`dissect.vmfs.resource`¶

Module Contents¶

Classes¶

`ResourceFile`	VMFS resource file implementation.
`FileBlockResourceVMFS5`	(Small) file block resource (`.fbb.sf`).
`SmallFileBlockResourceVMFS6`	Small file block resource (`.fbb.sf`) for VMFS6.
`SubBlockResourceVMFS5`	Sub-block resource (`.sbc.sf`) for VMFS5.
`SubBlockResourceVMFS6`	Sub-block resource (`.sbc.sf`) for VMFS6.
`PointerBlockResourceVMFS5`	Pointer block resource (`.pbc.sf`).
`PointerBlockResourceVMFS6`	Pointer block resource (`.pbc.sf`) for VMFS6.
`FileDescriptorResourceVMFS5`	File descriptor resource (`.fdc.sf`) for VMFS5.
`FileDescriptorResourceVMFS6`	File descriptor resource (`.fdc.sf`) for VMFS6.
`PointerBlock2ResourceVMFS5`	Pointer block 2 resource (`.pb2.sf`) for VMFS5.
`PointerBlock2ResourceVMFS6`	Pointer block 2 resource (`.pb2.sf`) for VMFS6.
`JournalBlockResourceVMFS6`	Journal block resource (`.jbc.sf`).
`LargeFileBlockResourceVMFS6`	Large file block resource (`.fbb.sf`).
`ResourceManager`	Manager for VMFS resources.

Attributes¶

`RESOURCE_TYPE_MAP_VMFS5`
`RESOURCE_TYPE_MAP_VMFS6`
`RESOURCE_TYPE_ABBREVIATIONS`

class dissect.vmfs.resource.ResourceFile(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data. Some may not have any resource data at all, using only the bitmaps in the resource file to track allocation.

Resource files start with a metadata header (FS3_ResFileMetadata) that contains information about the layout of the file, such as the number of resources, their size, and their organization into clusters and cluster groups.

Following the metadata header, at an offset defined in clusterGroupOffset, starts the first cluster group. Each cluster group contains a clustersPerGroup number of clusters. Each cluster group starts with an array of FS3_ResourceCluster structures, one for every cluster in the group. This structure contains a lock and a cluster metadata header, which has resource allocation information about the cluster. The resource data starts after the cluster metadata headers. To get to the correct resource data, you need to calculate the offset based on the cluster group, cluster and resource indices.

Parameters:

vmfs – The VMFS instance this resource file belongs to.
resource_type – The type of the resource file.
address – The file descriptor address of the resource file.
fh – A file-like object to read the resource data from.
fd – An optional file descriptor for the resource file, if available.
metadata_offset – The offset in the file where the resource metadata starts. Defaults to 0.

vmfs¶

type¶

address¶

fh¶

fd = None¶

metadata¶

debug() → str¶

Return a debug string for this resource file.

Mimicks vmkfstool -D output.

abstract parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

resolve_address(address: int) → int¶: Resolve an address to a volume address.

read(address: int) → bytes¶: Read and return the resource belonging to the given address.

class dissect.vmfs.resource.FileBlockResourceVMFS5(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

(Small) file block resource (.fbb.sf).

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

resolve_address(address: int) → int¶: Resolve a file block address to a volume address.

class dissect.vmfs.resource.SmallFileBlockResourceVMFS6(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

Small file block resource (.fbb.sf) for VMFS6.

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

resolve_address(address: int) → int¶: Resolve a small file block address to a volume address.

class dissect.vmfs.resource.SubBlockResourceVMFS5(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

Sub-block resource (.sbc.sf) for VMFS5.

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.SubBlockResourceVMFS6(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

Sub-block resource (.sbc.sf) for VMFS6.

Uses 64-bit addressing.

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.PointerBlockResourceVMFS5(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

Pointer block resource (.pbc.sf).

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.PointerBlockResourceVMFS6(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

Pointer block resource (.pbc.sf) for VMFS6.

Uses 64-bit addressing.

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.FileDescriptorResourceVMFS5(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

File descriptor resource (.fdc.sf) for VMFS5.

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.FileDescriptorResourceVMFS6(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

File descriptor resource (.fdc.sf) for VMFS6.

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.PointerBlock2ResourceVMFS5(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

Pointer block 2 resource (.pb2.sf) for VMFS5.

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.PointerBlock2ResourceVMFS6(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

Pointer block 2 resource (.pb2.sf) for VMFS6.

Uses 64-bit addressing.

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.JournalBlockResourceVMFS6(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

Journal block resource (.jbc.sf).

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.LargeFileBlockResourceVMFS6(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int, fh: BinaryIO, fd: dissect.vmfs.vmfs.FileDescriptor | None = None, metadata_offset: int = 0)¶

Bases: ResourceFile

Large file block resource (.fbb.sf).

parse_address(address: int) → tuple[int, int]¶: Parse an address into a cluster/resource pair to use for looking up a resource.

resolve_address(address: int) → int¶: Resolve a large file block address to a volume address.

dissect.vmfs.resource.RESOURCE_TYPE_MAP_VMFS5¶

dissect.vmfs.resource.RESOURCE_TYPE_MAP_VMFS6¶

dissect.vmfs.resource.RESOURCE_TYPE_ABBREVIATIONS¶

class dissect.vmfs.resource.ResourceManager(vmfs: dissect.vmfs.vmfs.VMFS)¶

Manager for VMFS resources.

Utility class for keeping track of opened resource files and providing access to them.

vmfs¶

resources¶

__repr__() → str¶

__getitem__(type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID | int) → ResourceFile¶: Get a resource file by its type.

open(type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID, address: int | None = None, fileobj: BinaryIO | None = None, metadata_offset: int = 0) → None¶

Open a resource file of the given type.

Parameters:

type – The type of the resource to open.
address – The address of the resource to open. If not provided, fileobj must be provided.
fileobj – A file-like object to read the resource from. If not provided, address must be provided.
metadata_offset – The offset in the file where the resource metadata starts. Defaults to 0. This is used for child metadata that share the same resource file.

close(type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID) → None¶

Close a resource file of the given type.

Parameters:: type – The type of the resource to close.

has(type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID) → bool¶

Check if a resource of the given type is opened.

Parameters:: type – The type of the resource to check.

get(type: dissect.vmfs.c_vmfs.FS3_ResourceTypeID | int) → ResourceFile | None¶

Get a resource file by its type.

Parameters:: type – The type of the resource to get.

read(address: int) → bytes¶

Read a resource from the given address, automatically selecting the correct resource from the address.

Parameters:: address – The address of the resource to read.

property FB: FileBlockResourceVMFS5 | SmallFileBlockResourceVMFS6¶: Get the file block resource (.fbb.sf, VMFS5).

property SFB: FileBlockResourceVMFS5 | SmallFileBlockResourceVMFS6¶: Get the small file block resource (.fbb.sf, VMFS6).

property SB: SubBlockResourceVMFS5 | SubBlockResourceVMFS6¶: Get the sub-block resource (.sbc.sf).

property PB: PointerBlockResourceVMFS5 | PointerBlockResourceVMFS6¶: Get the pointer block resource (.pbc.sf).

property FD: FileDescriptorResourceVMFS5 | FileDescriptorResourceVMFS6¶: Get the file descriptor resource (.fdc.sf).

property PB2: PointerBlock2ResourceVMFS5 | PointerBlock2ResourceVMFS6¶: Get the pointer block 2 resource (.pb2.sf).

property JB: JournalBlockResourceVMFS6¶: Get the journal block resource (.jbc.sf).

property LFB: LargeFileBlockResourceVMFS6¶: Get the large file block resource (.fbb.sf).

dissect.vmfs.resource¶

Module Contents¶

Classes¶

Attributes¶

`dissect.vmfs.resource`¶