 300, in scan_path OSError: [WinError 1920] The file cannot be accessed by the system: 'C:\Users\stump\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu20.04onWindows_79rhkp1fndgsc\LocalState\rootfs\bin'

When I browse to that path in the terminal and run the "dir" command:

Directory of C:\Users\stump\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu20.04onWindows_79rhkp1fndgsc\LocalState\rootfs

30/03/2021 09:55 DIR . 30/03/2021 09:55 DIR .. 19/02/2021 23:48 JUNCTION bin [...] 19/02/2021 23:56 DIR boot 19/02/2021 23:51 DIR dev 24/11/2021 13:01 DIR etc 30/03/2021 09:55 DIR home 12/11/2021 16:07 636,192 init 19/02/2021 23:48 JUNCTION lib [...] 19/02/2021 23:48 JUNCTION lib32 [...] 19/02/2021 23:48 JUNCTION lib64 [...] 19/02/2021 23:48 JUNCTION libx32 [...] 05/09/2021 18:59 DIR media 14/10/2021 16:59 DIR mnt 10/10/2021 20:26 DIR opt 15/04/2020 11:09 DIR proc 05/09/2021 20:16 DIR root 19/02/2021 23:52 DIR run 19/02/2021 23:48 JUNCTION sbin [...] 19/02/2021 23:52 DIR snap 19/02/2021 23:48 DIR srv 15/04/2020 11:09 DIR sys 20/11/2021 16:50 DIR tmp 08/09/2021 10:29 DIR usr 05/09/2021 18:49 DIR var 7 File(s) 636,192 bytes 18 Dir(s) 381,584,572,416 bytes free

When I try and cd into the "bin" folder: **C:\Users\stump\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu20.04onWindows_79rhkp1fndgsc\LocalState\rootfs>cd bin The directory name is invalid.

stumpyuk1 avatar Nov 26 '21 11:11 stumpyuk1