:py:mod:`dissect.vmfs.resource` =============================== .. py:module:: dissect.vmfs.resource Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.vmfs.resource.ResourceManager dissect.vmfs.resource.ResourceFile dissect.vmfs.resource.SmallFileBlockResource dissect.vmfs.resource.SubBlockResource dissect.vmfs.resource.PointerBlockResource dissect.vmfs.resource.FileDescriptorResource dissect.vmfs.resource.JournalBlockResource dissect.vmfs.resource.LargeFileBlockResource Functions ~~~~~~~~~ .. autoapisummary:: :nosignatures: dissect.vmfs.resource.address_type dissect.vmfs.resource.address_fmt dissect.vmfs.resource.address_tbz dissect.vmfs.resource.parse_fb_address dissect.vmfs.resource.parse_sfb_address dissect.vmfs.resource.parse_sb_address dissect.vmfs.resource.parse_pb_address dissect.vmfs.resource.parse_fd_address dissect.vmfs.resource.parse_jb_address dissect.vmfs.resource.parse_lfb_address Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.vmfs.resource.RESOURCE_TYPE_MAP .. py:function:: address_type(addr) Return the address type. Address type is encoded in the lower 3 bits. .. py:function:: address_fmt(vmfs, address) Create a human readable representation of an address. References: - Addr3_AddrToStr and similar .. py:function:: address_tbz(vmfs, address) Return whether the TBZ flag is set. The TBZ flag is only valid for FB and LFB addresses. .. py:function:: parse_fb_address(vmfs, address) Parse a FB address and return the block. VMFS5 encoding: 0b11111111 11111111 11111111 11000000 .. py:function:: parse_sfb_address(vmfs, address) Parse a SFB address and return the cluster and resource. SFB (small file block) in VMFS6 is what FB was in VMFS5. VMFS6 encoding: 0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (cluster) 0b11111111 11111000 00000000 00000000 00000000 00000000 00000000 00000000 (resource) .. py:function:: parse_sb_address(vmfs, address) Parse a SB address and return the cluster and resource. VMFS5 encoding: 0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource) 0b00000000 00000000 00000000 00011000 (resource if config flag set, << 4) VMFS6 encoding: 0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource) .. py:function:: parse_pb_address(vmfs, address) Parse a PB address and return the cluster and resource. Encoding: 0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource) VMFS6 encoding: 0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource) .. py:function:: parse_fd_address(vmfs, address) Parse a FD address and return the cluster and resource. Encoding: 0b00000000 00111111 11111111 11000000 (cluster) 0b11111111 11000000 00000000 00000000 (resource) .. py:function:: parse_jb_address(vmfs, address) Parse a JB address and return the cluster and resource. Encoding: 0b11111100 00000000 00000000 00000000 (cluster) 0b00000000 00000000 11111111 11111000 (resource) .. py:function:: parse_lfb_address(vmfs, address) Parse a LFB address and return the block. Encoding: 0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (block) .. py:class:: ResourceManager(vmfs) .. py:property:: fdc .. py:property:: pb2 .. py:property:: pbc .. py:property:: sbc .. py:property:: fbb .. py:property:: lfb .. py:property:: jbc .. py:method:: open(resource_type, address=None, fileobj=None) .. py:method:: get(address) .. py:method:: get_resource(resource_type, cluster, resource) .. py:method:: parse_address(address) .. py:method:: resolve_address(address) .. py:class:: ResourceFile(vmfs, resource_type, address, fh) VMFS resource file implementation. Resource files of different types need different interpretation of the resource data. Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters ("bitmaps"), followed by the actual resource items. .. py:property:: resource_size .. py:method:: iter_resource_locations() .. py:method:: parse_address(address) :abstractmethod: Parse an address into a cluster/resource pair to use for looking up a resource. .. py:method:: get(address) Get the resource belonging to the given address. .. py:method:: get_resource(cluster, resource) Get the resource belonging to the given cluster/resource pair. .. py:class:: SmallFileBlockResource(vmfs, resource_type, address, fh) Bases: :py:obj:`ResourceFile` VMFS resource file implementation. Resource files of different types need different interpretation of the resource data. Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters ("bitmaps"), followed by the actual resource items. .. py:method:: parse_address(address) Parse an address into a cluster/resource pair to use for looking up a resource. .. py:class:: SubBlockResource(vmfs, resource_type, address, fh) Bases: :py:obj:`ResourceFile` VMFS resource file implementation. Resource files of different types need different interpretation of the resource data. Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters ("bitmaps"), followed by the actual resource items. .. py:method:: parse_address(address) Parse an address into a cluster/resource pair to use for looking up a resource. .. py:class:: PointerBlockResource(vmfs, resource_type, address, fh) Bases: :py:obj:`ResourceFile` VMFS resource file implementation. Resource files of different types need different interpretation of the resource data. Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters ("bitmaps"), followed by the actual resource items. .. py:method:: parse_address(address) Parse an address into a cluster/resource pair to use for looking up a resource. .. py:class:: FileDescriptorResource(vmfs, resource_type, address, fh) Bases: :py:obj:`ResourceFile` VMFS resource file implementation. Resource files of different types need different interpretation of the resource data. Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters ("bitmaps"), followed by the actual resource items. .. py:method:: parse_address(address) Parse an address into a cluster/resource pair to use for looking up a resource. .. py:class:: JournalBlockResource(vmfs, resource_type, address, fh) Bases: :py:obj:`ResourceFile` VMFS resource file implementation. Resource files of different types need different interpretation of the resource data. Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters ("bitmaps"), followed by the actual resource items. .. py:method:: parse_address(address) Parse an address into a cluster/resource pair to use for looking up a resource. .. py:class:: LargeFileBlockResource(vmfs, resource_type, address, fh) Bases: :py:obj:`ResourceFile` VMFS resource file implementation. Resource files of different types need different interpretation of the resource data. Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters ("bitmaps"), followed by the actual resource items. .. py:method:: parse_address(address) Parse an address into a cluster/resource pair to use for looking up a resource. .. py:data:: RESOURCE_TYPE_MAP