dissect.vmfs.resource

Module Contents

Classes

ResourceManager
ResourceFile	VMFS resource file implementation.
SmallFileBlockResource	VMFS resource file implementation.
SubBlockResource	VMFS resource file implementation.
PointerBlockResource	VMFS resource file implementation.
FileDescriptorResource	VMFS resource file implementation.
JournalBlockResource	VMFS resource file implementation.
LargeFileBlockResource	VMFS resource file implementation.

Functions

address_type	Return the address type.
address_fmt	Create a human readable representation of an address.
address_tbz	Return whether the TBZ flag is set.
parse_fb_address	Parse a FB address and return the block.
parse_sfb_address	Parse a SFB address and return the cluster and resource.
parse_sb_address	Parse a SB address and return the cluster and resource.
parse_pb_address	Parse a PB address and return the cluster and resource.
parse_fd_address	Parse a FD address and return the cluster and resource.
parse_jb_address	Parse a JB address and return the cluster and resource.
parse_lfb_address	Parse a LFB address and return the block.

Attributes

RESOURCE_TYPE_MAP

dissect.vmfs.resource.address_type(addr: int) → int

Return the address type.

Address type is encoded in the lower 3 bits.

dissect.vmfs.resource.address_fmt(vmfs: dissect.vmfs.vmfs.VMFS, address: int) → str

Create a human readable representation of an address.

References: - Addr3_AddrToStr and similar

dissect.vmfs.resource.address_tbz(vmfs: dissect.vmfs.vmfs.VMFS, address: int) → int | None

Return whether the TBZ flag is set.

The TBZ flag is only valid for FB and LFB addresses.

dissect.vmfs.resource.parse_fb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) → int

Parse a FB address and return the block.

VMFS5 encoding:

0b11111111 11111111 11111111 11000000

dissect.vmfs.resource.parse_sfb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) → tuple[int, int]

Parse a SFB address and return the cluster and resource.

SFB (small file block) in VMFS6 is what FB was in VMFS5.

VMFS6 encoding:

0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (cluster) 0b11111111 11111000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_sb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) → tuple[int, int]

Parse a SB address and return the cluster and resource.

VMFS5 encoding:

0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource) 0b00000000 00000000 00000000 00011000 (resource if config flag set, << 4)

VMFS6 encoding:

0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_pb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) → tuple[int, int]

Parse a PB address and return the cluster and resource.

Encoding:

0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource)

VMFS6 encoding:

0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_fd_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) → tuple[int, int]

Parse a FD address and return the cluster and resource.

Encoding:

0b00000000 00111111 11111111 11000000 (cluster) 0b11111111 11000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_jb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) → tuple[int, int]

Parse a JB address and return the cluster and resource.

Encoding:

0b11111100 00000000 00000000 00000000 (cluster) 0b00000000 00000000 11111111 11111000 (resource)

dissect.vmfs.resource.parse_lfb_address(vmfs: dissect.vmfs.vmfs.VMFS, address: int) → int

Parse a LFB address and return the block.

Encoding:

0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (block)

class dissect.vmfs.resource.ResourceManager(vmfs: dissect.vmfs.vmfs.VMFS)

vmfs

resources

open(resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int | None = None, fileobj: BinaryIO | None = None) → None

get(address: int) → bytes

get_resource(resource_type: dissect.vmfs.c_vmfs.ResourceType, cluster: int, resource: int) → bytes

parse_address(address: int) → tuple[int, int]

property fdc: FileDescriptorResource

property pb2: PointerBlockResource

property pbc: PointerBlockResource

property sbc: SubBlockResource

property fbb: SmallFileBlockResource

property lfb: LargeFileBlockResource

property jbc: JournalBlockResource

class dissect.vmfs.resource.ResourceFile(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

vmfs

type

address

fh

metadata

iter_resource_locations() → collections.abc.Iterator[tuple[int, int]]

property resource_size: int

abstract parse_address(address: int) → tuple[int, int]

Parse an address into a cluster/resource pair to use for looking up a resource.

get(address: int) → bytes

Get the resource belonging to the given address.

get_resource(cluster: int, resource: int) → bytes

Get the resource belonging to the given cluster/resource pair.

class dissect.vmfs.resource.SmallFileBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address: int) → tuple[int, int]

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.SubBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address: int) → tuple[int, int]

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.PointerBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address: int) → tuple[int, int]

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.FileDescriptorResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address: int) → tuple[int, int]

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.JournalBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address: int) → tuple[int, int]

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.LargeFileBlockResource(vmfs: dissect.vmfs.vmfs.VMFS, resource_type: dissect.vmfs.c_vmfs.ResourceType, address: int, fh: BinaryIO)

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address: int) → tuple[int, int]

Parse an address into a cluster/resource pair to use for looking up a resource.

dissect.vmfs.resource.RESOURCE_TYPE_MAP