1284194Sdelphij 2284194Sdelphij#------------------------------------------------------------------------------ 3284194Sdelphij# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $ 4284194Sdelphij# From: James Nobis <quel@quelrod.net> 5284194Sdelphij# Microsoft hard disk images for: 6284194Sdelphij# Virtual Server 7284194Sdelphij# Virtual PC 8284194Sdelphij# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx 9284194Sdelphij# .vhd 10284194Sdelphij0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 11284194Sdelphij 12284194Sdelphij# libvirt 13284194Sdelphij# From: Philipp Hahn <hahn@univention.de> 14284194Sdelphij0 string LibvirtQemudSave Libvirt QEMU Suspend Image 15284194Sdelphij>0x10 lelong x \b, version %u 16284194Sdelphij>0x14 lelong x \b, XML length %u 17284194Sdelphij>0x18 lelong 1 \b, running 18284194Sdelphij>0x1c lelong 1 \b, compressed 19284194Sdelphij 20284194Sdelphij0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 21284194Sdelphij# From: Alex Beregszaszi <alex@fsn.hu> 22284194Sdelphij0 string/b COWD VMWare3 23284194Sdelphij>4 byte 3 disk image 24284194Sdelphij>>32 lelong x (%d/ 25284194Sdelphij>>36 lelong x \b%d/ 26284194Sdelphij>>40 lelong x \b%d) 27284194Sdelphij>4 byte 2 undoable disk image 28284194Sdelphij>>32 string >\0 (%s) 29284194Sdelphij 30284194Sdelphij0 string/b VMDK VMware4 disk image 31284194Sdelphij0 string/b KDMV VMware4 disk image 32284194Sdelphij 33284194Sdelphij#-------------------------------------------------------------------- 34284194Sdelphij# Qemu Emulator Images 35284194Sdelphij# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 36284194Sdelphij# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 37284194Sdelphij# Made by reading sources, reading documentation, and doing trial and error 38284194Sdelphij# on existing QCOW files 39284194Sdelphij0 string/b QFI\xFB QEMU QCOW Image 40284194Sdelphij 41284194Sdelphij# Uncomment the following line to display Magic (only used for debugging 42284194Sdelphij# this magic number) 43284194Sdelphij#>0 string/b x , Magic: %s 44284194Sdelphij 45284194Sdelphij# There are currently 2 Versions: "1" and "2". 46284194Sdelphij# http://www.gnome.org/~markmc/qcow-image-format-version-1.html 47284194Sdelphij>4 belong 1 (v1) 48284194Sdelphij 49284194Sdelphij# Using the existence of the Backing File Offset to determine whether 50284194Sdelphij# to read Backing File Information 51284194Sdelphij>>12 belong >0 \b, has backing file ( 52284194Sdelphij# Note that this isn't a null-terminated string; the length is actually 53284194Sdelphij# (16.L). Assuming a null-terminated string happens to work usually, but it 54284194Sdelphij# may spew junk until it reaches a \0 in some cases. 55284194Sdelphij>>>(12.L) string >\0 \bpath %s 56284194Sdelphij 57284194Sdelphij# Modification time of the Backing File 58284194Sdelphij# Really useful if you want to know if your backing 59284194Sdelphij# file is still usable together with this image 60284194Sdelphij>>>>20 bedate >0 \b, mtime %s) 61284194Sdelphij>>>>20 default x \b) 62284194Sdelphij 63284194Sdelphij# Size is stored in bytes in a big-endian u64. 64284194Sdelphij>>24 bequad x \b, %lld bytes 65284194Sdelphij 66284194Sdelphij# 1 for AES encryption, 0 for none. 67284194Sdelphij>>36 belong 1 \b, AES-encrypted 68284194Sdelphij 69284194Sdelphij# http://www.gnome.org/~markmc/qcow-image-format.html 70284194Sdelphij>4 belong 2 (v2) 71284194Sdelphij# Using the existence of the Backing File Offset to determine whether 72284194Sdelphij# to read Backing File Information 73284194Sdelphij>>8 bequad >0 \b, has backing file 74284194Sdelphij# Note that this isn't a null-terminated string; the length is actually 75284194Sdelphij# (16.L). Assuming a null-terminated string happens to work usually, but it 76284194Sdelphij# may spew junk until it reaches a \0 in some cases. Also, since there's no 77284194Sdelphij# .Q modifier, we just use the bottom four bytes as an offset. Note that if 78284194Sdelphij# the file is over 4G, and the backing file path is stored after the first 4G, 79284194Sdelphij# the wrong filename will be printed. (This should be (8.Q), when that syntax 80284194Sdelphij# is introduced.) 81284194Sdelphij>>>(12.L) string >\0 (path %s) 82284194Sdelphij>>24 bequad x \b, %lld bytes 83284194Sdelphij>>32 belong 1 \b, AES-encrypted 84284194Sdelphij 85284194Sdelphij>4 belong 3 (v3) 86284194Sdelphij# Using the existence of the Backing File Offset to determine whether 87284194Sdelphij# to read Backing File Information 88284194Sdelphij>>8 bequad >0 \b, has backing file 89284194Sdelphij# Note that this isn't a null-terminated string; the length is actually 90284194Sdelphij# (16.L). Assuming a null-terminated string happens to work usually, but it 91284194Sdelphij# may spew junk until it reaches a \0 in some cases. Also, since there's no 92284194Sdelphij# .Q modifier, we just use the bottom four bytes as an offset. Note that if 93284194Sdelphij# the file is over 4G, and the backing file path is stored after the first 4G, 94284194Sdelphij# the wrong filename will be printed. (This should be (8.Q), when that syntax 95284194Sdelphij# is introduced.) 96284194Sdelphij>>>(12.L) string >\0 (path %s) 97284194Sdelphij>>24 bequad x \b, %lld bytes 98284194Sdelphij>>32 belong 1 \b, AES-encrypted 99284194Sdelphij 100284194Sdelphij>4 default x (unknown version) 101284194Sdelphij 102284194Sdelphij0 string/b QEVM QEMU suspend to disk image 103284194Sdelphij 104284194Sdelphij# QEMU QED Image 105284194Sdelphij# http://wiki.qemu.org/Features/QED/Specification 106284194Sdelphij0 string/b QED\0 QEMU QED Image 107284194Sdelphij 108284194Sdelphij# VDI Image 109284194Sdelphij# Sun xVM VirtualBox Disk Image 110284194Sdelphij# From: Richard W.M. Jones <rich@annexia.org> 111284194Sdelphij# VirtualBox Disk Image 112284194Sdelphij0x40 ulelong 0xbeda107f VirtualBox Disk Image 113284194Sdelphij>0x44 uleshort >0 \b, major %u 114284194Sdelphij>0x46 uleshort >0 \b, minor %u 115284194Sdelphij>0 string >\0 (%s) 116284194Sdelphij>368 lequad x \b, %lld bytes 117284194Sdelphij 118284194Sdelphij0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 119284194Sdelphij>32 string x type %s, 120284194Sdelphij>48 string x subtype %s 121284194Sdelphij 122284194Sdelphij0 lelong 0x02468ace Bochs Sparse disk image 123284194Sdelphij 124