dissect.hypervisor 3.19.dev1__py3-none-any.whl → 3.19.dev2__py3-none-any.whl

dissect/hypervisor/disk/c_qcow2.py

@@ -171,9 +171,6 @@ UNALLOCATED_SUBCLUSTER_TYPES = (
 )
 
 
-def ctz(value: int, size: int = 32) -> int:
+def ctz(value: int) -> int:
     """Count the number of zero bits in an integer of a given size."""
-    for i in range(size):
-        if value & (1 << i):
-            return i
-    return 0
+    return (value & -value).bit_length() - 1 if value else 0

dissect/hypervisor/disk/c_qcow2.pyi

@@ -0,0 +1,190 @@
+# Generated by cstruct-stubgen
+from typing import BinaryIO, Literal, overload
+
+import dissect.cstruct as __cs__
+from typing_extensions import TypeAlias
+
+class _c_qcow2(__cs__.cstruct):
+    MIN_CLUSTER_BITS: Literal[9] = ...
+    MAX_CLUSTER_BITS: Literal[21] = ...
+    QCOW2_COMPRESSED_SECTOR_SIZE: Literal[512] = ...
+    QCOW2_COMPRESSION_TYPE_ZLIB: Literal[0] = ...
+    QCOW2_COMPRESSION_TYPE_ZSTD: Literal[1] = ...
+    L1E_SIZE: Literal[8] = ...
+    L2E_SIZE_NORMAL: Literal[8] = ...
+    L2E_SIZE_EXTENDED: Literal[16] = ...
+    L1E_OFFSET_MASK: Literal[72057594037927424] = ...
+    L2E_OFFSET_MASK: Literal[72057594037927424] = ...
+    L2E_COMPRESSED_OFFSET_SIZE_MASK: Literal[4611686018427387903] = ...
+    QCOW_OFLAG_COPIED: Literal[9223372036854775808] = ...
+    QCOW_OFLAG_COMPRESSED: Literal[4611686018427387904] = ...
+    QCOW_OFLAG_ZERO: Literal[1] = ...
+    QCOW_EXTL2_SUBCLUSTERS_PER_CLUSTER: Literal[32] = ...
+    QCOW2_INCOMPAT_DIRTY_BITNR: Literal[0] = ...
+    QCOW2_INCOMPAT_CORRUPT_BITNR: Literal[1] = ...
+    QCOW2_INCOMPAT_DATA_FILE_BITNR: Literal[2] = ...
+    QCOW2_INCOMPAT_COMPRESSION_BITNR: Literal[3] = ...
+    QCOW2_INCOMPAT_EXTL2_BITNR: Literal[4] = ...
+    QCOW2_INCOMPAT_DIRTY: Literal[1] = ...
+    QCOW2_INCOMPAT_CORRUPT: Literal[2] = ...
+    QCOW2_INCOMPAT_DATA_FILE: Literal[4] = ...
+    QCOW2_INCOMPAT_COMPRESSION: Literal[8] = ...
+    QCOW2_INCOMPAT_EXTL2: Literal[16] = ...
+    QCOW2_EXT_MAGIC_END: Literal[0] = ...
+    QCOW2_EXT_MAGIC_BACKING_FORMAT: Literal[3799591626] = ...
+    QCOW2_EXT_MAGIC_FEATURE_TABLE: Literal[1745090647] = ...
+    QCOW2_EXT_MAGIC_CRYPTO_HEADER: Literal[87539319] = ...
+    QCOW2_EXT_MAGIC_BITMAPS: Literal[595929205] = ...
+    QCOW2_EXT_MAGIC_DATA_FILE: Literal[1145132097] = ...
+    class QCowHeader(__cs__.Structure):
+        magic: _c_qcow2.uint32
+        version: _c_qcow2.uint32
+        backing_file_offset: _c_qcow2.uint64
+        backing_file_size: _c_qcow2.uint32
+        cluster_bits: _c_qcow2.uint32
+        size: _c_qcow2.uint64
+        crypt_method: _c_qcow2.uint32
+        l1_size: _c_qcow2.uint32
+        l1_table_offset: _c_qcow2.uint64
+        refcount_table_offset: _c_qcow2.uint64
+        refcount_table_clusters: _c_qcow2.uint32
+        nb_snapshots: _c_qcow2.uint32
+        snapshots_offset: _c_qcow2.uint64
+        incompatible_features: _c_qcow2.uint64
+        compatible_features: _c_qcow2.uint64
+        autoclear_features: _c_qcow2.uint64
+        refcount_order: _c_qcow2.uint32
+        header_length: _c_qcow2.uint32
+        compression_type: _c_qcow2.uint8
+        padding: __cs__.Array[_c_qcow2.uint8]
+        @overload
+        def __init__(
+            self,
+            magic: _c_qcow2.uint32 | None = ...,
+            version: _c_qcow2.uint32 | None = ...,
+            backing_file_offset: _c_qcow2.uint64 | None = ...,
+            backing_file_size: _c_qcow2.uint32 | None = ...,
+            cluster_bits: _c_qcow2.uint32 | None = ...,
+            size: _c_qcow2.uint64 | None = ...,
+            crypt_method: _c_qcow2.uint32 | None = ...,
+            l1_size: _c_qcow2.uint32 | None = ...,
+            l1_table_offset: _c_qcow2.uint64 | None = ...,
+            refcount_table_offset: _c_qcow2.uint64 | None = ...,
+            refcount_table_clusters: _c_qcow2.uint32 | None = ...,
+            nb_snapshots: _c_qcow2.uint32 | None = ...,
+            snapshots_offset: _c_qcow2.uint64 | None = ...,
+            incompatible_features: _c_qcow2.uint64 | None = ...,
+            compatible_features: _c_qcow2.uint64 | None = ...,
+            autoclear_features: _c_qcow2.uint64 | None = ...,
+            refcount_order: _c_qcow2.uint32 | None = ...,
+            header_length: _c_qcow2.uint32 | None = ...,
+            compression_type: _c_qcow2.uint8 | None = ...,
+            padding: __cs__.Array[_c_qcow2.uint8] | None = ...,
+        ): ...
+        @overload
+        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+    class QCowExtension(__cs__.Structure):
+        magic: _c_qcow2.uint32
+        len: _c_qcow2.uint32
+        @overload
+        def __init__(self, magic: _c_qcow2.uint32 | None = ..., len: _c_qcow2.uint32 | None = ...): ...
+        @overload
+        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+    class Qcow2CryptoHeaderExtension(__cs__.Structure):
+        offset: _c_qcow2.uint64
+        length: _c_qcow2.uint64
+        @overload
+        def __init__(self, offset: _c_qcow2.uint64 | None = ..., length: _c_qcow2.uint64 | None = ...): ...
+        @overload
+        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+    class Qcow2BitmapHeaderExt(__cs__.Structure):
+        nb_bitmaps: _c_qcow2.uint32
+        reserved32: _c_qcow2.uint32
+        bitmap_directory_size: _c_qcow2.uint64
+        bitmap_directory_offset: _c_qcow2.uint64
+        @overload
+        def __init__(
+            self,
+            nb_bitmaps: _c_qcow2.uint32 | None = ...,
+            reserved32: _c_qcow2.uint32 | None = ...,
+            bitmap_directory_size: _c_qcow2.uint64 | None = ...,
+            bitmap_directory_offset: _c_qcow2.uint64 | None = ...,
+        ): ...
+        @overload
+        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+    class QCowSnapshotHeader(__cs__.Structure):
+        l1_table_offset: _c_qcow2.uint64
+        l1_size: _c_qcow2.uint32
+        id_str_size: _c_qcow2.uint16
+        name_size: _c_qcow2.uint16
+        date_sec: _c_qcow2.uint32
+        date_nsec: _c_qcow2.uint32
+        vm_clock_nsec: _c_qcow2.uint64
+        vm_state_size: _c_qcow2.uint32
+        extra_data_size: _c_qcow2.uint32
+        @overload
+        def __init__(
+            self,
+            l1_table_offset: _c_qcow2.uint64 | None = ...,
+            l1_size: _c_qcow2.uint32 | None = ...,
+            id_str_size: _c_qcow2.uint16 | None = ...,
+            name_size: _c_qcow2.uint16 | None = ...,
+            date_sec: _c_qcow2.uint32 | None = ...,
+            date_nsec: _c_qcow2.uint32 | None = ...,
+            vm_clock_nsec: _c_qcow2.uint64 | None = ...,
+            vm_state_size: _c_qcow2.uint32 | None = ...,
+            extra_data_size: _c_qcow2.uint32 | None = ...,
+        ): ...
+        @overload
+        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+    class QCowSnapshotExtraData(__cs__.Structure):
+        vm_state_size_large: _c_qcow2.uint64
+        disk_size: _c_qcow2.uint64
+        icount: _c_qcow2.uint64
+        @overload
+        def __init__(
+            self,
+            vm_state_size_large: _c_qcow2.uint64 | None = ...,
+            disk_size: _c_qcow2.uint64 | None = ...,
+            icount: _c_qcow2.uint64 | None = ...,
+        ): ...
+        @overload
+        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+    class QCow2ClusterType(__cs__.Enum):
+        QCOW2_CLUSTER_UNALLOCATED = ...
+        QCOW2_CLUSTER_ZERO_PLAIN = ...
+        QCOW2_CLUSTER_ZERO_ALLOC = ...
+        QCOW2_CLUSTER_NORMAL = ...
+        QCOW2_CLUSTER_COMPRESSED = ...
+
+    class QCow2SubclusterType(__cs__.Enum):
+        QCOW2_SUBCLUSTER_UNALLOCATED_PLAIN = ...
+        QCOW2_SUBCLUSTER_UNALLOCATED_ALLOC = ...
+        QCOW2_SUBCLUSTER_ZERO_PLAIN = ...
+        QCOW2_SUBCLUSTER_ZERO_ALLOC = ...
+        QCOW2_SUBCLUSTER_NORMAL = ...
+        QCOW2_SUBCLUSTER_COMPRESSED = ...
+        QCOW2_SUBCLUSTER_INVALID = ...
+
+# Technically `c_qcow2` is an instance of `_c_qcow2`, but then we can't use it in type hints
+c_qcow2: TypeAlias = _c_qcow2
+
+QCOW2_MAGIC: int
+QCOW2_MAGIC_BYTES: bytes
+
+QCOW2_INCOMPAT_MASK: int
+
+QCow2ClusterType: TypeAlias = _c_qcow2.QCow2ClusterType
+QCow2SubclusterType: TypeAlias = _c_qcow2.QCow2SubclusterType
+
+NORMAL_SUBCLUSTER_TYPES: tuple[QCow2SubclusterType, ...]
+ZERO_SUBCLUSTER_TYPES: tuple[QCow2SubclusterType, ...]
+UNALLOCATED_SUBCLUSTER_TYPES: tuple[QCow2SubclusterType, ...]
+
+def ctz(value: int) -> int: ...

dissect/hypervisor/disk/qcow2.py

@@ -3,7 +3,6 @@
 # - https://github.com/qemu/qemu/blob/master/docs/interop/qcow2.txt
 from __future__ import annotations
 
-import copy
 import zlib
 from functools import cached_property, lru_cache
 from io import BytesIO
@@ -15,6 +14,7 @@ from dissect.util.stream import AlignedStream
 from dissect.hypervisor.disk.c_qcow2 import (
     NORMAL_SUBCLUSTER_TYPES,
     QCOW2_MAGIC,
+    QCOW2_MAGIC_BYTES,
     UNALLOCATED_SUBCLUSTER_TYPES,
     ZERO_SUBCLUSTER_TYPES,
     QCow2ClusterType,
@@ -35,28 +35,42 @@ except ImportError:
     HAS_ZSTD = False
 
 
-ALLOW_NO_BACKING_FILE = 1
-
-
-class QCow2(AlignedStream):
+class QCow2:
     """QCOW2 virtual disk implementation.
 
-    Supports both data-file and backing-file, but must be manually given as arguments.
+    If a data-file is required and ``fh`` is not a ``Path``, it's required to manually pass a file like object
+    in the `data_file` argument. Otherwise, the data file will be automatically opened if it exists in the same directory.
+    It's possible to defer opening the data file by passing ``allow_no_data_file=True``.
 
-    If a data-file is required, it's required to manually pass a file like object
-    as the `data_file` argument.
+    The same applies to the backing-file. This too can be deferred by passing ``allow_no_backing_file=True``.
 
-    A backing-file can optionally be skipped if `qcow2.ALLOW_NO_BACKING_FILE` is passed
-    as the `backing_file` argument. In this case, any reads from a backing file will result
-    in all null bytes being read.
-    """
+    Args:
+        fh: File handle or path to the QCOW2 file.
+        data_file: Optional file handle for the data file. If not provided and ``fh`` is a ``Path``, it will try to open it automatically.
+        backing_file: Optional file handle for the backing file. If not provided and ``fh`` is a ``Path``, it will try to open it automatically.
+        allow_no_data_file: If True, allows the QCOW2 file to be opened without a data file.
+        allow_no_backing_file: If True, allows the QCOW2 file to be opened without a backing file.
+    """  # noqa: E501
 
     def __init__(
-        self, fh: BinaryIO | Path, data_file: BinaryIO | None = None, backing_file: BinaryIO | int | None = None
+        self,
+        fh: BinaryIO | Path,
+        data_file: BinaryIO | None = None,
+        backing_file: BinaryIO | None = None,
+        *,
+        allow_no_data_file: bool = False,
+        allow_no_backing_file: bool = False,
     ):
-        self.fh = fh.open("rb") if isinstance(fh, Path) else fh
+        if isinstance(fh, Path):
+            self.path = fh
+            self.fh = self.path.open("rb")
+        else:
+            self.path = None
+            self.fh = fh
 
-        self.header = c_qcow2.QCowHeader(fh)
+        self.fh.seek(0)
+
+        self.header = c_qcow2.QCowHeader(self.fh)
         if self.header.magic != QCOW2_MAGIC:
             raise InvalidHeaderError("Invalid qcow2 header magic")
 
@@ -66,14 +80,16 @@ class QCow2(AlignedStream):
         if self.header.cluster_bits < c_qcow2.MIN_CLUSTER_BITS or self.header.cluster_bits > c_qcow2.MAX_CLUSTER_BITS:
             raise InvalidHeaderError(f"Unsupported cluster size: 2**{self.header.cluster_bits}")
 
+        self.size = self.header.size
+
         self.cluster_bits = self.header.cluster_bits
         self.cluster_size = 1 << self.cluster_bits
         self.subclusters_per_cluster = c_qcow2.QCOW_EXTL2_SUBCLUSTERS_PER_CLUSTER if self.has_subclusters else 1
         self.subcluster_size = self.cluster_size // self.subclusters_per_cluster
-        self.subcluster_bits = ctz(self.subcluster_size, 32)
+        self.subcluster_bits = ctz(self.subcluster_size)
 
         self._l2_entry_size = c_qcow2.L2E_SIZE_EXTENDED if self.has_subclusters else c_qcow2.L2E_SIZE_NORMAL
-        self.l2_bits = self.cluster_bits - ctz(self._l2_entry_size, 32)
+        self.l2_bits = self.cluster_bits - ctz(self._l2_entry_size)
         self.l2_size = 1 << self.l2_bits
 
         # 104 = byte offset of compression_type
@@ -103,10 +119,8 @@ class QCow2(AlignedStream):
         self.unknown_extensions = []
         self._read_extensions()
 
-        if self.header.incompatible_features & c_qcow2.QCOW2_INCOMPAT_DATA_FILE:
-            if data_file is None:
-                raise Error(f"data-file required but not provided (image_data_file = {self.image_data_file})")
-            self.data_file = data_file
+        if self.needs_data_file:
+            self.data_file = self._open_data_file(data_file, allow_no_data_file)
         else:
             self.data_file = self.fh
 
@@ -118,24 +132,10 @@ class QCow2(AlignedStream):
             self.auto_backing_file = self.fh.read(self.header.backing_file_size).decode()
             self.image_backing_file = self.auto_backing_file.upper()
 
-            if backing_file is None:
-                if not isinstance(fh, Path):
-                    raise Error(
-                        f"backing-file required but not provided (auto_backing_file = {self.auto_backing_file})"
-                    )
-                if not (candidate_path := fh.parent.joinpath(self.auto_backing_file)).exists():
-                    raise Error(
-                        f"backing-file '{candidate_path}' not found (auto_backing_file = '{self.auto_backing_file}')"
-                    )
-                backing_file = candidate_path.open("rb")
-
-            if backing_file != ALLOW_NO_BACKING_FILE:
-                self.backing_file = backing_file
+            self.backing_file = self._open_backing_file(backing_file, allow_no_backing_file)
 
         self.l2_table = lru_cache(128)(self.l2_table)
 
-        super().__init__(self.header.size)
-
     def _read_extensions(self) -> None:
         start_offset = self.header.header_length
         end_offset = self.header.backing_file_offset or 1 << self.cluster_bits
@@ -169,14 +169,54 @@ class QCow2(AlignedStream):
             # Align to nearest 8 byte boundary
             offset += (ext.len + 7) & 0xFFFFFFF8
 
+    def _open_data_file(self, data_file: BinaryIO | None, allow_no_data_file: bool = False) -> BinaryIO | None:
+        if data_file is not None:
+            return data_file
+
+        if self.path:
+            if (data_file_path := self.path.with_name(self.image_data_file)).exists():
+                return data_file_path.open("rb")
+
+            if not allow_no_data_file:
+                raise Error(f"data-file {str(data_file_path)!r} not found (image_data_file = {self.image_data_file!r})")
+        elif allow_no_data_file:
+            return None
+
+        raise Error(f"data-file required but not provided (image_data_file = {self.image_data_file!r})")
+
+    def _open_backing_file(self, backing_file: BinaryIO | None, allow_no_backing_file: bool = False) -> BinaryIO | None:
+        backing_file_path = None
+        if backing_file is None:
+            if self.path:
+                if (backing_file_path := self.path.with_name(self.auto_backing_file)).exists():
+                    backing_file = backing_file_path.open("rb")
+                elif not allow_no_backing_file:
+                    raise Error(
+                        f"backing-file {str(backing_file_path)!r} not found (auto_backing_file = {self.auto_backing_file!r})"  # noqa: E501
+                    )
+            elif not allow_no_backing_file:
+                raise Error(f"backing-file required but not provided (auto_backing_file = {self.auto_backing_file!r})")
+
+        if backing_file:
+            if backing_file.read(4) == QCOW2_MAGIC_BYTES:
+                if backing_file_path:
+                    backing_file.close()
+                    backing_file = QCow2(backing_file_path).open()
+                else:
+                    backing_file = QCow2(backing_file).open()
+            else:
+                backing_file.seek(0)
+
+        return backing_file
+
     @cached_property
     def snapshots(self) -> list[QCow2Snapshot]:
-        snapshots = []
+        snapshots: list[QCow2Snapshot] = []
 
         offset = self.header.snapshots_offset
         for _ in range(self.header.nb_snapshots):
             snapshots.append(QCow2Snapshot(self, offset))
-            offset += snapshots[-1].entry_size
+            offset += (snapshots[-1].entry_size + 7) & ~7  # Round up to 8 bytes
 
         return snapshots
 
@@ -193,65 +233,72 @@ class QCow2(AlignedStream):
     def has_backing_file(self) -> bool:
         return self.backing_file is not None
 
+    @property
+    def needs_backing_file(self) -> bool:
+        return self.header.backing_file_offset != 0
+
     @property
     def has_data_file(self) -> bool:
-        return self.data_file != self.fh
+        return self.data_file is not None and self.data_file != self.fh
+
+    @property
+    def needs_data_file(self) -> bool:
+        return bool(self.header.incompatible_features & c_qcow2.QCOW2_INCOMPAT_DATA_FILE)
 
     @property
     def has_subclusters(self) -> bool:
         return bool(self.header.incompatible_features & c_qcow2.QCOW2_INCOMPAT_EXTL2)
 
-    def _read(self, offset: int, length: int) -> bytes:
-        result = []
+    def open(self) -> QCow2Stream:
+        """Open the QCow2 file for reading."""
+        if self.needs_data_file and not self.has_data_file:
+            raise Error(f"data-file required but not provided (image_data_file = {self.image_data_file!r})")
+        if self.needs_backing_file and not self.has_backing_file:
+            raise Error(f"backing-file required but not provided (auto_backing_file = {self.auto_backing_file!r})")
+        return QCow2Stream(self)
 
-        for sc_type, read_offset, run_offset, run_length in self._yield_runs(offset, length):
-            unalloc_zeroed = sc_type in UNALLOCATED_SUBCLUSTER_TYPES and not self.has_backing_file
 
-            if sc_type in ZERO_SUBCLUSTER_TYPES or unalloc_zeroed:
-                result.append(b"\x00" * run_length)
-            elif sc_type in UNALLOCATED_SUBCLUSTER_TYPES and self.has_backing_file:
-                self.backing_file.seek(read_offset)
-                result.append(self.backing_file.read(run_length))
-            elif sc_type == QCow2SubclusterType.QCOW2_SUBCLUSTER_COMPRESSED:
-                result.append(self._read_compressed(run_offset, read_offset, run_length))
-            elif sc_type == QCow2SubclusterType.QCOW2_SUBCLUSTER_NORMAL:
-                self.data_file.seek(run_offset)
-                result.append(self.data_file.read(run_length))
+class QCow2Snapshot:
+    """Wrapper class for snapshot table entries."""
 
-        return b"".join(result)
+    def __init__(self, qcow2: QCow2, offset: int):
+        self.qcow2 = qcow2
+        self.offset = offset
 
-    def _read_compressed(self, cluster_descriptor: int, offset: int, length: int) -> bytes:
-        offset_in_cluster = offset_into_cluster(self, offset)
-        coffset = cluster_descriptor & self.cluster_offset_mask
-        nb_csectors = ((cluster_descriptor >> self.csize_shift) & self.csize_mask) + 1
-        # Original source uses the mask ~(~(QCOW2_COMPRESSED_SECTOR_SIZE - 1ULL))
-        # However bit inversion is weird in Python, and this evaluates to 511, so we use that value instead.
-        csize = nb_csectors * c_qcow2.QCOW2_COMPRESSED_SECTOR_SIZE - (coffset & 511)
+        self.qcow2.fh.seek(offset)
+        self.header = c_qcow2.QCowSnapshotHeader(self.qcow2.fh)
 
-        self.fh.seek(coffset)
-        buf = self.fh.read(csize)
-        decompressed = self._decompress(buf)
+        # Older versions may not have all the extra data fields
+        # Instead of reading them manually, just pad the extra data to fit our struct
+        extra_data = self.qcow2.fh.read(self.header.extra_data_size)
+        self.extra = c_qcow2.QCowSnapshotExtraData(extra_data.ljust(len(c_qcow2.QCowSnapshotExtraData), b"\x00"))
 
-        return decompressed[offset_in_cluster : offset_in_cluster + length]
+        unknown_extra_size = self.header.extra_data_size - len(c_qcow2.QCowSnapshotExtraData)
+        self.unknown_extra = self.qcow2.fh.read(unknown_extra_size) if unknown_extra_size > 0 else None
 
-    def _decompress(self, buf: bytes) -> bytes:
-        if self.compression_type == c_qcow2.QCOW2_COMPRESSION_TYPE_ZLIB:
-            dctx = zlib.decompressobj(-12)
-            return dctx.decompress(buf, self.cluster_size)
+        self.id = self.qcow2.fh.read(self.header.id_str_size).decode()
+        self.name = self.qcow2.fh.read(self.header.name_size).decode()
 
-        if self.compression_type == c_qcow2.QCOW2_COMPRESSION_TYPE_ZSTD:
-            result = []
+        self.entry_size = self.qcow2.fh.tell() - offset
 
-            dctx = zstd.ZstdDecompressor()
-            reader = dctx.stream_reader(BytesIO(buf))
-            while reader.tell() < self.cluster_size:
-                chunk = reader.read(self.cluster_size - reader.tell())
-                if not chunk:
-                    break
-                result.append(chunk)
-            return b"".join(result)
+    def open(self) -> QCow2Stream:
+        """Open the snapshot for reading."""
+        return QCow2Stream(self.qcow2, self.l1_table)
+
+    @cached_property
+    def l1_table(self) -> list[int]:
+        # L1 table is usually relatively small, it can be at most 32MB on PB or EB size disks
+        self.qcow2.fh.seek(self.header.l1_table_offset)
+        return c_qcow2.uint64[self.header.l1_size](self.qcow2.fh)
 
-        raise Error(f"Invalid compression type: {self.compression_type}")
+
+class QCow2Stream(AlignedStream):
+    """Aligned stream for reading QCow2 files."""
+
+    def __init__(self, qcow2: QCow2, l1_table: list[int] | None = None):
+        super().__init__(qcow2.header.size, align=qcow2.cluster_size)
+        self.qcow2 = qcow2
+        self.l1_table = l1_table or qcow2.l1_table
 
     def _yield_runs(self, offset: int, length: int) -> Iterator[tuple[QCow2SubclusterType, int, int, int]]:
         # reference: qcow2_get_host_offset
@@ -260,19 +307,19 @@ class QCow2(AlignedStream):
             host_offset = 0
             read_count = 0
 
-            l1_index = offset_to_l1_index(self, offset)
-            l2_index = offset_to_l2_index(self, offset)
-            sc_index = offset_to_sc_index(self, offset)
+            l1_index = offset_to_l1_index(self.qcow2, offset)
+            l2_index = offset_to_l2_index(self.qcow2, offset)
+            sc_index = offset_to_sc_index(self.qcow2, offset)
 
-            offset_in_cluster = offset_into_cluster(self, offset)
+            offset_in_cluster = offset_into_cluster(self.qcow2, offset)
 
             bytes_needed = length + offset_in_cluster
             # at the time being we just use the entire l2 table and not cached slices
             # this is actually the bytes available/remaining in this l2 table
-            bytes_available = (self.l2_size - l2_index) << self.cluster_bits
+            bytes_available = (self.qcow2.l2_size - l2_index) << self.qcow2.cluster_bits
             bytes_needed = min(bytes_needed, bytes_available)
 
-            if l1_index > self.header.l1_size:
+            if l1_index > self.qcow2.header.l1_size:
                 # bytes_needed is already the smaller value here
                 read_count = bytes_needed - offset_in_cluster
 
@@ -293,11 +340,11 @@ class QCow2(AlignedStream):
                 offset += read_count
                 continue
 
-            l2_table = self.l2_table(l2_offset)
+            l2_table = self.qcow2.l2_table(l2_offset)
             l2_entry = l2_table.entry(l2_index)
             l2_bitmap = l2_table.bitmap(l2_index)
 
-            sc_type = get_subcluster_type(self, l2_entry, l2_bitmap, sc_index)
+            sc_type = get_subcluster_type(self.qcow2, l2_entry, l2_bitmap, sc_index)
 
             if sc_type == QCow2SubclusterType.QCOW2_SUBCLUSTER_COMPRESSED:
                 host_offset = l2_entry & c_qcow2.L2E_COMPRESSED_OFFSET_SIZE_MASK
@@ -305,10 +352,10 @@ class QCow2(AlignedStream):
                 host_cluster_offset = l2_entry & c_qcow2.L2E_OFFSET_MASK
                 host_offset = host_cluster_offset + offset_in_cluster
 
-            nb_clusters = size_to_clusters(self, bytes_needed)
-            sc_count = count_contiguous_subclusters(self, nb_clusters, sc_index, l2_table, l2_index)
+            nb_clusters = size_to_clusters(self.qcow2, bytes_needed)
+            sc_count = count_contiguous_subclusters(self.qcow2, nb_clusters, sc_index, l2_table, l2_index)
             # this is the amount of contiguous bytes available of the same subcluster type
-            bytes_available = (sc_count + sc_index) << self.subcluster_bits
+            bytes_available = (sc_count + sc_index) << self.qcow2.subcluster_bits
 
             # account for the offset in the cluster
             read_count = min(bytes_available, bytes_needed) - offset_in_cluster
@@ -317,6 +364,58 @@ class QCow2(AlignedStream):
             length -= read_count
             offset += read_count
 
+    def _read_compressed(self, cluster_descriptor: int, offset: int, length: int) -> bytes:
+        offset_in_cluster = offset_into_cluster(self.qcow2, offset)
+        coffset = cluster_descriptor & self.qcow2.cluster_offset_mask
+        nb_csectors = ((cluster_descriptor >> self.qcow2.csize_shift) & self.qcow2.csize_mask) + 1
+        # Original source uses the mask ~(~(QCOW2_COMPRESSED_SECTOR_SIZE - 1ULL))
+        # However bit inversion is weird in Python, and this evaluates to 511, so we use that value instead.
+        csize = nb_csectors * c_qcow2.QCOW2_COMPRESSED_SECTOR_SIZE - (coffset & 511)
+
+        self.qcow2.fh.seek(coffset)
+        buf = self.qcow2.fh.read(csize)
+        decompressed = self._decompress(buf)
+
+        return decompressed[offset_in_cluster : offset_in_cluster + length]
+
+    def _decompress(self, buf: bytes) -> bytes:
+        if self.qcow2.compression_type == c_qcow2.QCOW2_COMPRESSION_TYPE_ZLIB:
+            dctx = zlib.decompressobj(-12)
+            return dctx.decompress(buf, self.qcow2.cluster_size)
+
+        if self.qcow2.compression_type == c_qcow2.QCOW2_COMPRESSION_TYPE_ZSTD:
+            result = []
+
+            dctx = zstd.ZstdDecompressor()
+            reader = dctx.stream_reader(BytesIO(buf))
+            while reader.tell() < self.qcow2.cluster_size:
+                chunk = reader.read(self.qcow2.cluster_size - reader.tell())
+                if not chunk:
+                    break
+                result.append(chunk)
+            return b"".join(result)
+
+        raise Error(f"Invalid compression type: {self.qcow2.compression_type}")
+
+    def _read(self, offset: int, length: int) -> bytes:
+        result = []
+
+        for sc_type, read_offset, run_offset, run_length in self._yield_runs(offset, length):
+            unalloc_zeroed = sc_type in UNALLOCATED_SUBCLUSTER_TYPES and not self.qcow2.has_backing_file
+
+            if sc_type in ZERO_SUBCLUSTER_TYPES or unalloc_zeroed:
+                result.append(b"\x00" * run_length)
+            elif sc_type in UNALLOCATED_SUBCLUSTER_TYPES and self.qcow2.has_backing_file:
+                self.qcow2.backing_file.seek(read_offset)
+                result.append(self.qcow2.backing_file.read(run_length))
+            elif sc_type == QCow2SubclusterType.QCOW2_SUBCLUSTER_COMPRESSED:
+                result.append(self._read_compressed(run_offset, read_offset, run_length))
+            elif sc_type == QCow2SubclusterType.QCOW2_SUBCLUSTER_NORMAL:
+                self.qcow2.data_file.seek(run_offset)
+                result.append(self.qcow2.data_file.read(run_length))
+
+        return b"".join(result)
+
 
 class L2Table:
     """Convenience class for accessing the L2 table."""
@@ -338,42 +437,6 @@ class L2Table:
         return 0
 
 
-class QCow2Snapshot:
-    """Wrapper class for snapshot table entries."""
-
-    def __init__(self, qcow2: QCow2, offset: int):
-        self.qcow2 = qcow2
-        self.offset = offset
-
-        self.qcow2.fh.seek(offset)
-        self.header = c_qcow2.QCowSnapshotHeader(self.qcow2.fh)
-
-        # Older versions may not have all the extra data fields
-        # Instead of reading them manually, just pad the extra data to fit our struct
-        extra_data = self.qcow2.fh.read(self.header.extra_data_size)
-        self.extra = c_qcow2.QCowSnapshotExtraData(extra_data.ljust(len(c_qcow2.QCowSnapshotExtraData), b"\x00"))
-
-        unknown_extra_size = self.header.extra_data_size - len(c_qcow2.QCowSnapshotExtraData)
-        self.unknown_extra = self.qcow2.fh.read(unknown_extra_size) if unknown_extra_size > 0 else None
-
-        self.id_str = self.qcow2.fh.read(self.header.id_str_size).decode()
-        self.name = self.qcow2.fh.read(self.header.name_size).decode()
-
-        self.entry_size = self.qcow2.fh.tell() - offset
-
-    def open(self) -> QCow2:
-        disk = copy.copy(self.qcow2)
-        disk.l1_table = self.l1_table
-        disk.seek(0)
-        return disk
-
-    @cached_property
-    def l1_table(self) -> list[int]:
-        # L1 table is usually relatively small, it can be at most 32MB on PB or EB size disks
-        self.qcow2.fh.seek(self.header.l1_table_offset)
-        return c_qcow2.uint64[self.header.l1_size](self.qcow2.fh)
-
-
 def offset_into_cluster(qcow2: QCow2, offset: int) -> int:
     return offset & (qcow2.cluster_size - 1)
 
@@ -471,16 +534,16 @@ def get_subcluster_range_type(
     sc_mask = (1 << sc_from) - 1
     if sc_type == QCow2SubclusterType.QCOW2_SUBCLUSTER_NORMAL:
         val = l2_bitmap | sc_mask  # QCOW_OFLAG_SUB_ALLOC_RANGE(0, sc_from)
-        return sc_type, ctz(val, 32) - sc_from
+        return sc_type, ctz(val) - sc_from
     if sc_type in ZERO_SUBCLUSTER_TYPES:
         val = (l2_bitmap | sc_mask) >> 32  # QCOW_OFLAG_SUB_ZERO_RANGE(0, sc_from)
-        return sc_type, ctz(val, 32) - sc_from
+        return sc_type, ctz(val) - sc_from
     if sc_type in UNALLOCATED_SUBCLUSTER_TYPES:
         # We need to mask it with a 64bit mask because Python flips the sign bit
         inv_mask = ~sc_mask & ((1 << 64) - 1)  # ~QCOW_OFLAG_SUB_ALLOC_RANGE(0, sc_from)
 
         val = ((l2_bitmap >> 32) | l2_bitmap) & inv_mask
-        return sc_type, ctz(val, 32) - sc_from
+        return sc_type, ctz(val) - sc_from
 
     raise Error(f"Invalid subcluster type: {sc_type}")
 

{dissect_hypervisor-3.19.dev1.dist-info → dissect_hypervisor-3.19.dev2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.hypervisor
-Version: 3.19.dev1
+Version: 3.19.dev2
 Summary: A Dissect module implementing parsers for various hypervisor disk, backup and configuration files
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_hypervisor-3.19.dev1.dist-info → dissect_hypervisor-3.19.dev2.dist-info}/RECORD

@@ -9,13 +9,14 @@ dissect/hypervisor/descriptor/vbox.py,sha256=TrfMN0BppjIoDeHVCMKlH1OS0IHO-V7uRFo
 dissect/hypervisor/descriptor/vmx.py,sha256=6xhX7RlDqyn9XBkiq2NnQ5LrLL0nXwiPGOPy3WVVAtI,12647
 dissect/hypervisor/disk/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/hypervisor/disk/c_hdd.py,sha256=wrJ5qwyf7QCZ3Pl-I8eYDR4CUUo4pAFhjzs8huRGqs8,2235
-dissect/hypervisor/disk/c_qcow2.py,sha256=oD4GaUGkTEwuusFg7I4uX3MNX_LtQKZS8QlYOz7ZnoY,5115
+dissect/hypervisor/disk/c_qcow2.py,sha256=jOr2fQmDQuegbE1qDX2x2xaA4RS0LKMsOCI5UwKJxhg,5071
+dissect/hypervisor/disk/c_qcow2.pyi,sha256=Rf-tCTf78F2fsVBYw04cZ2vNq2Xns7P1f86oSVe7zEU,7896
 dissect/hypervisor/disk/c_vdi.py,sha256=lKk5MnCImdfyUyGDe_yY_ntLd1ITkKEvMGIMCHiHC2w,3843
 dissect/hypervisor/disk/c_vhd.py,sha256=gYOwOdvhMKNLflugkpjmdn__ZUJBlxeByx6P0ePNQ00,1493
 dissect/hypervisor/disk/c_vhdx.py,sha256=4yNU51jfYPEBFXEZAvaF8cFdHBRlmCe_OU5ZU83-kco,2920
 dissect/hypervisor/disk/c_vmdk.py,sha256=lfObMyD9r-20DCDwVDm9xT98cq3aE4MCJF5TpDBNdd4,5988
 dissect/hypervisor/disk/hdd.py,sha256=ChKtQIQrssIgZyUv86JE9-n4XdjDT14pc6EO6mZllQg,12981
-dissect/hypervisor/disk/qcow2.py,sha256=tLVTtunhrvM6ELOGgwJtWNGBhRUWYRzeAHFbdkpTLZ4,21366
+dissect/hypervisor/disk/qcow2.py,sha256=j7GSgzYceSq6Nx7vw4M7Cm5irKqGDql1t9apl2gC1FY,24509
 dissect/hypervisor/disk/vdi.py,sha256=Ezm_vmi6ZKLTgPx5chXmtBzkBOCxilBWUrdqQdq_4KA,1958
 dissect/hypervisor/disk/vhd.py,sha256=GfEfFp5g8OlV0MrTXqSfBRzMMvIZO_T1A8d05SeGiBk,3948
 dissect/hypervisor/disk/vhdx.py,sha256=Yidz57PsH6IGRiN8cpfAnyZiOGt1qApd8ohVdHGF2mY,13215
@@ -26,10 +27,10 @@ dissect/hypervisor/tools/vmtar.py,sha256=bAf_rEhqUmeI8my22p7L9uV3SgB5C_61YQKfD3t
 dissect/hypervisor/util/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/hypervisor/util/envelope.py,sha256=EhZjZh3EezqxkJ84OgqpptHIhpVWPcUkFMjdYU-iAnU,10442
 dissect/hypervisor/util/vmtar.py,sha256=xzc4bd5RnBgP9_dCU9i-ZwXI_0S3N7gCfMzElwwnd5s,4004
-dissect_hypervisor-3.19.dev1.dist-info/licenses/COPYRIGHT,sha256=EOOoIwk_inOMUD4c1ylpzMtYLjGzmc-MLEVAEdLLr20,305
-dissect_hypervisor-3.19.dev1.dist-info/licenses/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
-dissect_hypervisor-3.19.dev1.dist-info/METADATA,sha256=BE14yQzzJCRJ1aREgqWsywnHXiYa0H85iCpNtnRM8WA,3434
-dissect_hypervisor-3.19.dev1.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-dissect_hypervisor-3.19.dev1.dist-info/entry_points.txt,sha256=kW36GnJ3G1dSRYFL4r8Bj32Al_CkGqST3bdHvo3pyiY,120
-dissect_hypervisor-3.19.dev1.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
-dissect_hypervisor-3.19.dev1.dist-info/RECORD,,
+dissect_hypervisor-3.19.dev2.dist-info/licenses/COPYRIGHT,sha256=EOOoIwk_inOMUD4c1ylpzMtYLjGzmc-MLEVAEdLLr20,305
+dissect_hypervisor-3.19.dev2.dist-info/licenses/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
+dissect_hypervisor-3.19.dev2.dist-info/METADATA,sha256=58CgYl9rnPBcQauWn5zLrrdF6jR6N6oI1eYENq8W3ek,3434
+dissect_hypervisor-3.19.dev2.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+dissect_hypervisor-3.19.dev2.dist-info/entry_points.txt,sha256=kW36GnJ3G1dSRYFL4r8Bj32Al_CkGqST3bdHvo3pyiY,120
+dissect_hypervisor-3.19.dev2.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
+dissect_hypervisor-3.19.dev2.dist-info/RECORD,,