Resume support

[ss23]

Got this error while running the new ACLCrimes branch:

Unhandled Exception: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
   at SnaffCore.Classifiers.EffectiveAccess.Win32.AuthzInitializeRemoteResourceManager(IntPtr rpcInitInfo, SafeAuthzRMHandle& authRM)
   at SnaffCore.Classifiers.EffectiveAccess.Win32.GetEffectivePermissions_AuthzInitializeResourceManager(String serverName, Boolean& remoteServerAvailable) in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\Classifiers\EffectiveAccess\EffectiveAccess.cs:line 479
   at SnaffCore.Classifiers.EffectiveAccess.Win32.GetEffectiveAccess(ObjectSecurity sd, IdentityReference2 identity, String serverName, Boolean& remoteServerAvailable, Exception& authzException) in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\Classifiers\EffectiveAccess\EffectiveAccess.cs:line 453
   at SnaffCore.Classifiers.EffectiveAccess.EffectiveAccess.GetEffectiveAccess(FileSystemInfo item, IdentityReference2 id, String serverName) in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\Classifiers\EffectiveAccess\EffectiveAccess.cs:line 113
   at SnaffCore.Classifiers.EffectiveAccess.EffectivePermissions.GetEffectivePermissions(FileSystemInfo filesysInfo, String username) in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\Classifiers\EffectiveAccess\EffectiveAccess.cs:line 93
   at SnaffCore.Classifiers.EffectiveAccess.EffectivePermissions.CanRw(FileSystemInfo filesysInfo) in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\Classifiers\EffectiveAccess\EffectiveAccess.cs:line 39
   at Classifiers.FileResult..ctor(FileInfo fileInfo) in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\Classifiers\FileClassifier.cs:line 361
   at Classifiers.FileClassifier.ClassifyFile(FileInfo fileInfo) in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\Classifiers\FileClassifier.cs:line 97
   at SnaffCore.FileScan.FileScanner.ScanFile(String file) in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\FileScan\FileScanner.cs:line 26
   at SnaffCore.TreeWalk.TreeWalker.<>c__DisplayClass17_0.<WalkTree>b__0() in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\TreeWalk\TreeWalker.cs:line 45
   at System.Threading.Tasks.Task.Execute()
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot)
   at System.Threading.Tasks.Task.ExecuteEntry(Boolean bPreventDoubleExecution)
   at SnaffCore.Concurrency.LimitedConcurrencyLevelTaskScheduler.<NotifyThreadPoolOfPendingWork>b__12_0(Object _) in Z:\tcfox On My Mac\Source\Repos\github.com\SnaffCon\Snaffler\SnaffCore\Concurrency\BlockingTaskScheduler.cs:line 171
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()

No idea what caused it unfortunately.

[ss23]

After looking into this some more, I believe what happened is Snaffler triggered AV and was killed. It might be good to include resume support or something to recover from this situation

[l0ss]

Yeah i think we might be able to do something for a resume function but it would likely involve writing a fairly large file out to disk that contained the contents of the task queues. In order to recover from an unexpected interruption like this we'd need to be doing that on a regular interval. Certainly not impossible but not gonna lie, it's not super far up the TODO list.

[l0ss]

FYI the code that caused the original bug here has since been torn out in favour of a much simpler/faster approach. Resume functionality is something I'd still like to add at some point though so I'll leave this issue open as a reminder.