`dissect.vmfs.resource`¶

Module Contents¶

Classes¶

`ResourceManager`
`ResourceFile`	VMFS resource file implementation.
`SmallFileBlockResource`	VMFS resource file implementation.
`SubBlockResource`	VMFS resource file implementation.
`PointerBlockResource`	VMFS resource file implementation.
`FileDescriptorResource`	VMFS resource file implementation.
`JournalBlockResource`	VMFS resource file implementation.
`LargeFileBlockResource`	VMFS resource file implementation.

Functions¶

`address_type`	Return the address type.
`address_fmt`	Create a human readable representation of an address.
`address_tbz`	Return whether the TBZ flag is set.
`parse_fb_address`	Parse a FB address and return the block.
`parse_sfb_address`	Parse a SFB address and return the cluster and resource.
`parse_sb_address`	Parse a SB address and return the cluster and resource.
`parse_pb_address`	Parse a PB address and return the cluster and resource.
`parse_fd_address`	Parse a FD address and return the cluster and resource.
`parse_jb_address`	Parse a JB address and return the cluster and resource.
`parse_lfb_address`	Parse a LFB address and return the block.

Attributes¶

RESOURCE_TYPE_MAP

dissect.vmfs.resource.address_type(addr)¶

Return the address type.

Address type is encoded in the lower 3 bits.

dissect.vmfs.resource.address_fmt(vmfs, address)¶

Create a human readable representation of an address.

References: - Addr3_AddrToStr and similar

dissect.vmfs.resource.address_tbz(vmfs, address)¶

Return whether the TBZ flag is set.

The TBZ flag is only valid for FB and LFB addresses.

dissect.vmfs.resource.parse_fb_address(vmfs, address)¶

Parse a FB address and return the block.

VMFS5 encoding:: 0b11111111 11111111 11111111 11000000

dissect.vmfs.resource.parse_sfb_address(vmfs, address)¶

Parse a SFB address and return the cluster and resource.

SFB (small file block) in VMFS6 is what FB was in VMFS5.

VMFS6 encoding:: 0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (cluster) 0b11111111 11111000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_sb_address(vmfs, address)¶

Parse a SB address and return the cluster and resource.

VMFS5 encoding:: 0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource) 0b00000000 00000000 00000000 00011000 (resource if config flag set, << 4)
VMFS6 encoding:: 0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_pb_address(vmfs, address)¶

Parse a PB address and return the cluster and resource.

Encoding:: 0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource)
VMFS6 encoding:: 0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_fd_address(vmfs, address)¶

Parse a FD address and return the cluster and resource.

Encoding:: 0b00000000 00111111 11111111 11000000 (cluster) 0b11111111 11000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_jb_address(vmfs, address)¶

Parse a JB address and return the cluster and resource.

Encoding:: 0b11111100 00000000 00000000 00000000 (cluster) 0b00000000 00000000 11111111 11111000 (resource)

dissect.vmfs.resource.parse_lfb_address(vmfs, address)¶

Parse a LFB address and return the block.

Encoding:: 0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (block)

class dissect.vmfs.resource.ResourceManager(vmfs)¶

vmfs¶

resources¶

open(resource_type, address=None, fileobj=None)¶

get(address)¶

get_resource(resource_type, cluster, resource)¶

parse_address(address)¶

resolve_address(address)¶

property fdc¶

property pb2¶

property pbc¶

property sbc¶

property fbb¶

property lfb¶

property jbc¶

class dissect.vmfs.resource.ResourceFile(vmfs, resource_type, address, fh)¶

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

vmfs¶

type¶

address¶

fh¶

metadata¶

iter_resource_locations()¶

property resource_size¶

abstract parse_address(address)¶: Parse an address into a cluster/resource pair to use for looking up a resource.

get(address)¶: Get the resource belonging to the given address.

get_resource(cluster, resource)¶: Get the resource belonging to the given cluster/resource pair.

class dissect.vmfs.resource.SmallFileBlockResource(vmfs, resource_type, address, fh)¶

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.SubBlockResource(vmfs, resource_type, address, fh)¶

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.PointerBlockResource(vmfs, resource_type, address, fh)¶

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.FileDescriptorResource(vmfs, resource_type, address, fh)¶

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.JournalBlockResource(vmfs, resource_type, address, fh)¶

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.LargeFileBlockResource(vmfs, resource_type, address, fh)¶

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)¶: Parse an address into a cluster/resource pair to use for looking up a resource.

dissect.vmfs.resource.RESOURCE_TYPE_MAP¶

dissect.vmfs.resource¶

Module Contents¶

Classes¶

Functions¶

Attributes¶

`dissect.vmfs.resource`¶