dissect.hypervisor 3.16.dev3__tar.gz → 3.17.dev1__tar.gz

{dissect_hypervisor-3.16.dev3/dissect.hypervisor.egg-info → dissect_hypervisor-3.17.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.hypervisor
-Version: 3.16.dev3
+Version: 3.17.dev1
 Summary: A Dissect module implementing parsers for various hypervisor disk, backup and configuration files
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_hypervisor-3.16.dev3 → dissect_hypervisor-3.17.dev1}/dissect/hypervisor/disk/vmdk.py

@@ -1,10 +1,14 @@
+from __future__ import annotations
+
 import ctypes
 import io
 import logging
 import os
+import re
 import textwrap
 import zlib
 from bisect import bisect_right
+from dataclasses import dataclass
 from functools import lru_cache
 from pathlib import Path
 
@@ -59,13 +63,13 @@ class VMDK(AlignedStream):
                 if self.descriptor.attr["parentCID"] != "ffffffff":
                     self.parent = open_parent(path.parent, self.descriptor.attr["parentFileNameHint"])
 
-                for _, size, extent_type, filename in self.descriptor.extents:
-                    if extent_type in ["SPARSE", "VMFSSPARSE", "SESPARSE"]:
-                        sdisk_fh = path.with_name(filename).open("rb")
+                for extent in self.descriptor.extents:
+                    if extent.type in ["SPARSE", "VMFSSPARSE", "SESPARSE"]:
+                        sdisk_fh = path.with_name(extent.filename).open("rb")
                         self.disks.append(SparseDisk(sdisk_fh, parent=self.parent))
-                    elif extent_type in ["VMFS", "FLAT"]:
-                        rdisk_fh = path.with_name(filename).open("rb")
-                        self.disks.append(RawDisk(rdisk_fh, size * SECTOR_SIZE))
+                    elif extent.type in ["VMFS", "FLAT"]:
+                        rdisk_fh = path.with_name(extent.filename).open("rb")
+                        self.disks.append(RawDisk(rdisk_fh, extent.sectors * SECTOR_SIZE))
 
             elif magic in (COWD_MAGIC, VMDK_MAGIC, SESPARSE_MAGIC):
                 sparse_disk = SparseDisk(fh)
@@ -398,8 +402,53 @@ class SparseExtentHeader:
         return getattr(self.hdr, attr)
 
 
+RE_EXTENT_DESCRIPTOR = re.compile(
+    r"""
+    ^
+    (?P<access_mode>RW|RDONLY|NOACCESS)\s
+    (?P<sectors>\d+)\s
+    (?P<type>SPARSE|ZERO|FLAT|VMFS|VMFSSPARSE|VMFSRDM|VMFSRAW)
+    (\s(?P<filename>\".+\"))?
+    (\s(?P<start_sector>\d+))?
+    (\s(?P<partition_uuid>\S+))?
+    (\s(?P<device_identifier>\S+))?
+    $
+    """,
+    re.VERBOSE,
+)
+
+
+@dataclass
+class ExtentDescriptor:
+    raw: str
+    access_mode: str
+    sectors: int
+    type: str
+    filename: str | None = None
+    start_sector: int | None = None
+    partition_uuid: str | None = None
+    device_identifier: str | None = None
+
+    def __post_init__(self) -> None:
+        self.sectors = int(self.sectors)
+
+        if self.filename:
+            self.filename = self.filename.strip('"')
+
+        if self.start_sector:
+            self.start_sector = int(self.start_sector)
+
+    def __repr__(self) -> str:
+        return f"<ExtentDescriptor {self.raw}>"
+
+    def __str__(self) -> str:
+        return self.raw
+
+
 class DiskDescriptor:
-    def __init__(self, attr, extents, disk_db, sectors, raw_config=None):
+    def __init__(
+        self, attr: dict, extents: list[ExtentDescriptor], disk_db: dict, sectors: int, raw_config: str | None = None
+    ):
         self.attr = attr
         self.extents = extents
         self.ddb = disk_db
@@ -407,9 +456,15 @@ class DiskDescriptor:
         self.raw = raw_config
 
     @classmethod
-    def parse(cls, vmdk_config):
+    def parse(cls, vmdk_config: str) -> DiskDescriptor:
+        """Return :class:`DiskDescriptor` based on the provided ``vmdk_config``.
+
+        Resources:
+            - https://github.com/libyal/libvmdk/blob/main/documentation/VMWare%20Virtual%20Disk%20Format%20(VMDK).asciidoc
+        """  # noqa: E501
+
         descriptor_settings = {}
-        extents = []
+        extents: list[ExtentDescriptor] = []
         disk_db = {}
         sectors = 0
 
@@ -420,11 +475,15 @@ class DiskDescriptor:
                 continue
 
             if line.startswith("RW ") or line.startswith("RDONLY ") or line.startswith("NOACCESS "):
-                access_type, size, extent_type, filename = line.split(" ", 3)
-                filename = filename.strip('"')
-                size = int(size)
-                sectors += size
-                extents.append([access_type, size, extent_type, filename])
+                match = RE_EXTENT_DESCRIPTOR.search(line)
+
+                if not match:
+                    log.warning("Unexpected ExtentDescriptor format in vmdk config: %s, ignoring", line)
+                    continue
+
+                extent = ExtentDescriptor(raw=line, **match.groupdict())
+                sectors += extent.sectors
+                extents.append(extent)
                 continue
 
             setting, _, value = line.partition("=")
@@ -438,35 +497,33 @@ class DiskDescriptor:
 
         return cls(descriptor_settings, extents, disk_db, sectors, vmdk_config)
 
-    def __str__(self):
-        str_template = """\
-                          # Disk DescriptorFile
-                          version=1
-                          {}
+    def __str__(self) -> str:
+        str_template = textwrap.dedent(
+            """\
+        # Disk DescriptorFile
+        version=1
+        {}
 
-                          # Extent Description
-                          {}
+        # Extent Description
+        {}
 
-                          # The Disk Data Base
-                          #DDB
+        # The Disk Data Base
+        #DDB
+
+        {}"""
+        )
 
-                          {}"""
-        str_template = textwrap.dedent(str_template)
         descriptor_settings = []
         for setting, value in self.attr.items():
-            if setting == "version":
-                continue
-            descriptor_settings.append("{}={}".format(setting, value))
+            if setting != "version":
+                descriptor_settings.append(f"{setting}={value}")
         descriptor_settings = "\n".join(descriptor_settings)
 
-        extents = []
-        for access_type, size, extent_type, filename in self.extents:
-            extents.append('{} {} {} "{}"'.format(access_type, size, extent_type, filename))
-        extents = "\n".join(extents)
+        extents = "\n".join(map(str, self.extents))
 
         disk_db = []
         for setting, value in self.ddb.items():
-            disk_db.append('{} = "{}"'.format(setting, value))
+            disk_db.append(f'{setting} = "{value}"')
         disk_db = "\n".join(disk_db)
 
         return str_template.format(descriptor_settings, extents, disk_db)

{dissect_hypervisor-3.16.dev3 → dissect_hypervisor-3.17.dev1/dissect.hypervisor.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.hypervisor
-Version: 3.16.dev3
+Version: 3.17.dev1
 Summary: A Dissect module implementing parsers for various hypervisor disk, backup and configuration files
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect_hypervisor-3.17.dev1/tests/test_vmdk.py

@@ -0,0 +1,199 @@
+import pytest
+
+from dissect.hypervisor.disk.c_vmdk import c_vmdk
+from dissect.hypervisor.disk.vmdk import VMDK, DiskDescriptor, ExtentDescriptor
+
+
+def test_vmdk_sesparse(sesparse_vmdk):
+    vmdk = VMDK(sesparse_vmdk)
+
+    disk = vmdk.disks[0]
+
+    assert disk.is_sesparse
+    assert disk._grain_directory_size == 0x20000
+    assert disk._grain_table_size == 0x1000
+    assert disk._grain_entry_type == c_vmdk.uint64
+    assert disk._grain_directory[0] == 0x1000000000000000
+
+    header = disk.header
+    assert header.magic == c_vmdk.SESPARSE_CONST_HEADER_MAGIC
+    assert header.version == 0x200000001
+
+    assert vmdk.read(0x1000000) == b"a" * 0x1000000
+
+
+@pytest.mark.parametrize(
+    "extent_description, expected_extents",
+    [
+        (
+            'RW 123456789 SPARSE "disk.vmdk"',
+            [
+                ExtentDescriptor(
+                    raw='RW 123456789 SPARSE "disk.vmdk"',
+                    access_mode="RW",
+                    sectors=123456789,
+                    type="SPARSE",
+                    filename='"disk.vmdk"',
+                    start_sector=None,
+                    partition_uuid=None,
+                    device_identifier=None,
+                ),
+            ],
+        ),
+        (
+            'RW 123456789 FLAT "disk-flat.vmdk" 0',
+            [
+                ExtentDescriptor(
+                    raw='RW 123456789 FLAT "disk-flat.vmdk" 0',
+                    access_mode="RW",
+                    sectors=123456789,
+                    type="FLAT",
+                    filename='"disk-flat.vmdk"',
+                    start_sector=0,
+                    partition_uuid=None,
+                    device_identifier=None,
+                )
+            ],
+        ),
+        (
+            "RDONLY 0 ZERO",
+            [
+                ExtentDescriptor(
+                    raw="RDONLY 0 ZERO",
+                    access_mode="RDONLY",
+                    sectors=0,
+                    type="ZERO",
+                ),
+            ],
+        ),
+        (
+            'NOACCESS 123456789 SPARSE "disk-sparse.vmdk" 123 partition-uuid device-id',
+            [
+                ExtentDescriptor(
+                    raw='NOACCESS 123456789 SPARSE "disk-sparse.vmdk" 123 partition-uuid device-id',
+                    access_mode="NOACCESS",
+                    sectors=123456789,
+                    type="SPARSE",
+                    filename='"disk-sparse.vmdk"',
+                    start_sector=123,
+                    partition_uuid="partition-uuid",
+                    device_identifier="device-id",
+                ),
+            ],
+        ),
+        ("RW 1234567890", []),
+        ('RDONLY "file.vmdk"', []),
+        ("NOACCESS", []),
+        (
+            'RW 1234567890 SPARSE "disk with spaces.vmdk"',
+            [
+                ExtentDescriptor(
+                    raw='RW 1234567890 SPARSE "disk with spaces.vmdk"',
+                    access_mode="RW",
+                    sectors=1234567890,
+                    type="SPARSE",
+                    filename='"disk with spaces.vmdk"',
+                    start_sector=None,
+                    partition_uuid=None,
+                    device_identifier=None,
+                )
+            ],
+        ),
+        (
+            'RW 1234567890 SPARSE "disk with spaces.vmdk" 123',
+            [
+                ExtentDescriptor(
+                    raw='RW 1234567890 SPARSE "disk with spaces.vmdk" 123',
+                    access_mode="RW",
+                    sectors=1234567890,
+                    type="SPARSE",
+                    filename='"disk with spaces.vmdk"',
+                    start_sector=123,
+                    partition_uuid=None,
+                    device_identifier=None,
+                )
+            ],
+        ),
+        (
+            'RW 1234567890 SPARSE "disk with spaces.vmdk" 123 part-uuid',
+            [
+                ExtentDescriptor(
+                    raw='RW 1234567890 SPARSE "disk with spaces.vmdk" 123 part-uuid',
+                    access_mode="RW",
+                    sectors=1234567890,
+                    type="SPARSE",
+                    filename='"disk with spaces.vmdk"',
+                    start_sector=123,
+                    partition_uuid="part-uuid",
+                    device_identifier=None,
+                )
+            ],
+        ),
+        (
+            'RW 1234567890 SPARSE "disk with spaces.vmdk" 123 part-uuid device-id',
+            [
+                ExtentDescriptor(
+                    raw='RW 1234567890 SPARSE "disk with spaces.vmdk" 123 part-uuid device-id',
+                    access_mode="RW",
+                    sectors=1234567890,
+                    type="SPARSE",
+                    filename='"disk with spaces.vmdk"',
+                    start_sector=123,
+                    partition_uuid="part-uuid",
+                    device_identifier="device-id",
+                )
+            ],
+        ),
+        (
+            r'RW 16777216 SPARSE "this is an example "\' diskëäô:)\\\'`\foo.vmdk" 123',
+            [
+                ExtentDescriptor(
+                    raw=r'RW 16777216 SPARSE "this is an example "\' diskëäô:)\\\'`\foo.vmdk" 123',
+                    access_mode="RW",
+                    sectors=16777216,
+                    type="SPARSE",
+                    filename=r'"this is an example "\' diskëäô:)\\\'`\foo.vmdk"',
+                    start_sector=123,
+                    partition_uuid=None,
+                    device_identifier=None,
+                )
+            ],
+        ),
+        (
+            r'RW 13371337 SPARSE "🦊 🦊 🦊.vmdk"',
+            [
+                ExtentDescriptor(
+                    raw=r'RW 13371337 SPARSE "🦊 🦊 🦊.vmdk"',
+                    access_mode="RW",
+                    sectors=13371337,
+                    type="SPARSE",
+                    filename='"🦊 🦊 🦊.vmdk"',
+                )
+            ],
+        ),
+    ],
+    ids=(
+        "sparse",
+        "flat",
+        "zero",
+        "sparse-ids",
+        "bad-1",
+        "bad-2",
+        "bad-3",
+        "spaces-four-parts",
+        "spaces-five-parts",
+        "spaces-six-parts",
+        "spaces-seven-parts",
+        "specials-five-parts",
+        "emoji-four-parts",
+    ),
+)
+def test_vmdk_extent_description(extent_description: str, expected_extents: list) -> None:
+    """test if we correctly parse VMDK sparse and flat extent descriptions.
+
+    Resources:
+        - https://github.com/libyal/libvmdk/blob/main/documentation/VMWare%20Virtual%20Disk%20Format%20(VMDK).asciidoc#22-extent-descriptions
+    """  # noqa: E501
+
+    descriptor = DiskDescriptor.parse(extent_description)
+    assert descriptor.extents == expected_extents

dissect_hypervisor-3.16.dev3/tests/test_vmdk.py

@@ -1,20 +0,0 @@
-from dissect.hypervisor.disk.c_vmdk import c_vmdk
-from dissect.hypervisor.disk.vmdk import VMDK
-
-
-def test_vmdk_sesparse(sesparse_vmdk):
-    vmdk = VMDK(sesparse_vmdk)
-
-    disk = vmdk.disks[0]
-
-    assert disk.is_sesparse
-    assert disk._grain_directory_size == 0x20000
-    assert disk._grain_table_size == 0x1000
-    assert disk._grain_entry_type == c_vmdk.uint64
-    assert disk._grain_directory[0] == 0x1000000000000000
-
-    header = disk.header
-    assert header.magic == c_vmdk.SESPARSE_CONST_HEADER_MAGIC
-    assert header.version == 0x200000001
-
-    assert vmdk.read(0x1000000) == b"a" * 0x1000000