`dissect.hypervisor.disk.qcow2`¶

Module Contents¶

Classes¶

`QCow2`	QCOW2 virtual disk implementation.
`L2Table`	Convenience class for accessing the L2 table.
`QCow2Snapshot`	Wrapper class for snapshot table entries.

Functions¶

`offset_into_cluster`
`offset_into_subcluster`
`size_to_clusters`
`size_to_subclusters`
`offset_to_l1_index`
`offset_to_l2_index`
`offset_to_sc_index`
`get_cluster_type`
`get_subcluster_type`
`get_subcluster_range_type`
`count_contiguous_subclusters`

Attributes¶

`HAS_ZSTD`
`ALLOW_NO_BACKING_FILE`

dissect.hypervisor.disk.qcow2.HAS_ZSTD = True¶

dissect.hypervisor.disk.qcow2.ALLOW_NO_BACKING_FILE = 1¶

class dissect.hypervisor.disk.qcow2.QCow2(fh: BinaryIO, data_file: BinaryIO | None = None, backing_file: BinaryIO | int | None = None)¶

Bases: dissect.util.stream.AlignedStream

QCOW2 virtual disk implementation.

Supports both data-file and backing-file, but must be manually given as arguments.

If a data-file is required, it’s required to manually pass a file like object as the data_file argument.

A backing-file can optionally be skipped if qcow2.ALLOW_NO_BACKING_FILE is passed as the backing_file argument. In this case, any reads from a backing file will result in all null bytes being read.

fh¶

header¶

cluster_bits¶

cluster_size¶

subclusters_per_cluster¶

subcluster_size¶

subcluster_bits¶

l2_bits¶

l2_size¶

csize_shift¶

csize_mask¶

cluster_offset_mask¶

backing_format = None¶

feature_table = None¶

crypto_header = None¶

bitmap_header = None¶

image_data_file = None¶

unknown_extensions = []¶

backing_file = None¶

auto_backing_file = None¶

image_backing_file = None¶

l2_table¶

property snapshots: list[QCow2Snapshot]¶

property l1_table: list[int]¶

property has_backing_file: bool¶

property has_data_file: bool¶

property has_subclusters: bool¶

class dissect.hypervisor.disk.qcow2.L2Table(qcow2: QCow2, offset: int)¶

Convenience class for accessing the L2 table.

qcow2¶

offset¶

entry(idx: int) → int¶

bitmap(idx: int) → int¶

class dissect.hypervisor.disk.qcow2.QCow2Snapshot(qcow2: QCow2, offset: int)¶

Wrapper class for snapshot table entries.

qcow2¶

offset¶

header¶

extra¶

unknown_extra¶

id_str¶

name¶

entry_size¶

open() → QCow2¶

property l1_table: list[int]¶

dissect.hypervisor.disk.qcow2.offset_into_cluster(qcow2: QCow2, offset: int) → int¶

dissect.hypervisor.disk.qcow2.offset_into_subcluster(qcow2: QCow2, offset: int) → int¶

dissect.hypervisor.disk.qcow2.size_to_clusters(qcow2: QCow2, size: int) → int¶

dissect.hypervisor.disk.qcow2.size_to_subclusters(qcow2: QCow2, size: int) → int¶

dissect.hypervisor.disk.qcow2.offset_to_l1_index(qcow2: QCow2, offset: int) → int¶

dissect.hypervisor.disk.qcow2.offset_to_l2_index(qcow2: QCow2, offset: int) → int¶

dissect.hypervisor.disk.qcow2.offset_to_sc_index(qcow2: QCow2, offset: int) → int¶

dissect.hypervisor.disk.qcow2.get_cluster_type(qcow2: QCow2, l2_entry: int) → dissect.hypervisor.disk.c_qcow2.QCow2ClusterType¶

dissect.hypervisor.disk.qcow2.get_subcluster_type(qcow2: QCow2, l2_entry: int, l2_bitmap: int, sc_index: int) → dissect.hypervisor.disk.c_qcow2.QCow2SubclusterType¶

dissect.hypervisor.disk.qcow2.get_subcluster_range_type(qcow2: QCow2, l2_entry: int, l2_bitmap: int, sc_from: int) → tuple[dissect.hypervisor.disk.c_qcow2.QCow2SubclusterType, int]¶

dissect.hypervisor.disk.qcow2.count_contiguous_subclusters(qcow2: QCow2, nb_clusters: int, sc_index: int, l2_table: L2Table, l2_index: int) → int¶

dissect.hypervisor.disk.qcow2¶

Module Contents¶

Classes¶

Functions¶

Attributes¶

`dissect.hypervisor.disk.qcow2`¶