dissect.hypervisor.disk.vhd

Module Contents

Classes

VHD

Basic buffered stream that provides aligned reads.

Disk

FixedDisk

DynamicDisk

BlockAllocationTable

Implementation of the BAT.

Functions

read_footer

class dissect.hypervisor.disk.vhd.VHD(fh: BinaryIO)

Bases: dissect.util.stream.AlignedStream

Basic buffered stream that provides aligned reads.

Must be subclassed for various stream implementations. Subclasses can implement:

  • _read()

  • _seek()

The offset and length for _read are guaranteed to be aligned for streams of a known size. If your stream has an unknown size (i.e. size == None), reads of length -1 (i.e. read until EOF) will be passed through to your implementation of _read. The only time that overriding _seek would make sense is if there’s no known size of your stream, but still want to provide SEEK_END functionality.

Most subclasses of AlignedStream take one or more file-like objects as source. Operations on these subclasses, like reading, will modify the source file-like object as a side effect.

Parameters:

  • size – The size of the stream. This is used in read and seek operations. None if unknown.

  • align – The alignment size. Read operations are aligned on this boundary. Also determines buffer size.

_read(offset: int, length: int) → bytes

Read method that backs this aligned stream.

_seek(pos: int, whence: int = 0) → int

Calculate and return the new stream position after a seek.

fh
class dissect.hypervisor.disk.vhd.Disk(fh: BinaryIO, footer: dissect.hypervisor.disk.c_vhd.c_vhd.footer | None = None)
fh
footer
size
abstract read_sectors(sector: int, count: int) → bytes
class dissect.hypervisor.disk.vhd.FixedDisk(fh: BinaryIO, footer: dissect.hypervisor.disk.c_vhd.c_vhd.footer | None = None)

Bases: Disk

read_sectors(sector: int, count: int) → bytes
class dissect.hypervisor.disk.vhd.DynamicDisk(fh: BinaryIO, footer: dissect.hypervisor.disk.c_vhd.c_vhd.footer | None = None)

Bases: Disk

header
bat
read_sectors(sector: int, count: int) → bytes
class dissect.hypervisor.disk.vhd.BlockAllocationTable(fh: BinaryIO, offset: int, max_entries: int)

Implementation of the BAT.

Entries are uint32 sector offsets to blocks in the file.

ENTRY
fh
offset
max_entries
get
__getitem__(block: int) → int | None