dissect.hypervisor.disk.c_vhdx#

Module Contents#

dissect.hypervisor.disk.c_vhdx.vhdx_def = Multiline-String#
Show Value
"""
#define PAYLOAD_BLOCK_NOT_PRESENT           0
#define PAYLOAD_BLOCK_UNDEFINED             1
#define PAYLOAD_BLOCK_ZERO                  2
#define PAYLOAD_BLOCK_UNMAPPED              3
#define PAYLOAD_BLOCK_FULLY_PRESENT         6
#define PAYLOAD_BLOCK_PARTIALLY_PRESENT     7

#define SB_BLOCK_NOT_PRESENT                0
#define SB_BLOCK_PRESENT                    6

struct file_identifier {
    char    signature[8];
    char    creator[512];
};

struct header {
    char    signature[4];
    uint32  checksum;
    uint64  sequence_number;
    char    file_write_guid[16];
    char    data_write_guid[16];
    char    log_guid[16];
    uint16  log_version;
    uint16  version;
    uint32  log_length;
    uint64  log_offset;
    char    reserved[4096];
};

struct region_table_header {
    char    signature[4];
    uint32  checksum;
    uint32  entry_count;
    char    reserved[4];
};

struct region_table_entry {
    char    guid[16];
    uint64  file_offset;
    uint32  length;
    uint32  required;
};

struct bat_entry {
    uint64  state:3;
    uint64  reserved:17;
    uint64  file_offset_mb:44;
};

struct metadata_table_header {
    char    signature[8];
    char    reserved[2];
    uint16  entry_count;
    char    reserved2[20];
};

struct metadata_table_entry {
    char    item_id[16];
    uint32  offset;
    uint32  length;
    uint32  is_user:1;
    uint32  is_virtual_disk:1;
    uint32  is_required:1;
    uint32  reserved:29;
    uint32  reserved2:2;
};

struct file_parameters {
    uint32  block_size;
    uint32  leave_block_allocated:1;
    uint32  has_parent:1;
    uint32  reserved:30;
};

struct virtual_disk_id {
    char    virtual_disk_id[16];            // typedef of an array is still broken
};

typedef uint64      virtual_disk_size;
typedef uint32      logical_sector_size;
typedef uint32      physical_sector_size;

struct parent_locator_header {
    char    locator_type[16];
    uint16  reserved;
    uint16  key_value_count;
};

struct parent_locator_entry {
    uint32  key_offset;
    uint32  value_offset;
    uint16  key_length;
    uint16  value_length;
};
"""
dissect.hypervisor.disk.c_vhdx.c_vhdx#
dissect.hypervisor.disk.c_vhdx.ALIGNMENT#
dissect.hypervisor.disk.c_vhdx.MB#
dissect.hypervisor.disk.c_vhdx.BAT_REGION_GUID#
dissect.hypervisor.disk.c_vhdx.FILE_PARAMETERS_GUID#
dissect.hypervisor.disk.c_vhdx.LOGICAL_SECTOR_SIZE_GUID#
dissect.hypervisor.disk.c_vhdx.METADATA_REGION_GUID#
dissect.hypervisor.disk.c_vhdx.PARENT_LOCATOR_GUID#
dissect.hypervisor.disk.c_vhdx.PHYSICAL_SECTOR_SIZE_GUID#
dissect.hypervisor.disk.c_vhdx.VIRTUAL_DISK_ID_GUID#
dissect.hypervisor.disk.c_vhdx.VIRTUAL_DISK_SIZE_GUID#
dissect.hypervisor.disk.c_vhdx.VHDX_PARENT_LOCATOR_GUID#