`dissect.vmfs.address`¶

Module Contents¶

Classes¶

`Address`	Base class for VMFS addresses.
`FileBlockAddr`	VMFS5 FB address.
`SmallFileBlockAddr`	VMFS6 SFB address.
`SubBlockAddr`	VMFS5 SB address.
`SubBlockAddr64`	VMFS6 SB address.
`PointerBlockAddr`	VMFS5 PB/PB2 address.
`PointerBlockAddr64`	VMFS6 PB/PB2 address.
`FileDescriptorAddr`	FD address. Used in both VMFS5 and VMFS6.
`PointerBlock2Addr`	PB2 address, 32-bit variant. Only used in VMFS5.
`PointerBlock2Addr64`	PB2 address, 64-bit variant. Only used in VMFS6.
`JournalBlockAddr`	JB address. Only used in VMFS6.
`LargeFileBlockAddr`	LFB address. Only used in VMFS6.

Functions¶

`address_type`	Return the address type.
`address_fmt`

dissect.vmfs.address.address_type(address: int) → int¶

Return the address type.

Address type is encoded in the lower 3 bits.

dissect.vmfs.address.address_fmt(address: int) → str¶

class dissect.vmfs.address.Address(value: int = 0)¶

Base class for VMFS addresses.

This class primarily exists to provide an easy way to inspect addresses when debugging or testing interactively. For every other case where we actually parse addresses, we use the static methods of the subclasses. This is primarily for performance reasons, so we avoid the overhead of creating unnecessary class instances when we just want one or two integers.

VMFS makes extensive use of opaque 32-bit and 64-bit integers to represent addresses. In VMFS5, exclusively 32-bit integers are used, while VMFS6 uses 64-bit integers for most address types. The lower 3 bits of an address determine the address type, while the remaining bits are address type specific. Some address types have additional bits for flags, such as copy-on-write (COW) or to-be-zeroed (TBZ). Most address types have a cluster and resource part, which are used to index into resource files. The file block and large file block addresses only have a block part, which points to somewhere on the volume.

Encoding

struct FS3_Address {
    uint32 addrType : 3;
    uint32 addrSpecific : 29;
};

struct FS3_Address64 {
    uint64 addrType : 3;
    uint64 addrSpecific : 61;
};

References

Addr3_AddrToStr
Addr3_AddrToStr64
Res3Parse*Addr*

__type__¶

__known_types__: ClassVar[dict[int, type[Address]]]¶

classmethod __init_subclass__()¶

value = 0¶

__int__() → int¶

__eq__(other: object) → bool¶

__ne__(other: object) → bool¶

__hash__() → int¶

__repr__() → str¶

property type: int¶: Return the address type.

static parse(address: int) → tuple[int, int] | int¶

Abstractmethod:

Parse the address and return the cluster and resource.

This method should be overridden by subclasses.

classmethod make(cluster: int, resource: int) → int¶

Abstractmethod:

Create an address from a cluster and resource.

This method should be overridden by subclasses.

classmethod make_type(type: dissect.vmfs.c_vmfs.FS3_AddrType | int, cluster: int, resource: int) → int¶: Create an address from a type, cluster and resource.

class dissect.vmfs.address.FileBlockAddr(value: int = 0)¶

Bases: Address

VMFS5 FB address.

FB (file block) in VMFS5 are used to describe data blocks on the volume.

A block in a lazily zeroed file, can have its TBZ (to-be-zeroed) flag set to 1, indicating that the block should be treated as zeroed when read. This is treated for the whole block.

Encoding

struct FS3_FileBlockAddr {
    uint32 addrType     : 3;
    uint32 unused       : 1;
    uint32 copyOnWrite  : 1;
    uint32 toBeZeroed   : 1;
    uint32 blockNum     : 26;
};

0b00000000 00000000 00000000 00000111  (type)
0b00000000 00000000 00000000 00001000  (unused/unknown)
0b00000000 00000000 00000000 00010000  (cow)
0b00000000 00000000 00000000 00100000  (tbz)
0b11111111 11111111 11111111 11000000  (block)

__type__¶

__repr__() → str¶

property cow: int¶: Parse the FB address and return the copy-on-write value.

property tbz: int¶: Parse the FB address and return the to-be-zeroed value.

property block: int¶

static parse(address: int) → int¶

Parse the address and return the cluster and resource.

This method should be overridden by subclasses.

classmethod make(block: int, cow: int = 0, tbz: int = 0) → int¶: Create a VMFS5 FB address from a block.

class dissect.vmfs.address.SmallFileBlockAddr(value: int = 0)¶

Bases: Address

VMFS6 SFB address.

SFB (small file block) in VMFS6 is what FB was in VMFS5. They are used to describe data blocks on the volume. Their encoding now consists of a cluster and resource part, which can be used to check allocation status in the resource file. See SmallFileBlockResourceVMFS6 for more details.

In this variant of the address, the TBZ (to-be-zeroed) flag is a bitmap that can be used to indicate different parts of the block that should be zeroed out. Though when reading the block, the whole block seems to be treated as zeroed when any bit is set to 1.

Encoding

struct FS3_SmallFileBlockAddr64 {
    uint64 addrType         : 3;
    uint64 unused1          : 2;
    uint64 copyOnWrite      : 1;
    uint64 unused2          : 1;
    uint64 toBeZeroed       : 8;
    uint64 sfbClusterNum    : 31;
    uint64 unknown          : 5;
    uint64 sfbNum           : 13;
};

0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000111  (type)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00011000  (unused/unknown)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00100000  (cow)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 01000000  (unused/unknown)
0b00000000 00000000 00000000 00000000 00000000 00000000 01111111 10000000  (tbz bitmap)
0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000  (cluster)
0b00000000 00000111 11000000 00000000 00000000 00000000 00000000 00000000  (unknown)
0b11111111 11111000 00000000 00000000 00000000 00000000 00000000 00000000  (resource)

__type__¶

__repr__() → str¶

property cow: int¶: Parse the SFB address and return the copy-on-write value.

property tbz: int¶: Parse the SFB address and return the to-be-zeroed value.

property cluster: int¶: Return the cluster part of the address.

property resource: int¶: Return the resource part of the address.

static parse(address: int) → tuple[int, int]¶: Parse the SFB address and return the cluster and resource.

classmethod make(cluster: int, resource: int, cow: int = 0, tbz: int = 0) → int¶: Create a VMFS6 SFB address from a cluster and resource.

class dissect.vmfs.address.SubBlockAddr(value: int = 0)¶

Bases: Address

VMFS5 SB address.

SB (sub-block) describe small blocks of data which would be wasteful to store in a normal file block, and instead are stored in the .sbc.sf resource file.

If the /config/VMFS3/intOpts/DenseSBPerCluster option is set, the resource part of the address is extended by 2 bits to allow more sub-block resources per cluster.

Encoding

struct FS3_SubBlockAddr {
    uint32 addrType     : 3;
    uint32 sbNumHi      : 2;
    uint32 copyOnWrite  : 1;
    uint32 sbClusterNum : 22;
    uint32 sbNum        : 4;
};

0b00000000 00000000 00000000 00000111  (type)
0b00000000 00000000 00000000 00011000  (resourceHi if FS3_Config.DENSE_SBPC is set)
0b00000000 00000000 00000000 00100000  (cow)
0b00001111 11111111 11111111 11000000  (cluster)
0b11110000 00000000 00000000 00000000  (resource)

__type__¶

__repr__() → str¶

property cow: int¶: Parse the SB address and return the copy-on-write value.

property cluster: int¶: Return the cluster part of the address.

property resource: int¶: Return the resource part of the address.

static parse(address: int, dense: bool = False) → tuple[int, int]¶: Parse the SB address and return the cluster and resource.

classmethod make(cluster: int, resource: int, cow: int = 0) → int¶: Create a VMFS5 SB address from a cluster and resource.

class dissect.vmfs.address.SubBlockAddr64(value: int = 0)¶

Bases: Address

VMFS6 SB address.

SB (sub-block) describe small blocks of data which would be wasteful to store in a normal file block, and instead are stored in the .sbc.sf resource file.

Encoding

struct FS3_SubBlockAddr64 {
    uint64 addrType     : 3;
    uint64 unused       : 2;
    uint64 copyOnWrite  : 1;
    uint64 sbClusterNum : 36;
    uint64 unknown      : 14;
    uint64 sbNum        : 8;
};

0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000111  (type)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00011000  (unused/unknown)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00100000  (cow)
0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000  (cluster)
0b00000000 00000000 00000011 00000000 00000000 00000000 00000000 00000000  (cluster according to Addr3_AddrToStr64, but not Res3ParseSubBlockAddr64VMFS6)
0b00000000 11111111 11111100 00000000 00000000 00000000 00000000 00000000  (unknown)
0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000  (resource)

__type__¶

__repr__() → str¶

property cow: int¶: Parse the SB address and return the copy-on-write value.

property cluster: int¶: Return the cluster part of the address.

property resource: int¶: Return the resource part of the address.

static parse(address: int) → tuple[int, int]¶: Parse the SB address and return the cluster and resource.

classmethod make(cluster: int, resource: int, cow: int = 0) → int¶: Create a VMFS6 SB address from a cluster and resource.

class dissect.vmfs.address.PointerBlockAddr(value: int = 0)¶

Bases: Address

VMFS5 PB/PB2 address.

PB (pointer block) are used for indirect addressing of file blocks. They can point to other PBs or file blocks.

Encoding

struct FS3_PtrBlockAddr {
    uint32 addrType     : 3;
    uint32 unused       : 2;
    uint32 copyOnWrite  : 1;
    uint32 pbClusterNum : 22;
    uint32 ptrBlockNum  : 4;
};

0b00000000 00000000 00000000 00000111  (type)
0b00000000 00000000 00000000 00011000  (unused)
0b00000000 00000000 00000000 00100000  (cow)
0b00001111 11111111 11111111 11000000  (cluster)
0b11110000 00000000 00000000 00000000  (resource)

__type__¶

__repr__() → str¶

property cow: int¶: Parse the PB address and return the copy-on-write value.

property cluster: int¶: Return the cluster part of the address.

property resource: int¶: Return the resource part of the address.

static parse(address: int) → tuple[int, int]¶: Parse the PB address and return the cluster and resource.

classmethod make(cluster: int, resource: int, cow: int = 0) → int¶: Create a VMFS5 PB address from a cluster and resource.

class dissect.vmfs.address.PointerBlockAddr64(value: int = 0)¶

Bases: Address

VMFS6 PB/PB2 address.

PB (pointer block) are used for indirect addressing of file blocks. They can point to other PBs or file blocks.

Encoding

struct FS3_PtrBlockAddr64 {
    uint64 addrType     : 3;
    uint64 unused       : 2;
    uint64 copyOnWrite  : 1;
    uint64 pbClusterNum : 36;
    uint64 unknown      : 14;
    uint64 ptrBlockNum  : 8;
};

0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000111  (type)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00011000  (unused/unknown)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00100000  (cow)
0b00000000 00000000 00000011 11111111 11111111 11111111 11111111 11000000  (cluster)
0b00000000 11111111 11111100 00000000 00000000 00000000 00000000 00000000  (unknown)
0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000  (resource)

__type__¶

__repr__() → str¶

property cow: int¶: Parse the PB address and return the copy-on-write value.

property cluster: int¶: Return the cluster part of the address.

property resource: int¶: Return the resource part of the address.

static parse(address: int) → tuple[int, int]¶: Parse the PB address and return the cluster and resource.

classmethod make(cluster: int, resource: int, cow: int = 0) → int¶: Create a VMFS6 PB address from a cluster and resource.

class dissect.vmfs.address.FileDescriptorAddr(value: int = 0)¶

Bases: Address

FD address. Used in both VMFS5 and VMFS6.

FD (file descriptor) addresses are used to reference file descriptors in the .fdc.sf resource file. They are similar to inode numbers in traditional filesystems.

Encoding

struct FS3_FDAddr {
    uint32 addrType     : 3;
    uint32 unused       : 3;
    uint32 fdClusterNum : 16;
    uint32 fdNum        : 10;
};

0b00000000 00000000 00000000 00000111  (type)
0b00000000 00000000 00000000 00111000  (unused)
0b00000000 00111111 11111111 11000000  (cluster)
0b11111111 11000000 00000000 00000000  (resource)

__type__¶

__repr__() → str¶

property cluster: int¶: Return the cluster part of the address.

property resource: int¶: Return the resource part of the address.

static parse(address: int) → tuple[int, int]¶: Parse the FD address and return the cluster and resource.

classmethod make(cluster: int, resource: int) → int¶: Create a FD address from a cluster and resource.

class dissect.vmfs.address.PointerBlock2Addr(value: int = 0)¶

Bases: PointerBlockAddr

PB2 address, 32-bit variant. Only used in VMFS5.

PB (pointer block) are used for indirect addressing of file blocks. They can point to other PBs or file blocks.

Encoding for PB and PB2 is the same, but the address type differs.

__type__¶

__repr__() → str¶

class dissect.vmfs.address.PointerBlock2Addr64(value: int = 0)¶

Bases: PointerBlockAddr64

PB2 address, 64-bit variant. Only used in VMFS6.

PB (pointer block) are used for indirect addressing of file blocks. They can point to other PBs or file blocks.

Encoding for PB and PB2 is the same, but the address type differs.

__type__¶

__repr__() → str¶

class dissect.vmfs.address.JournalBlockAddr(value: int = 0)¶

Bases: Address

JB address. Only used in VMFS6.

Encoding

struct FS3_JournalBlockAddr {
    uint32 addrType     : 3;
    uint32 jbClusterNum : 13;
    uint32 unused       : 10;
    uint32 jbNum        : 6;
};

0b00000000 00000000 00000000 00000111  (type)
0b00000000 00000000 11111111 11111000  (cluster)
0b00000011 11111111 00000000 00000000  (unused/unknown)
0b11111100 00000000 00000000 00000000  (resource)

__type__¶

__repr__() → str¶

property cluster: int¶: Return the cluster part of the address.

property resource: int¶: Return the resource part of the address.

static parse(address: int) → tuple[int, int]¶: Parse the JB address and return the cluster and resource.

classmethod make(cluster: int, resource: int) → int¶: Create a JB address from a cluster and resource.

class dissect.vmfs.address.LargeFileBlockAddr(value: int = 0)¶

Bases: Address

LFB address. Only used in VMFS6.

LFB (large file block) addresses are used to reference file blocks larger than the standard file block size. They are used for large files, such as virtual disks.

Encoding

struct FS3_LargeFileBlockAddr64 {
    uint64 addrType     : 3;
    uint64 unused1      : 2;
    uint64 copyOnWrite  : 1;
    uint64 unused2      : 1;
    uint64 toBeZeroed   : 8;
    uint64 blockNum     : 31;
    uint64 unused3      : 18;
};

0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000111  (type)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00011000  (unused/unknown)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 00100000  (cow)
0b00000000 00000000 00000000 00000000 00000000 00000000 00000000 01000000  (unused/unknown)
0b00000000 00000000 00000000 00000000 00000000 00000000 01111111 10000000  (tbz bitmap)
0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000  (block)
0b11111111 11111111 11000000 00000000 00000000 00000000 00000000 00000000  (unused/unknown)

__type__¶

__repr__() → str¶

property cow: int¶: Parse the LFB address and return the copy-on-write value.

property tbz: int¶: Parse the LFB address and return the to-be-zeroed value.

property block: int¶

static parse(address: int) → int¶: Parse the LFB address and return the block.

classmethod make(block: int, cow: int = 0, tbz: int = 0) → int¶: Create a LFB address from a block.

dissect.vmfs.address¶

Module Contents¶

Classes¶

Functions¶

`dissect.vmfs.address`¶