dissect.hypervisor 3.15.dev2__tar.gz → 3.16.dev2__tar.gz

{dissect_hypervisor-3.15.dev2/dissect.hypervisor.egg-info → dissect_hypervisor-3.16.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.hypervisor
-Version: 3.15.dev2
+Version: 3.16.dev2
 Summary: A Dissect module implementing parsers for various hypervisor disk, backup and configuration files
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -27,7 +27,6 @@ Requires-Dist: dissect.cstruct<5,>=4
 Requires-Dist: dissect.util<4,>=3
 Provides-Extra: full
 Requires-Dist: pycryptodome; extra == "full"
-Requires-Dist: rich; extra == "full"
 Provides-Extra: dev
 Requires-Dist: dissect.hypervisor[full]; extra == "dev"
 Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"

{dissect_hypervisor-3.15.dev2 → dissect_hypervisor-3.16.dev2}/dissect/hypervisor/__init__.py

@@ -1,4 +1,3 @@
-from dissect.hypervisor.backup import vma, xva
 from dissect.hypervisor.descriptor import hyperv, ovf, pvs, vbox, vmx
 from dissect.hypervisor.disk import hdd, qcow2, vdi, vhd, vhdx, vmdk
 from dissect.hypervisor.util import envelope, vmtar
@@ -14,9 +13,7 @@ __all__ = [
     "vdi",
     "vhd",
     "vhdx",
-    "vma",
     "vmdk",
     "vmtar",
     "vmx",
-    "xva",
 ]

{dissect_hypervisor-3.15.dev2 → dissect_hypervisor-3.16.dev2}/dissect/hypervisor/disk/vmdk.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import ctypes
 import io
 import logging
@@ -5,6 +7,7 @@ import os
 import textwrap
 import zlib
 from bisect import bisect_right
+from dataclasses import dataclass
 from functools import lru_cache
 from pathlib import Path
 
@@ -59,13 +62,13 @@ class VMDK(AlignedStream):
                 if self.descriptor.attr["parentCID"] != "ffffffff":
                     self.parent = open_parent(path.parent, self.descriptor.attr["parentFileNameHint"])
 
-                for _, size, extent_type, filename in self.descriptor.extents:
-                    if extent_type in ["SPARSE", "VMFSSPARSE", "SESPARSE"]:
-                        sdisk_fh = path.with_name(filename).open("rb")
+                for extent in self.descriptor.extents:
+                    if extent.type in ["SPARSE", "VMFSSPARSE", "SESPARSE"]:
+                        sdisk_fh = path.with_name(extent.filename).open("rb")
                         self.disks.append(SparseDisk(sdisk_fh, parent=self.parent))
-                    elif extent_type in ["VMFS", "FLAT"]:
-                        rdisk_fh = path.with_name(filename).open("rb")
-                        self.disks.append(RawDisk(rdisk_fh, size * SECTOR_SIZE))
+                    elif extent.type in ["VMFS", "FLAT"]:
+                        rdisk_fh = path.with_name(extent.filename).open("rb")
+                        self.disks.append(RawDisk(rdisk_fh, extent.sectors * SECTOR_SIZE))
 
             elif magic in (COWD_MAGIC, VMDK_MAGIC, SESPARSE_MAGIC):
                 sparse_disk = SparseDisk(fh)
@@ -398,8 +401,37 @@ class SparseExtentHeader:
         return getattr(self.hdr, attr)
 
 
+@dataclass
+class ExtentDescriptor:
+    access_mode: str
+    sectors: int
+    type: str
+    filename: str | None = None
+    start_sector: int | None = None
+    partition_uuid: str | None = None
+    device_identifier: str | None = None
+
+    def __post_init__(self) -> None:
+        self._raw = " ".join(map(str, [v for v in self.__dict__.values() if v is not None]))
+        self.sectors = int(self.sectors)
+
+        if self.filename:
+            self.filename = self.filename.strip('"')
+
+        if self.start_sector:
+            self.start_sector = int(self.start_sector)
+
+    def __repr__(self) -> str:
+        return f"<ExtentDescriptor {self._raw}>"
+
+    def __str__(self) -> str:
+        return self._raw
+
+
 class DiskDescriptor:
-    def __init__(self, attr, extents, disk_db, sectors, raw_config=None):
+    def __init__(
+        self, attr: dict, extents: list[ExtentDescriptor], disk_db: dict, sectors: int, raw_config: str | None = None
+    ):
         self.attr = attr
         self.extents = extents
         self.ddb = disk_db
@@ -407,9 +439,15 @@ class DiskDescriptor:
         self.raw = raw_config
 
     @classmethod
-    def parse(cls, vmdk_config):
+    def parse(cls, vmdk_config: str) -> DiskDescriptor:
+        """Return :class:`DiskDescriptor` based on the provided ``vmdk_config``.
+
+        Resources:
+            - https://github.com/libyal/libvmdk/blob/main/documentation/VMWare%20Virtual%20Disk%20Format%20(VMDK).asciidoc
+        """  # noqa: E501
+
         descriptor_settings = {}
-        extents = []
+        extents: list[ExtentDescriptor] = []
         disk_db = {}
         sectors = 0
 
@@ -420,11 +458,16 @@ class DiskDescriptor:
                 continue
 
             if line.startswith("RW ") or line.startswith("RDONLY ") or line.startswith("NOACCESS "):
-                access_type, size, extent_type, filename = line.split(" ", 3)
-                filename = filename.strip('"')
-                size = int(size)
-                sectors += size
-                extents.append([access_type, size, extent_type, filename])
+                # Extent descriptors can have up to seven values according to libvmdk documentation.
+                parts = line.split(" ", maxsplit=6)
+
+                if len(parts) < 3:
+                    log.warning("Unexpected ExtentDescriptor format in vmdk config: %s, ignoring", line)
+                    continue
+
+                extent = ExtentDescriptor(*parts)
+                sectors += extent.sectors
+                extents.append(extent)
                 continue
 
             setting, _, value = line.partition("=")
@@ -438,35 +481,33 @@ class DiskDescriptor:
 
         return cls(descriptor_settings, extents, disk_db, sectors, vmdk_config)
 
-    def __str__(self):
-        str_template = """\
-                          # Disk DescriptorFile
-                          version=1
-                          {}
+    def __str__(self) -> str:
+        str_template = textwrap.dedent(
+            """\
+        # Disk DescriptorFile
+        version=1
+        {}
+
+        # Extent Description
+        {}
 
-                          # Extent Description
-                          {}
+        # The Disk Data Base
+        #DDB
 
-                          # The Disk Data Base
-                          #DDB
+        {}"""
+        )
 
-                          {}"""
-        str_template = textwrap.dedent(str_template)
         descriptor_settings = []
         for setting, value in self.attr.items():
-            if setting == "version":
-                continue
-            descriptor_settings.append("{}={}".format(setting, value))
+            if setting != "version":
+                descriptor_settings.append(f"{setting}={value}")
         descriptor_settings = "\n".join(descriptor_settings)
 
-        extents = []
-        for access_type, size, extent_type, filename in self.extents:
-            extents.append('{} {} {} "{}"'.format(access_type, size, extent_type, filename))
-        extents = "\n".join(extents)
+        extents = "\n".join(map(str, self.extents))
 
         disk_db = []
         for setting, value in self.ddb.items():
-            disk_db.append('{} = "{}"'.format(setting, value))
+            disk_db.append(f'{setting} = "{value}"')
         disk_db = "\n".join(disk_db)
 
         return str_template.format(descriptor_settings, extents, disk_db)

{dissect_hypervisor-3.15.dev2 → dissect_hypervisor-3.16.dev2/dissect.hypervisor.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.hypervisor
-Version: 3.15.dev2
+Version: 3.16.dev2
 Summary: A Dissect module implementing parsers for various hypervisor disk, backup and configuration files
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -27,7 +27,6 @@ Requires-Dist: dissect.cstruct<5,>=4
 Requires-Dist: dissect.util<4,>=3
 Provides-Extra: full
 Requires-Dist: pycryptodome; extra == "full"
-Requires-Dist: rich; extra == "full"
 Provides-Extra: dev
 Requires-Dist: dissect.hypervisor[full]; extra == "dev"
 Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"

{dissect_hypervisor-3.15.dev2 → dissect_hypervisor-3.16.dev2}/dissect.hypervisor.egg-info/SOURCES.txt

@@ -12,10 +12,6 @@ dissect.hypervisor.egg-info/requires.txt
 dissect.hypervisor.egg-info/top_level.txt
 dissect/hypervisor/__init__.py
 dissect/hypervisor/exceptions.py
-dissect/hypervisor/backup/__init__.py
-dissect/hypervisor/backup/c_vma.py
-dissect/hypervisor/backup/vma.py
-dissect/hypervisor/backup/xva.py
 dissect/hypervisor/descriptor/__init__.py
 dissect/hypervisor/descriptor/c_hyperv.py
 dissect/hypervisor/descriptor/hyperv.py
@@ -38,7 +34,6 @@ dissect/hypervisor/disk/vhdx.py
 dissect/hypervisor/disk/vmdk.py
 dissect/hypervisor/tools/__init__.py
 dissect/hypervisor/tools/envelope.py
-dissect/hypervisor/tools/vma.py
 dissect/hypervisor/util/__init__.py
 dissect/hypervisor/util/envelope.py
 dissect/hypervisor/util/vmtar.py
@@ -52,7 +47,6 @@ tests/test_pvs.py
 tests/test_vbox.py
 tests/test_vhd.py
 tests/test_vhdx.py
-tests/test_vma.py
 tests/test_vmdk.py
 tests/test_vmtar.py
 tests/test_vmx.py
@@ -67,7 +61,6 @@ tests/data/local.tgz.ve
 tests/data/sesparse.vmdk.gz
 tests/data/test.VMRS
 tests/data/test.vgz
-tests/data/test.vma.gz
 tests/data/test.vmcx
 tests/data/expanding.hdd/DiskDescriptor.xml
 tests/data/expanding.hdd/expanding.hdd

{dissect_hypervisor-3.15.dev2 → dissect_hypervisor-3.16.dev2}/dissect.hypervisor.egg-info/entry_points.txt

@@ -1,3 +1,2 @@
 [console_scripts]
 envelope-decrypt = dissect.hypervisor.tools.envelope:main
-vma-extract = dissect.hypervisor.tools.vma:main

{dissect_hypervisor-3.15.dev2 → dissect_hypervisor-3.16.dev2}/dissect.hypervisor.egg-info/requires.txt

@@ -9,4 +9,3 @@ dissect.util<4.0.dev,>=3.0.dev
 
 [full]
 pycryptodome
-rich

{dissect_hypervisor-3.15.dev2 → dissect_hypervisor-3.16.dev2}/pyproject.toml

@@ -39,7 +39,6 @@ repository = "https://github.com/fox-it/dissect.hypervisor"
 [project.optional-dependencies]
 full = [
     "pycryptodome",
-    "rich",
 ]
 dev = [
     "dissect.hypervisor[full]",
@@ -48,7 +47,6 @@ dev = [
 ]
 
 [project.scripts]
-vma-extract = "dissect.hypervisor.tools.vma:main"
 envelope-decrypt = "dissect.hypervisor.tools.envelope:main"
 
 [tool.black]

{dissect_hypervisor-3.15.dev2 → dissect_hypervisor-3.16.dev2}/tests/conftest.py

@@ -79,11 +79,6 @@ def split_hdd() -> Iterator[str]:
     yield absolute_path("data/split.hdd")
 
 
-@pytest.fixture
-def simple_vma() -> Iterator[BinaryIO]:
-    yield from open_file_gz("data/test.vma.gz")
-
-
 @pytest.fixture
 def envelope() -> Iterator[BinaryIO]:
     yield from open_file("data/local.tgz.ve")

dissect_hypervisor-3.16.dev2/tests/test_vmdk.py

@@ -0,0 +1,93 @@
+import pytest
+
+from dissect.hypervisor.disk.c_vmdk import c_vmdk
+from dissect.hypervisor.disk.vmdk import VMDK, DiskDescriptor, ExtentDescriptor
+
+
+def test_vmdk_sesparse(sesparse_vmdk):
+    vmdk = VMDK(sesparse_vmdk)
+
+    disk = vmdk.disks[0]
+
+    assert disk.is_sesparse
+    assert disk._grain_directory_size == 0x20000
+    assert disk._grain_table_size == 0x1000
+    assert disk._grain_entry_type == c_vmdk.uint64
+    assert disk._grain_directory[0] == 0x1000000000000000
+
+    header = disk.header
+    assert header.magic == c_vmdk.SESPARSE_CONST_HEADER_MAGIC
+    assert header.version == 0x200000001
+
+    assert vmdk.read(0x1000000) == b"a" * 0x1000000
+
+
+@pytest.mark.parametrize(
+    "extent_description, expected_extents",
+    [
+        (
+            'RW 123456789 SPARSE "disk.vmdk"',
+            [
+                ExtentDescriptor(
+                    access_mode="RW",
+                    sectors=123456789,
+                    type="SPARSE",
+                    filename="disk.vmdk",
+                    partition_uuid=None,
+                    device_identifier=None,
+                ),
+            ],
+        ),
+        (
+            'RW 123456789 FLAT "disk-flat.vmdk" 0',
+            [
+                ExtentDescriptor(
+                    access_mode="RW",
+                    sectors=123456789,
+                    type="FLAT",
+                    filename="disk-flat.vmdk",
+                    start_sector=0,
+                    partition_uuid=None,
+                    device_identifier=None,
+                )
+            ],
+        ),
+        (
+            "RDONLY 0 ZERO",
+            [
+                ExtentDescriptor(
+                    access_mode="RDONLY",
+                    sectors=0,
+                    type="ZERO",
+                ),
+            ],
+        ),
+        (
+            'NOACCESS 123456789 SPARSE "disk-sparse.vmdk" 123 partition-uuid device-id',
+            [
+                ExtentDescriptor(
+                    access_mode="NOACCESS",
+                    sectors=123456789,
+                    type="SPARSE",
+                    filename="disk-sparse.vmdk",
+                    start_sector=123,
+                    partition_uuid="partition-uuid",
+                    device_identifier="device-id",
+                ),
+            ],
+        ),
+        ("RW 1234567890", []),
+        ('RDONLY "file.vmdk"', []),
+        ("NOACCESS", []),
+    ],
+    ids=("sparse", "flat", "zero", "sparse-ids", "bad-1", "bad-2", "bad-3"),
+)
+def test_vmdk_extent_description(extent_description: str, expected_extents: list) -> None:
+    """test if we correctly parse VMDK sparse and flat extent descriptions.
+
+    Resources:
+        - https://github.com/libyal/libvmdk/blob/main/documentation/VMWare%20Virtual%20Disk%20Format%20(VMDK).asciidoc#22-extent-descriptions
+    """  # noqa: E501
+
+    descriptor = DiskDescriptor.parse(extent_description)
+    assert descriptor.extents == expected_extents

dissect_hypervisor-3.15.dev2/dissect/hypervisor/backup/c_vma.py

@@ -1,60 +0,0 @@
-from dissect.cstruct import cstruct
-
-vma_def = """
-#define VMA_BLOCK_BITS          12
-#define VMA_BLOCK_SIZE          (1 << VMA_BLOCK_BITS)
-#define VMA_CLUSTER_BITS        (VMA_BLOCK_BITS + 4)
-#define VMA_CLUSTER_SIZE        (1 << VMA_CLUSTER_BITS)
-
-#define VMA_EXTENT_HEADER_SIZE  512
-#define VMA_BLOCKS_PER_EXTENT   59
-#define VMA_MAX_CONFIGS         256
-
-#define VMA_MAX_EXTENT_SIZE     (VMA_EXTENT_HEADER_SIZE + VMA_CLUSTER_SIZE * VMA_BLOCKS_PER_EXTENT)
-
-/* File Format Definitions */
-
-struct VmaDeviceInfoHeader {
-    uint32  devname_ptr;    /* offset into blob_buffer table */
-    uint32  reserved0;
-    uint64  size;           /* device size in bytes */
-    uint64  reserved1;
-    uint64  reserved2;
-};
-
-struct VmaHeader {
-    char    magic[4];
-    uint32  version;
-    char    uuid[16];
-    int64   ctime;
-    char    md5sum[16];
-
-    uint32  blob_buffer_offset;
-    uint32  blob_buffer_size;
-    uint32  header_size;
-
-    char    _reserved1[1984];
-
-    uint32  config_names[VMA_MAX_CONFIGS]; /* offset into blob_buffer table */
-    uint32  config_data[VMA_MAX_CONFIGS];  /* offset into blob_buffer table */
-
-    char    _reserved2[4];
-
-    VmaDeviceInfoHeader     dev_info[256];
-};
-
-struct VmaExtentHeader {
-    char    magic[4];
-    uint16  reserved1;
-    uint16  block_count;
-    char    uuid[16];
-    char    md5sum[16];
-    uint64  blockinfo[VMA_BLOCKS_PER_EXTENT];
-};
-"""
-
-c_vma = cstruct(endian=">").load(vma_def)
-
-
-VMA_MAGIC = b"VMA\x00"
-VMA_EXTENT_MAGIC = b"VMAE"