1226048Sobrien 2226048Sobrien#------------------------------------------------------------------------------ 3362844Sdelphij# $File: virtual,v 1.12 2020/02/15 01:20:15 christos Exp $ 4226048Sobrien# From: James Nobis <quel@quelrod.net> 5226048Sobrien# Microsoft hard disk images for: 6226048Sobrien# Virtual Server 7226048Sobrien# Virtual PC 8354939Sdelphij# VirtualBox 9354939Sdelphij# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk) 10354939Sdelphij# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/ 11354939Sdelphij# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc 12226048Sobrien0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 13354939Sdelphij# alternative shorter names 14354939Sdelphij#0 string conectix Microsoft Virtual Hard Disk image 15354939Sdelphij#0 string conectix Microsoft Virtual HD image 16354939Sdelphij!:mime application/x-virtualbox-vhd 17354939Sdelphij!:ext vhd 18354939Sdelphij# Features is a bit field used to indicate specific feature support 19354939Sdelphij#>8 ubelong !0x00000002 \b, Features 0x%x 20354939Sdelphij# Reserved. This bit must always be set to 1. 21354939Sdelphij#>8 ubelong &0x00000002 \b, Reserved 0x%x 22354939Sdelphij# File Format Version for the current specification 0x00010000 23354939Sdelphij#>12 ubelong !0x00010000 \b, Version 0x%8.8x 24354939Sdelphij# Data Offset only found 0x200 25354939Sdelphij#>16 ubequad !0x200 \b, Data Offset 0x%llx 26354939Sdelphij#>16 ubequad x \b, at 0x%llx 27354939Sdelphij# Dynamic Disk Header cookie like cxsparse 28354939Sdelphij#>(16.Q) string x "%-.8s" 29354939Sdelphij# This field contains a Unicode string (UTF-16) of the parent hard disk filename 30354939Sdelphij#>(16.Q+64) ubequad x \b, parent name 0x%llx 31354939Sdelphij# Creator Application 32354939Sdelphij# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd 33354939Sdelphij>28 string x \b, Creator %-4.4s 34354939Sdelphij# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004 35354939Sdelphij# holds the major/minor version of the application that created the image 36354939Sdelphij>32 ubeshort x %x 37354939Sdelphij>34 ubeshort x \b.%x 38354939Sdelphij#>32 ubelong x \b, Version 0x%8.8x 39354939Sdelphij# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac) 40354939Sdelphij>36 ubelong x ( 41354939Sdelphij>>36 ubelong 0x5769326B \bW2k 42354939Sdelphij>>36 ubelong 0x4D616320 \bMac 43354939Sdelphij>>36 default x \b0x 44354939Sdelphij>>>36 ubelong x \b%8.8x 45354939Sdelphij# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch 46354939Sdelphij>24 bedate+946684800 x \b) %s 47354939Sdelphij# Original Size 48354939Sdelphij#>40 ubequad x \b, o.-Size 0x%llx 49354939Sdelphij# Current Size is same as original size, but change when disk is expanded 50354939Sdelphij#>48 ubequad x \b, Size 0x%llx 51354939Sdelphij>48 ubequad x \b, %llu bytes 52354939Sdelphij# Disk Geometry: cylinder, heads, and sectors/track for hard disk 53354939Sdelphij#>56 ubeshort x \b, Cylinder 0x%x 54354939Sdelphij>56 ubeshort x \b, CHS %u 55354939Sdelphij# Heads 56354939Sdelphij#>58 ubyte x \b, Heads 0x%x 57354939Sdelphij>58 ubyte x \b/%u 58354939Sdelphij# Sectors per track 59354939Sdelphij#>59 ubyte x \b, Sectors 0x%x 60354939Sdelphij>59 ubyte x \b/%u 61354939Sdelphij# Disk Type: 3~Dynamic hard disk 62354939Sdelphij>60 ubelong !0x3 \b, type 0x%x 63354939Sdelphij# Checksum 64354939Sdelphij#>64 ubelong x \b, cksum 0x%x 65354939Sdelphij# universally unique identifier (UUID) to associate a parent with its differencing image 66354939Sdelphij#>68 ubequad x \b, id 0x%16.16llx 67354939Sdelphij#>76 ubequad x \b-%16.16llx 68354939Sdelphij# Saved State: 1~Saved State 69354939Sdelphij>84 ubyte !0 \b, State 0x%x 70354939Sdelphij# Reserved 427 bytes with nils 71354939Sdelphij#>85 ubequad !0 \b, Reserved 0x%16.16llx 72226048Sobrien 73354939Sdelphij# From: Joerg Jenderek 74354939Sdelphij# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx 75354939Sdelphij# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/ 76354939Sdelphij# MS-VHDX/[MS-VHDX].pdf 77354939Sdelphij# Note: extends the VHD format with new capabilities, such as a 16TB maximum size 78354939Sdelphij# TODO: find and display values like virtual size, disk size, cluster_size, etc 79354939Sdelphij# display id in GUID format 80354939Sdelphij# 81354939Sdelphij# VHDX_FILE_IDENTIFIER signature 0x656C696678646876 82354939Sdelphij0 string vhdxfile 83354939Sdelphij# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB 84354939Sdelphij>0x10000 string head Microsoft Disk Image eXtended 85354939Sdelphij#>0x20000 string head \b, 2nd header 86354939Sdelphij#!:mime application/x-virtualbox-vhdx 87354939Sdelphij!:ext vhdx 88354939Sdelphij# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512" 89354939Sdelphij>>8 lestring16 x \b, by %.256s 90354939Sdelphij# The Checksum field is a CRC-32C hash over the entire 4 KB structure 91354939Sdelphij#>>0x10004 ulelong x \b, CRC 0x%x 92354939Sdelphij# SequenceNumber 93354939Sdelphij>>0x10008 ulequad x \b, sequence 0x%llx 94354939Sdelphij# FileWriteGuid 95354939Sdelphij#>>0x10010 ubequad x \b, file id 0x%llx 96354939Sdelphij#>>>0x10018 ubequad x \b-%llx 97354939Sdelphij# DataWriteGuid 98354939Sdelphij#>>0x10020 ubequad x \b, data id 0x%llx 99354939Sdelphij#>>>0x10028 ubequad x \b-%llx 100354939Sdelphij# LogGuid. If this field is zero, then the log is empty or has no valid entries 101354939Sdelphij>>0x10030 ubequad >0 \b, log id 0x%llx 102354939Sdelphij>>>0x10038 ubequad x \b-%llx 103354939Sdelphij# LogVersion. If not 0 there is a log to replay 104354939Sdelphij>>0x10040 uleshort >0 \b, LogVersion 0x%x 105354939Sdelphij# Version. This field must be set to 1 106354939Sdelphij>>0x10042 uleshort !1 \b, Version 0x%x 107354939Sdelphij# LogLength must be multiples of 1 MB 108354939Sdelphij>>0x10044 ulelong/1048576 >1 \b, LogLength %u MB 109354939Sdelphij# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB 110354939Sdelphij>>0x10048 ulequad !0x100000 \b, LogOffset 0x%llx 111354939Sdelphij# Log Entry Signature must be 0x65676F6C~loge 112354939Sdelphij>>(0x10048.q) ulelong !0x65676F6C \b, NO Log Signature 113354939Sdelphij>>(0x10048.q) ulelong =0x65676F6C \b; LOG 114354939Sdelphij# Log Entry Checksum 115354939Sdelphij#>>>(0x10048.q+4) ulelong x \b, Log CRC 0x%x 116354939Sdelphij# Log Entry Length must be a multiple of 4 KB 117354939Sdelphij>>>(0x10048.q+8) ulelong/1024 >4 \b, EntryLength %u KB 118354939Sdelphij# Log Entry Tail must be a multiple of 4 KB 119354939Sdelphij#>>>(0x10048.q+12) ulelong x \b, Tail 0x%x 120354939Sdelphij# Log Entry SequenceNumber 121354939Sdelphij#>>>(0x10048.q+16) ulequad x \b, # 0x%llx 122354939Sdelphij# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8 123354939Sdelphij#>>>(0x10048.q+24) ulelong x \b, DescriptorCount 0x%llx 124354939Sdelphij# Log Entry Reserved must be set to 0 125354939Sdelphij>>>(0x10048.q+28) ulelong !0 \b, Reserved 0x%x 126354939Sdelphij# Log Entry LogGuid 127354939Sdelphij#>>>(0x10048.q+32) ubequad x \b, Log id 0x%llx 128354939Sdelphij#>>>(0x10048.q+40) ubequad x \b-%llx 129354939Sdelphij# Log Entry FlushedFileOffset should VHDX size when entry is written. 130354939Sdelphij#>>>(0x10048.q+48) ulequad x \b, FlushedFileOffset %llu 131354939Sdelphij# Log Entry LastFileOffset 132354939Sdelphij#>>>(0x10048.q+56) ulequad x \b, LastFileOffset %llu 133354939Sdelphij# filling 134354939Sdelphij#>>>(0x10048.q+64) ulequad >0 \b, filling %llx 135354939Sdelphij# Reserved[4016] 136354939Sdelphij#>>0x10050 ulequad >0 \b, Reserved 0x%llx 137354939Sdelphij# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB 138354939Sdelphij>0x30000 ulelong !0x69676572 \b, 1st region INVALID 139354939Sdelphij>0x30000 ulelong =0x69676572 \b; region 140354939Sdelphij# region Checksum. CRC-32C hash over the entire 64-KB table 141354939Sdelphij#>>0x30004 ulelong x \b, CRC 0x%x 142354939Sdelphij# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047. 143354939Sdelphij>>0x30008 ulelong x \b, %u entries 144354939Sdelphij# reserved must be zero 145354939Sdelphij#>>0x3000C ulelong !0 \b, RESERVED 0x%x 146354939Sdelphij# Region Table Entry starts with identifier for the object. often BAT id 147354939Sdelphij>>0x30010 use vhdx-id 148354939Sdelphij# FileOffset 149354939Sdelphij>>0x30020 ulequad x \b, at 0x%llx 150354939Sdelphij# Length. Specifies the length of the object within the file 151354939Sdelphij#>>0x30028 ulelong x \b, Length 0x%x 152354939Sdelphij# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 153354939Sdelphij>>0x3002C ulelong x \b, Required %u 154354939Sdelphij# 2nd region entry often metadata id 155354939Sdelphij>>0x30030 use vhdx-id 156354939Sdelphij# 2nd entry FileOffset 157354939Sdelphij>>0x30040 ulequad x \b, at 0x%llx 158354939Sdelphij# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 159354939Sdelphij>>0x3004C ulelong x \b, Required %u 160354939Sdelphij# 2nd region 161354939Sdelphij>>0x40000 ulelong !0x69676572 \b, 2nd region INVALID 162354939Sdelphij# check in vhdx images for known id and show names instead hexadecimal 163354939Sdelphij0 name vhdx-id 164354939Sdelphij# https://www.windowstricks.in/online-windows-guid-converter 165354939Sdelphij# 2DC27766-F623-4200-9D64-115E9BFD4A08 BAT GUID 166354939Sdelphij# 6677C22D23F600429D64115E9BFD4A08 BAT ID 167354939Sdelphij>0 ubequad =0x6677C22D23F60042 168354939Sdelphij>>8 ubequad =0x9D64115E9BFD4A08 \b, id BAT 169354939Sdelphij# no BAT id 170354939Sdelphij>>8 default x 171354939Sdelphij>>>0 use vhdx-id-hex 172354939Sdelphij# 8B7CA206-4790-4B9A-B8FE-575F050F886E Metadata region GUID 173354939Sdelphij# 06A27C8B90479A4BB8FE575F050F886E Metadata region ID 174354939Sdelphij>0 ubequad =0x06A27C8B90479A4B 175354939Sdelphij>>8 ubequad =0xB8FE575F050F886E \b, id Metadata 176354939Sdelphij# no Metadata id 177354939Sdelphij>>8 default x 178354939Sdelphij>>>0 use vhdx-id-hex 179354939Sdelphij# 2FA54224-CD1B-4876-B211-5DBED83BF4B8 Virtual Disk Size GUID 180354939Sdelphij# 2442A52F1BCD7648B2115DBED83BF4B8 Virtual Disk Size ID 181354939Sdelphij# value "virtual size" can be verified by command `qemu-img info ` 182354939Sdelphij>0 ubequad =0x2442A52F1BCD7648 183354939Sdelphij>>8 ubequad =0xB2115DBED83BF4B8 \b, id vsize 184354939Sdelphij# no Virtual Disk Size ID 185354939Sdelphij>>8 default x 186354939Sdelphij>>>0 use vhdx-id-hex 187354939Sdelphij# other ids 188354939Sdelphij>0 default x 189354939Sdelphij>>0 use vhdx-id-hex 190354939Sdelphij# in vhdx images show id as hexadecimal 191354939Sdelphij0 name vhdx-id-hex 192354939Sdelphij>0 ubequad x \b, ID 0x%16.16llx 193354939Sdelphij>8 ubequad x \b-%16.16llx 194354939Sdelphij# 195267843Sdelphij# libvirt 196267843Sdelphij# From: Philipp Hahn <hahn@univention.de> 197267843Sdelphij0 string LibvirtQemudSave Libvirt QEMU Suspend Image 198267843Sdelphij>0x10 lelong x \b, version %u 199267843Sdelphij>0x14 lelong x \b, XML length %u 200267843Sdelphij>0x18 lelong 1 \b, running 201267843Sdelphij>0x1c lelong 1 \b, compressed 202267843Sdelphij 203267843Sdelphij0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 204267843Sdelphij# From: Alex Beregszaszi <alex@fsn.hu> 205267843Sdelphij0 string/b COWD VMWare3 206267843Sdelphij>4 byte 3 disk image 207267843Sdelphij>>32 lelong x (%d/ 208267843Sdelphij>>36 lelong x \b%d/ 209267843Sdelphij>>40 lelong x \b%d) 210267843Sdelphij>4 byte 2 undoable disk image 211267843Sdelphij>>32 string >\0 (%s) 212267843Sdelphij 213267843Sdelphij0 string/b VMDK VMware4 disk image 214267843Sdelphij0 string/b KDMV VMware4 disk image 215267843Sdelphij 216267843Sdelphij#-------------------------------------------------------------------- 217267843Sdelphij# Qemu Emulator Images 218267843Sdelphij# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 219267843Sdelphij# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 220267843Sdelphij# Made by reading sources, reading documentation, and doing trial and error 221267843Sdelphij# on existing QCOW files 222354939Sdelphij0 string/b QFI\xFB 223267843Sdelphij 224267843Sdelphij# Uncomment the following line to display Magic (only used for debugging 225267843Sdelphij# this magic number) 226267843Sdelphij#>0 string/b x , Magic: %s 227267843Sdelphij 228267843Sdelphij# There are currently 2 Versions: "1" and "2". 229354939Sdelphij# https://www.gnome.org/~markmc/qcow-image-format-version-1.html 230354939Sdelphij>4 belong !1 QEMU QCOW2 Image 231354939Sdelphij>4 belong 1 QEMU QCOW Image (v1) 232267843Sdelphij 233267843Sdelphij# Using the existence of the Backing File Offset to determine whether 234267843Sdelphij# to read Backing File Information 235267843Sdelphij>>12 belong >0 \b, has backing file ( 236267843Sdelphij# Note that this isn't a null-terminated string; the length is actually 237267843Sdelphij# (16.L). Assuming a null-terminated string happens to work usually, but it 238267843Sdelphij# may spew junk until it reaches a \0 in some cases. 239267843Sdelphij>>>(12.L) string >\0 \bpath %s 240267843Sdelphij 241267843Sdelphij# Modification time of the Backing File 242267843Sdelphij# Really useful if you want to know if your backing 243267843Sdelphij# file is still usable together with this image 244267843Sdelphij>>>>20 bedate >0 \b, mtime %s) 245267843Sdelphij>>>>20 default x \b) 246267843Sdelphij 247267843Sdelphij# Size is stored in bytes in a big-endian u64. 248267843Sdelphij>>24 bequad x \b, %lld bytes 249267843Sdelphij 250267843Sdelphij# 1 for AES encryption, 0 for none. 251267843Sdelphij>>36 belong 1 \b, AES-encrypted 252267843Sdelphij 253354939Sdelphij# https://www.gnome.org/~markmc/qcow-image-format.html 254267843Sdelphij>4 belong 2 (v2) 255267843Sdelphij# Using the existence of the Backing File Offset to determine whether 256267843Sdelphij# to read Backing File Information 257267843Sdelphij>>8 bequad >0 \b, has backing file 258267843Sdelphij# Note that this isn't a null-terminated string; the length is actually 259267843Sdelphij# (16.L). Assuming a null-terminated string happens to work usually, but it 260267843Sdelphij# may spew junk until it reaches a \0 in some cases. Also, since there's no 261267843Sdelphij# .Q modifier, we just use the bottom four bytes as an offset. Note that if 262267843Sdelphij# the file is over 4G, and the backing file path is stored after the first 4G, 263267843Sdelphij# the wrong filename will be printed. (This should be (8.Q), when that syntax 264267843Sdelphij# is introduced.) 265267843Sdelphij>>>(12.L) string >\0 (path %s) 266267843Sdelphij>>24 bequad x \b, %lld bytes 267267843Sdelphij>>32 belong 1 \b, AES-encrypted 268267843Sdelphij 269267843Sdelphij>4 belong 3 (v3) 270267843Sdelphij# Using the existence of the Backing File Offset to determine whether 271267843Sdelphij# to read Backing File Information 272267843Sdelphij>>8 bequad >0 \b, has backing file 273267843Sdelphij# Note that this isn't a null-terminated string; the length is actually 274267843Sdelphij# (16.L). Assuming a null-terminated string happens to work usually, but it 275267843Sdelphij# may spew junk until it reaches a \0 in some cases. Also, since there's no 276267843Sdelphij# .Q modifier, we just use the bottom four bytes as an offset. Note that if 277267843Sdelphij# the file is over 4G, and the backing file path is stored after the first 4G, 278267843Sdelphij# the wrong filename will be printed. (This should be (8.Q), when that syntax 279267843Sdelphij# is introduced.) 280267843Sdelphij>>>(12.L) string >\0 (path %s) 281267843Sdelphij>>24 bequad x \b, %lld bytes 282267843Sdelphij>>32 belong 1 \b, AES-encrypted 283267843Sdelphij 284267843Sdelphij>4 default x (unknown version) 285267843Sdelphij 286267843Sdelphij0 string/b QEVM QEMU suspend to disk image 287267843Sdelphij 288267843Sdelphij# QEMU QED Image 289354939Sdelphij# https://wiki.qemu.org/Features/QED/Specification 290267843Sdelphij0 string/b QED\0 QEMU QED Image 291267843Sdelphij 292267843Sdelphij# VDI Image 293226048Sobrien# Sun xVM VirtualBox Disk Image 294234250Sobrien# From: Richard W.M. Jones <rich@annexia.org> 295234250Sobrien# VirtualBox Disk Image 296234250Sobrien0x40 ulelong 0xbeda107f VirtualBox Disk Image 297234250Sobrien>0x44 uleshort >0 \b, major %u 298234250Sobrien>0x46 uleshort >0 \b, minor %u 299267843Sdelphij>0 string >\0 (%s) 300267843Sdelphij>368 lequad x \b, %lld bytes 301267843Sdelphij 302267843Sdelphij0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 303267843Sdelphij>32 string x type %s, 304267843Sdelphij>48 string x subtype %s 305267843Sdelphij 306267843Sdelphij0 lelong 0x02468ace Bochs Sparse disk image 307267843Sdelphij 308