dissect.hypervisor.disk.c_vhdx
#
Module Contents#
- dissect.hypervisor.disk.c_vhdx.vhdx_def = Multiline-String#
Show Value
""" #define PAYLOAD_BLOCK_NOT_PRESENT 0 #define PAYLOAD_BLOCK_UNDEFINED 1 #define PAYLOAD_BLOCK_ZERO 2 #define PAYLOAD_BLOCK_UNMAPPED 3 #define PAYLOAD_BLOCK_FULLY_PRESENT 6 #define PAYLOAD_BLOCK_PARTIALLY_PRESENT 7 #define SB_BLOCK_NOT_PRESENT 0 #define SB_BLOCK_PRESENT 6 struct file_identifier { char signature[8]; char creator[512]; }; struct header { char signature[4]; uint32 checksum; uint64 sequence_number; char file_write_guid[16]; char data_write_guid[16]; char log_guid[16]; uint16 log_version; uint16 version; uint32 log_length; uint64 log_offset; char reserved[4096]; }; struct region_table_header { char signature[4]; uint32 checksum; uint32 entry_count; char reserved[4]; }; struct region_table_entry { char guid[16]; uint64 file_offset; uint32 length; uint32 required; }; struct bat_entry { uint64 state:3; uint64 reserved:17; uint64 file_offset_mb:44; }; struct metadata_table_header { char signature[8]; char reserved[2]; uint16 entry_count; char reserved2[20]; }; struct metadata_table_entry { char item_id[16]; uint32 offset; uint32 length; uint32 is_user:1; uint32 is_virtual_disk:1; uint32 is_required:1; uint32 reserved:29; uint32 reserved2:2; }; struct file_parameters { uint32 block_size; uint32 leave_block_allocated:1; uint32 has_parent:1; uint32 reserved:30; }; struct virtual_disk_id { char virtual_disk_id[16]; // typedef of an array is still broken }; typedef uint64 virtual_disk_size; typedef uint32 logical_sector_size; typedef uint32 physical_sector_size; struct parent_locator_header { char locator_type[16]; uint16 reserved; uint16 key_value_count; }; struct parent_locator_entry { uint32 key_offset; uint32 value_offset; uint16 key_length; uint16 value_length; }; """
- dissect.hypervisor.disk.c_vhdx.c_vhdx#
- dissect.hypervisor.disk.c_vhdx.ALIGNMENT#
- dissect.hypervisor.disk.c_vhdx.MB#
- dissect.hypervisor.disk.c_vhdx.BAT_REGION_GUID#
- dissect.hypervisor.disk.c_vhdx.FILE_PARAMETERS_GUID#
- dissect.hypervisor.disk.c_vhdx.LOGICAL_SECTOR_SIZE_GUID#
- dissect.hypervisor.disk.c_vhdx.METADATA_REGION_GUID#
- dissect.hypervisor.disk.c_vhdx.PARENT_LOCATOR_GUID#
- dissect.hypervisor.disk.c_vhdx.PHYSICAL_SECTOR_SIZE_GUID#
- dissect.hypervisor.disk.c_vhdx.VIRTUAL_DISK_ID_GUID#
- dissect.hypervisor.disk.c_vhdx.VIRTUAL_DISK_SIZE_GUID#
- dissect.hypervisor.disk.c_vhdx.VHDX_PARENT_LOCATOR_GUID#