dissect.vmfs.resource

Module Contents

Classes

ResourceManager
ResourceFile	VMFS resource file implementation.
SmallFileBlockResource	VMFS resource file implementation.
SubBlockResource	VMFS resource file implementation.
PointerBlockResource	VMFS resource file implementation.
FileDescriptorResource	VMFS resource file implementation.
JournalBlockResource	VMFS resource file implementation.
LargeFileBlockResource	VMFS resource file implementation.

Functions

address_type	Return the address type.
address_fmt	Create a human readable representation of an address.
address_tbz	Return whether the TBZ flag is set.
parse_fb_address	Parse a FB address and return the block.
parse_sfb_address	Parse a SFB address and return the cluster and resource.
parse_sb_address	Parse a SB address and return the cluster and resource.
parse_pb_address	Parse a PB address and return the cluster and resource.
parse_fd_address	Parse a FD address and return the cluster and resource.
parse_jb_address	Parse a JB address and return the cluster and resource.
parse_lfb_address	Parse a LFB address and return the block.

Attributes

RESOURCE_TYPE_MAP

dissect.vmfs.resource.address_type(addr)

Return the address type.

Address type is encoded in the lower 3 bits.

dissect.vmfs.resource.address_fmt(vmfs, address)

Create a human readable representation of an address.

References: - Addr3_AddrToStr and similar

dissect.vmfs.resource.address_tbz(vmfs, address)

Return whether the TBZ flag is set.

The TBZ flag is only valid for FB and LFB addresses.

dissect.vmfs.resource.parse_fb_address(vmfs, address)

Parse a FB address and return the block.

VMFS5 encoding:

0b11111111 11111111 11111111 11000000

dissect.vmfs.resource.parse_sfb_address(vmfs, address)

Parse a SFB address and return the cluster and resource.

SFB (small file block) in VMFS6 is what FB was in VMFS5.

VMFS6 encoding:

0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (cluster) 0b11111111 11111000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_sb_address(vmfs, address)

Parse a SB address and return the cluster and resource.

VMFS5 encoding:

0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource) 0b00000000 00000000 00000000 00011000 (resource if config flag set, << 4)

VMFS6 encoding:

0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_pb_address(vmfs, address)

Parse a PB address and return the cluster and resource.

Encoding:

0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource)

VMFS6 encoding:

0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_fd_address(vmfs, address)

Parse a FD address and return the cluster and resource.

Encoding:

0b00000000 00111111 11111111 11000000 (cluster) 0b11111111 11000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_jb_address(vmfs, address)

Parse a JB address and return the cluster and resource.

Encoding:

0b11111100 00000000 00000000 00000000 (cluster) 0b00000000 00000000 11111111 11111000 (resource)

dissect.vmfs.resource.parse_lfb_address(vmfs, address)

Parse a LFB address and return the block.

Encoding:

0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (block)

class dissect.vmfs.resource.ResourceManager(vmfs)

property fdc

property pb2

property pbc

property sbc

property fbb

property lfb

property jbc

open(resource_type, address=None, fileobj=None)

get(address)

get_resource(resource_type, cluster, resource)

parse_address(address)

resolve_address(address)

class dissect.vmfs.resource.ResourceFile(vmfs, resource_type, address, fh)

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

property resource_size

iter_resource_locations()

abstract parse_address(address)

Parse an address into a cluster/resource pair to use for looking up a resource.

get(address)

Get the resource belonging to the given address.

get_resource(cluster, resource)

Get the resource belonging to the given cluster/resource pair.

class dissect.vmfs.resource.SmallFileBlockResource(vmfs, resource_type, address, fh)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.SubBlockResource(vmfs, resource_type, address, fh)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.PointerBlockResource(vmfs, resource_type, address, fh)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.FileDescriptorResource(vmfs, resource_type, address, fh)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.JournalBlockResource(vmfs, resource_type, address, fh)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.LargeFileBlockResource(vmfs, resource_type, address, fh)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)

Parse an address into a cluster/resource pair to use for looking up a resource.

dissect.vmfs.resource.RESOURCE_TYPE_MAP