dissect.vmfs.resource
¶
Module Contents¶
Classes¶
VMFS resource file implementation. |
|
VMFS resource file implementation. |
|
VMFS resource file implementation. |
|
VMFS resource file implementation. |
|
VMFS resource file implementation. |
|
VMFS resource file implementation. |
|
VMFS resource file implementation. |
Functions¶
Return the address type. |
|
Create a human readable representation of an address. |
|
Return whether the TBZ flag is set. |
|
Parse a FB address and return the block. |
|
Parse a SFB address and return the cluster and resource. |
|
Parse a SB address and return the cluster and resource. |
|
Parse a PB address and return the cluster and resource. |
|
Parse a FD address and return the cluster and resource. |
|
Parse a JB address and return the cluster and resource. |
|
Parse a LFB address and return the block. |
Attributes¶
- dissect.vmfs.resource.address_type(addr: int) int ¶
Return the address type.
Address type is encoded in the lower 3 bits.
- dissect.vmfs.resource.address_fmt(vmfs: dissect.vmfs.vmfs.VMFS, address: int) str ¶
Create a human readable representation of an address.
References: - Addr3_AddrToStr and similar
- dissect.vmfs.resource.address_tbz(vmfs: dissect.vmfs.vmfs.VMFS, address: int) int | None ¶
Return whether the TBZ flag is set.
The TBZ flag is only valid for FB and LFB addresses.
- dissect.vmfs.resource.parse_fb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) int ¶
Parse a FB address and return the block.
- VMFS5 encoding:
0b11111111 11111111 11111111 11000000
- dissect.vmfs.resource.parse_sfb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) tuple[int, int] ¶
Parse a SFB address and return the cluster and resource.
SFB (small file block) in VMFS6 is what FB was in VMFS5.
- VMFS6 encoding:
0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (cluster) 0b11111111 11111000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)
- dissect.vmfs.resource.parse_sb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) tuple[int, int] ¶
Parse a SB address and return the cluster and resource.
- VMFS5 encoding:
0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource) 0b00000000 00000000 00000000 00011000 (resource if config flag set, << 4)
- VMFS6 encoding:
0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)
- dissect.vmfs.resource.parse_pb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) tuple[int, int] ¶
Parse a PB address and return the cluster and resource.
- Encoding:
0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource)
- VMFS6 encoding:
0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)
- dissect.vmfs.resource.parse_fd_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) tuple[int, int] ¶
Parse a FD address and return the cluster and resource.
- Encoding:
0b00000000 00111111 11111111 11000000 (cluster) 0b11111111 11000000 00000000 00000000 (resource)
- dissect.vmfs.resource.parse_jb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) tuple[int, int] ¶
Parse a JB address and return the cluster and resource.
- Encoding:
0b11111100 00000000 00000000 00000000 (cluster) 0b00000000 00000000 11111111 11111000 (resource)
- dissect.vmfs.resource.parse_lfb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) int ¶
Parse a LFB address and return the block.
- Encoding:
0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (block)
- class dissect.vmfs.resource.ResourceManager(vmfs: dissect.vmfs.vmfs.VMFS)¶
- vmfs¶
- resources¶
- open(resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int | None = None, fileobj: BinaryIO | None = None) None ¶
- parse_address(address: int) tuple[int, int] ¶
- property fdc: FileDescriptorResource¶
- property pb2: PointerBlockResource¶
- property pbc: PointerBlockResource¶
- property sbc: SubBlockResource¶
- property fbb: SmallFileBlockResource¶
- property lfb: LargeFileBlockResource¶
- property jbc: JournalBlockResource¶
- class dissect.vmfs.resource.ResourceFile(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)¶
VMFS resource file implementation.
Resource files of different types need different interpretation of the resource data.
Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.
- vmfs¶
- type¶
- address¶
- fh¶
- metadata¶
- iter_resource_locations() collections.abc.Iterator[tuple[int, int]] ¶
- property resource_size: int¶
- abstract parse_address(address: int) tuple[int, int] ¶
Parse an address into a cluster/resource pair to use for looking up a resource.
- class dissect.vmfs.resource.SmallFileBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)¶
Bases:
ResourceFile
VMFS resource file implementation.
Resource files of different types need different interpretation of the resource data.
Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.
- parse_address(address: int) tuple[int, int] ¶
Parse an address into a cluster/resource pair to use for looking up a resource.
- class dissect.vmfs.resource.SubBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)¶
Bases:
ResourceFile
VMFS resource file implementation.
Resource files of different types need different interpretation of the resource data.
Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.
- parse_address(address: int) tuple[int, int] ¶
Parse an address into a cluster/resource pair to use for looking up a resource.
- class dissect.vmfs.resource.PointerBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)¶
Bases:
ResourceFile
VMFS resource file implementation.
Resource files of different types need different interpretation of the resource data.
Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.
- parse_address(address: int) tuple[int, int] ¶
Parse an address into a cluster/resource pair to use for looking up a resource.
- class dissect.vmfs.resource.FileDescriptorResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)¶
Bases:
ResourceFile
VMFS resource file implementation.
Resource files of different types need different interpretation of the resource data.
Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.
- parse_address(address: int) tuple[int, int] ¶
Parse an address into a cluster/resource pair to use for looking up a resource.
- class dissect.vmfs.resource.JournalBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)¶
Bases:
ResourceFile
VMFS resource file implementation.
Resource files of different types need different interpretation of the resource data.
Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.
- parse_address(address: int) tuple[int, int] ¶
Parse an address into a cluster/resource pair to use for looking up a resource.
- class dissect.vmfs.resource.LargeFileBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)¶
Bases:
ResourceFile
VMFS resource file implementation.
Resource files of different types need different interpretation of the resource data.
Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.
- parse_address(address: int) tuple[int, int] ¶
Parse an address into a cluster/resource pair to use for looking up a resource.
- dissect.vmfs.resource.RESOURCE_TYPE_MAP¶