dissect.hypervisor 3.20.dev2__tar.gz → 3.21__tar.gz

dissect_hypervisor-3.21/MANIFEST.in

@@ -0,0 +1,4 @@
+exclude .gitattributes
+exclude .gitignore
+recursive-exclude .github/ *
+recursive-exclude tests/_data/ *

{dissect_hypervisor-3.20.dev2 → dissect_hypervisor-3.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.hypervisor
-Version: 3.20.dev2
+Version: 3.21
 Summary: A Dissect module implementing parsers for various hypervisor disk, backup and configuration files
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -26,6 +26,7 @@ Requires-Dist: dissect.cstruct<5,>=4
 Requires-Dist: dissect.util<4,>=3
 Provides-Extra: full
 Requires-Dist: pycryptodome; extra == "full"
+Requires-Dist: backports.zstd; python_version < "3.14" and extra == "full"
 Provides-Extra: dev
 Requires-Dist: dissect.hypervisor[full]; extra == "dev"
 Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"

dissect_hypervisor-3.21/dissect/hypervisor/descriptor/vbox.py

@@ -0,0 +1,226 @@
+from __future__ import annotations
+
+from datetime import datetime
+from functools import cached_property
+from typing import TYPE_CHECKING, TextIO
+from uuid import UUID
+
+from defusedxml import ElementTree
+
+if TYPE_CHECKING:
+    from xml.etree.ElementTree import Element
+
+NS = "{http://www.virtualbox.org/}"
+
+
+class VBox:
+    """VirtualBox XML descriptor parser.
+
+    Args:
+        fh: A file-like object of the VirtualBox XML descriptor.
+    """
+
+    def __init__(self, fh: TextIO):
+        self._xml: Element = ElementTree.fromstring(fh.read())
+        if self._xml.tag != f"{NS}VirtualBox":
+            raise ValueError("Invalid VirtualBox XML descriptor: root element is not VirtualBox")
+
+        if (machine := self._xml.find(f"./{NS}Machine")) is None:
+            raise ValueError("Invalid VirtualBox XML descriptor: no Machine element found")
+
+        if machine.find(f"./{NS}Hardware") is None:
+            raise ValueError("Invalid VirtualBox XML descriptor: no Hardware element found")
+
+        self.machine = Machine(self, machine)
+
+    def __repr__(self) -> str:
+        return f"<VBox uuid={self.uuid} name={self.name}>"
+
+    @property
+    def uuid(self) -> UUID | None:
+        """The VM UUID."""
+        return self.machine.uuid
+
+    @property
+    def name(self) -> str | None:
+        """The VM name."""
+        return self.machine.name
+
+    @property
+    def media(self) -> dict[UUID, HardDisk]:
+        """The media (disks) registry."""
+        return self.machine.media
+
+    @property
+    def hardware(self) -> Hardware:
+        """The current machine hardware state."""
+        return self.machine.hardware
+
+    @property
+    def snapshots(self) -> dict[UUID, Snapshot]:
+        """All snapshots."""
+        return self.machine.snapshots
+
+
+class Machine:
+    def __init__(self, vbox: VBox, element: Element):
+        self.vbox = vbox
+        self.element = element
+
+    def __repr__(self) -> str:
+        return f"<Machine uuid={self.uuid} name={self.name}>"
+
+    @property
+    def uuid(self) -> UUID:
+        """The machine UUID."""
+        return UUID(self.element.get("uuid").strip("{}"))
+
+    @property
+    def name(self) -> str:
+        """The machine name."""
+        return self.element.get("name")
+
+    @property
+    def current_snapshot(self) -> UUID | None:
+        """The current snapshot UUID."""
+        if (value := self.element.get("currentSnapshot")) is not None:
+            return UUID(value.strip("{}"))
+        return None
+
+    @cached_property
+    def media(self) -> dict[UUID, HardDisk]:
+        """The media (disks) registry."""
+        result = {}
+
+        stack = [(None, element) for element in self.element.find(f"./{NS}MediaRegistry/{NS}HardDisks")]
+        while stack:
+            parent, element = stack.pop()
+            hdd = HardDisk(self, element, parent)
+            result[hdd.uuid] = hdd
+
+            stack.extend([(hdd, child) for child in element.findall(f"./{NS}HardDisk")])
+
+        return result
+
+    @cached_property
+    def hardware(self) -> Hardware:
+        """The machine hardware state."""
+        return Hardware(self.vbox, self.element.find(f"./{NS}Hardware"))
+
+    @cached_property
+    def snapshots(self) -> dict[UUID, Snapshot]:
+        """All snapshots."""
+        result = {}
+
+        if (element := self.element.find(f"./{NS}Snapshot")) is None:
+            return result
+
+        stack = [(None, element)]
+        while stack:
+            parent, element = stack.pop()
+            snapshot = Snapshot(self.vbox, element, parent)
+            result[snapshot.uuid] = snapshot
+
+            if (snapshots := element.find(f"./{NS}Snapshots")) is not None:
+                stack.extend([(snapshot, child) for child in list(snapshots)])
+
+        return result
+
+    @property
+    def parent(self) -> Snapshot | None:
+        if (uuid := self.current_snapshot) is not None:
+            return self.vbox.snapshots[uuid]
+        return None
+
+
+class HardDisk:
+    def __init__(self, vbox: VBox, element: Element, parent: HardDisk | None = None):
+        self.vbox = vbox
+        self.element = element
+        self.parent = parent
+
+    def __repr__(self) -> str:
+        return f"<HardDisk uuid={self.uuid} location={self.location}>"
+
+    @property
+    def uuid(self) -> UUID:
+        """The disk UUID."""
+        return UUID(self.element.get("uuid").strip("{}"))
+
+    @property
+    def location(self) -> str:
+        """The disk location."""
+        return self.element.get("location")
+
+    @property
+    def type(self) -> str | None:
+        """The disk type."""
+        return self.element.get("type")
+
+    @property
+    def format(self) -> str:
+        """The disk format."""
+        return self.element.get("format")
+
+    @cached_property
+    def properties(self) -> dict[str, str]:
+        """The disk properties."""
+        return {prop.get("name"): prop.get("value") for prop in self.element.findall(f"./{NS}Property")}
+
+    @property
+    def is_encrypted(self) -> bool:
+        """Whether the disk is encrypted."""
+        disk = self
+        while disk is not None:
+            if "CRYPT/KeyId" in disk.properties or "CRYPT/KeyStore" in disk.properties:
+                return True
+            disk = disk.parent
+
+        return False
+
+
+class Snapshot:
+    def __init__(self, vbox: VBox, element: Element, parent: Snapshot | Machine | None = None):
+        self.vbox = vbox
+        self.element = element
+        self.parent = parent
+
+    def __repr__(self) -> str:
+        return f"<Snapshot uuid={self.uuid} name={self.name}>"
+
+    @property
+    def uuid(self) -> UUID:
+        """The snapshot UUID."""
+        return UUID(self.element.get("uuid").strip("{}"))
+
+    @property
+    def name(self) -> str:
+        """The snapshot name."""
+        return self.element.get("name")
+
+    @property
+    def ts(self) -> datetime:
+        """The snapshot timestamp."""
+        return datetime.strptime(self.element.get("timeStamp"), "%Y-%m-%dT%H:%M:%S%z")
+
+    @cached_property
+    def hardware(self) -> Hardware:
+        """The snapshot hardware state."""
+        return Hardware(self.vbox, self.element.find(f"./{NS}Hardware"))
+
+
+class Hardware:
+    def __init__(self, vbox: VBox, element: Element):
+        self.vbox = vbox
+        self.element = element
+
+    def __repr__(self) -> str:
+        return f"<Hardware disks={len(self.disks)}>"
+
+    @property
+    def disks(self) -> list[HardDisk]:
+        """All attached hard disks."""
+        images = self.element.findall(
+            f"./{NS}StorageControllers/{NS}StorageController/{NS}AttachedDevice[@type='HardDisk']/{NS}Image"
+        )
+        return [self.vbox.media[UUID(image.get("uuid").strip("{}"))] for image in images]

dissect_hypervisor-3.21/dissect/hypervisor/disk/c_vdi.py

@@ -0,0 +1,98 @@
+from __future__ import annotations
+
+from dissect.cstruct import cstruct
+
+# https://github.com/VirtualBox/virtualbox/blob/main/src/VBox/Storage/VDICore.h
+vdi_def = """
+enum VDI_IMAGE_TYPE {
+    /** Normal dynamically growing base image file. */
+    NORMAL          = 1,
+    /** Preallocated base image file of a fixed size. */
+    FIXED,
+    /** Dynamically growing image file for undo/commit changes support. */
+    UNDO,
+    /** Dynamically growing image file for differencing support. */
+    DIFF,
+};
+
+flag VDI_IMAGE_FLAGS {
+    /** Fill new blocks with zeroes while expanding image file. Only valid
+     * for newly created images, never set for opened existing images. */
+    ZERO_EXPAND     = 0x0100,
+};
+
+typedef struct VDIDISKGEOMETRY {
+    /** Cylinders. */
+    uint32_t        Cylinders;
+    /** Heads. */
+    uint32_t        Heads;
+    /** Sectors per track. */
+    uint32_t        Sectors;
+    /** Sector size. (bytes per sector) */
+    uint32_t        Sector;
+} VDIDISKGEOMETRY, *PVDIDISKGEOMETRY;
+
+typedef struct VDIPREHEADER {
+    /** Just text info about image type, for eyes only. */
+    char            szFileInfo[64];
+    /** The image signature (VDI_IMAGE_SIGNATURE). */
+    uint32_t        u32Signature;
+    /** The image version (VDI_IMAGE_VERSION). */
+    uint32_t        u32Version;
+} VDIPREHEADER, *PVDIPREHEADER;
+
+/**
+ * Size of Comment field of HDD image header.
+ */
+#define VDI_IMAGE_COMMENT_SIZE      256
+
+/* NOTE: All the header versions are additive, so just use the latest one. */
+typedef struct VDIHEADER1PLUS {
+    /** Size of this structure in bytes. */
+    uint32_t        cbHeader;
+    /** The image type (VDI_IMAGE_TYPE_*). */
+    VDI_IMAGE_TYPE  u32Type;
+    /** Image flags (VDI_IMAGE_FLAGS_*). */
+    VDI_IMAGE_FLAGS fFlags;
+    /** Image comment. (UTF-8) */
+    char            szComment[VDI_IMAGE_COMMENT_SIZE];
+    /** Offset of blocks array from the beginning of image file.
+     * Should be sector-aligned for HDD access optimization. */
+    uint32_t        offBlocks;
+    /** Offset of image data from the beginning of image file.
+     * Should be sector-aligned for HDD access optimization. */
+    uint32_t        offData;
+    /** Legacy image geometry (previous code stored PCHS there). */
+    VDIDISKGEOMETRY LegacyGeometry;
+    /** Was BIOS HDD translation mode, now unused. */
+    uint32_t        u32Dummy;
+    /** Size of disk (in bytes). */
+    uint64_t        cbDisk;
+    /** Block size. (For instance VDI_IMAGE_BLOCK_SIZE.) Should be a power of 2! */
+    uint32_t        cbBlock;
+    /** Size of additional service information of every data block.
+     * Prepended before block data. May be 0.
+     * Should be a power of 2 and sector-aligned for optimization reasons. */
+    uint32_t        cbBlockExtra;
+    /** Number of blocks. */
+    uint32_t        cBlocks;
+    /** Number of allocated blocks. */
+    uint32_t        cBlocksAllocated;
+    /** UUID of image. */
+    char            uuidCreate[16];
+    /** UUID of image's last modification. */
+    char            uuidModify[16];
+    /** Only for secondary images - UUID of previous image. */
+    char            uuidLinkage[16];
+    /** Only for secondary images - UUID of previous image's last modification. */
+    char            uuidParentModify[16];
+    /** LCHS image geometry (new field in VDI1.2 version. */
+    VDIDISKGEOMETRY Geometry;
+} VDIHEADER1PLUS, *PVDIHEADER1PLUS;
+"""
+
+c_vdi = cstruct().load(vdi_def)
+
+VDI_IMAGE_SIGNATURE = 0xBEDA107F
+VDI_IMAGE_BLOCK_FREE = ~0
+VDI_IMAGE_BLOCK_ZERO = ~1

dissect_hypervisor-3.21/dissect/hypervisor/disk/c_vdi.pyi

@@ -0,0 +1,100 @@
+# Generated by cstruct-stubgen
+from typing import BinaryIO, Literal, TypeAlias, overload
+
+import dissect.cstruct as __cs__
+
+class _c_vdi(__cs__.cstruct):
+    VDI_IMAGE_COMMENT_SIZE: Literal[256] = ...
+    class VDI_IMAGE_TYPE(__cs__.Enum):
+        NORMAL = ...
+        FIXED = ...
+        UNDO = ...
+        DIFF = ...
+
+    class VDI_IMAGE_FLAGS(__cs__.Flag):
+        ZERO_EXPAND = ...
+
+    class VDIDISKGEOMETRY(__cs__.Structure):
+        Cylinders: _c_vdi.uint32
+        Heads: _c_vdi.uint32
+        Sectors: _c_vdi.uint32
+        Sector: _c_vdi.uint32
+        @overload
+        def __init__(
+            self,
+            Cylinders: _c_vdi.uint32 | None = ...,
+            Heads: _c_vdi.uint32 | None = ...,
+            Sectors: _c_vdi.uint32 | None = ...,
+            Sector: _c_vdi.uint32 | None = ...,
+        ): ...
+        @overload
+        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+    PVDIDISKGEOMETRY: TypeAlias = __cs__.Pointer[_c_vdi.VDIDISKGEOMETRY]
+    class VDIPREHEADER(__cs__.Structure):
+        szFileInfo: __cs__.CharArray
+        u32Signature: _c_vdi.uint32
+        u32Version: _c_vdi.uint32
+        @overload
+        def __init__(
+            self,
+            szFileInfo: __cs__.CharArray | None = ...,
+            u32Signature: _c_vdi.uint32 | None = ...,
+            u32Version: _c_vdi.uint32 | None = ...,
+        ): ...
+        @overload
+        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+    PVDIPREHEADER: TypeAlias = __cs__.Pointer[_c_vdi.VDIPREHEADER]
+    class VDIHEADER1PLUS(__cs__.Structure):
+        cbHeader: _c_vdi.uint32
+        u32Type: _c_vdi.VDI_IMAGE_TYPE
+        fFlags: _c_vdi.VDI_IMAGE_FLAGS
+        szComment: __cs__.CharArray
+        offBlocks: _c_vdi.uint32
+        offData: _c_vdi.uint32
+        LegacyGeometry: _c_vdi.VDIDISKGEOMETRY
+        u32Dummy: _c_vdi.uint32
+        cbDisk: _c_vdi.uint64
+        cbBlock: _c_vdi.uint32
+        cbBlockExtra: _c_vdi.uint32
+        cBlocks: _c_vdi.uint32
+        cBlocksAllocated: _c_vdi.uint32
+        uuidCreate: __cs__.CharArray
+        uuidModify: __cs__.CharArray
+        uuidLinkage: __cs__.CharArray
+        uuidParentModify: __cs__.CharArray
+        Geometry: _c_vdi.VDIDISKGEOMETRY
+        @overload
+        def __init__(
+            self,
+            cbHeader: _c_vdi.uint32 | None = ...,
+            u32Type: _c_vdi.VDI_IMAGE_TYPE | None = ...,
+            fFlags: _c_vdi.VDI_IMAGE_FLAGS | None = ...,
+            szComment: __cs__.CharArray | None = ...,
+            offBlocks: _c_vdi.uint32 | None = ...,
+            offData: _c_vdi.uint32 | None = ...,
+            LegacyGeometry: _c_vdi.VDIDISKGEOMETRY | None = ...,
+            u32Dummy: _c_vdi.uint32 | None = ...,
+            cbDisk: _c_vdi.uint64 | None = ...,
+            cbBlock: _c_vdi.uint32 | None = ...,
+            cbBlockExtra: _c_vdi.uint32 | None = ...,
+            cBlocks: _c_vdi.uint32 | None = ...,
+            cBlocksAllocated: _c_vdi.uint32 | None = ...,
+            uuidCreate: __cs__.CharArray | None = ...,
+            uuidModify: __cs__.CharArray | None = ...,
+            uuidLinkage: __cs__.CharArray | None = ...,
+            uuidParentModify: __cs__.CharArray | None = ...,
+            Geometry: _c_vdi.VDIDISKGEOMETRY | None = ...,
+        ): ...
+        @overload
+        def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+    PVDIHEADER1PLUS: TypeAlias = __cs__.Pointer[_c_vdi.VDIHEADER1PLUS]
+
+# Technically `c_vdi` is an instance of `_c_vdi`, but then we can't use it in type hints
+c_vdi: TypeAlias = _c_vdi
+
+VDI_IMAGE_SIGNATURE: int
+VDI_IMAGE_BLOCK_FREE: int
+VDI_IMAGE_BLOCK_ZERO: int

{dissect_hypervisor-3.20.dev2 → dissect_hypervisor-3.21}/dissect/hypervisor/disk/qcow2.py

@@ -3,9 +3,9 @@
 # - https://github.com/qemu/qemu/blob/master/docs/interop/qcow2.txt
 from __future__ import annotations
 
+import sys
 import zlib
 from functools import cached_property, lru_cache
-from io import BytesIO
 from pathlib import Path
 from typing import TYPE_CHECKING, BinaryIO
 
@@ -28,8 +28,10 @@ if TYPE_CHECKING:
     from collections.abc import Iterator
 
 try:
-    import zstandard as zstd
-
+    if sys.version_info >= (3, 14):
+        from compression import zstd  # novermin
+    else:
+        from backports import zstd
     HAS_ZSTD = True
 except ImportError:
     HAS_ZSTD = False
@@ -384,16 +386,8 @@ class QCow2Stream(AlignedStream):
             return dctx.decompress(buf, self.qcow2.cluster_size)
 
         if self.qcow2.compression_type == c_qcow2.QCOW2_COMPRESSION_TYPE_ZSTD:
-            result = []
-
             dctx = zstd.ZstdDecompressor()
-            reader = dctx.stream_reader(BytesIO(buf))
-            while reader.tell() < self.qcow2.cluster_size:
-                chunk = reader.read(self.qcow2.cluster_size - reader.tell())
-                if not chunk:
-                    break
-                result.append(chunk)
-            return b"".join(result)
+            return dctx.decompress(buf, self.qcow2.cluster_size)
 
         raise Error(f"Invalid compression type: {self.qcow2.compression_type}")
 

dissect_hypervisor-3.21/dissect/hypervisor/disk/vdi.py

@@ -0,0 +1,140 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING, BinaryIO
+
+from dissect.util.stream import AlignedStream
+from dissect.util.xmemoryview import xmemoryview
+
+from dissect.hypervisor.disk.c_vdi import VDI_IMAGE_BLOCK_FREE, VDI_IMAGE_BLOCK_ZERO, VDI_IMAGE_SIGNATURE, c_vdi
+from dissect.hypervisor.exceptions import Error
+
+if TYPE_CHECKING:
+    from types import TracebackType
+
+    from typing_extensions import Self
+
+
+class VDI:
+    """VirtualBox Virtual Disk Image (VDI) implementation.
+
+    Use :method:`open` to get a stream for reading from the VDI file. The stream will handle reading
+    from the parent disk if necessary (and provided).
+
+    If provided with a file-like object, the caller is responsible for closing it.
+    When provided with a path, the VDI class will manage the file handle.
+
+    If providing a parent file-like object, the caller is responsible for the lifecycle of that object.
+
+    Args:
+        fh: File-like object or path of the VDI file.
+        parent: Optional file-like object for the parent disk (for differencing disks).
+    """
+
+    def __init__(self, fh: BinaryIO | Path, parent: BinaryIO | None = None):
+        if isinstance(fh, Path):
+            self.path = fh
+            self.fh = self.path.open("rb")
+        else:
+            self.path = None
+            self.fh = fh
+
+        self.parent = parent
+
+        self.fh.seek(0)
+        self.preheader = c_vdi.VDIPREHEADER(self.fh)
+        if self.preheader.u32Signature != VDI_IMAGE_SIGNATURE:
+            raise Error(
+                f"Invalid VDI signature, expected {VDI_IMAGE_SIGNATURE:#08X}, got {self.preheader.u32Signature:#08X}"
+            )
+
+        self.header = c_vdi.VDIHEADER1PLUS(self.fh)
+
+    def __enter__(self) -> Self:
+        return self
+
+    def __exit__(
+        self, exc_type: type[BaseException] | None, exc_value: BaseException | None, traceback: TracebackType | None
+    ) -> None:
+        self.close()
+
+    @property
+    def type(self) -> c_vdi.VDI_IMAGE_TYPE:
+        """The type of the VDI file."""
+        return self.header.u32Type
+
+    @property
+    def flags(self) -> c_vdi.VDI_IMAGE_FLAGS:
+        """The flags of the VDI file."""
+        return self.header.fFlags
+
+    @property
+    def size(self) -> int:
+        """The size of the virtual disk."""
+        return self.header.cbDisk
+
+    @property
+    def block_size(self) -> int:
+        """The size of each block in the VDI file."""
+        return self.header.cbBlock
+
+    @property
+    def data_offset(self) -> int:
+        """The offset to the data blocks."""
+        return self.header.offData
+
+    @property
+    def blocks_offset(self) -> int:
+        """The offset to the block allocation table."""
+        return self.header.offBlocks
+
+    @property
+    def number_of_blocks(self) -> int:
+        """The number of blocks in the VDI file."""
+        return self.header.cBlocks
+
+    def open(self) -> VDIStream:
+        """Open a stream to read from the VDI file."""
+        return VDIStream(self)
+
+    def close(self) -> None:
+        """Close the VDI file handle."""
+        if self.path is not None:
+            self.fh.close()
+
+
+class VDIStream(AlignedStream):
+    def __init__(self, vdi: VDI):
+        self.vdi = vdi
+        self.block_size = vdi.block_size
+
+        self.fh = self.vdi.fh
+        self.fh.seek(self.vdi.blocks_offset)
+        self.map = xmemoryview(self.fh.read(4 * self.vdi.number_of_blocks), "<i")
+        super().__init__(vdi.size, align=self.block_size)
+
+    def _read(self, offset: int, length: int) -> bytes:
+        result = []
+
+        block_idx, offset_in_block = divmod(offset, self.block_size)
+        while length > 0:
+            read_len = min(length, max(length, self.block_size - offset_in_block))
+
+            block = self.map[block_idx]
+            if block == VDI_IMAGE_BLOCK_FREE:
+                if self.vdi.parent is not None:
+                    self.vdi.parent.seek(offset)
+                    result.append(self.vdi.parent.read(read_len))
+                else:
+                    result.append(b"\x00" * read_len)
+            elif block == VDI_IMAGE_BLOCK_ZERO:
+                result.append(b"\x00" * read_len)
+            else:
+                self.fh.seek(self.vdi.data_offset + (block * self.block_size) + offset_in_block)
+                result.append(self.fh.read(read_len))
+
+            offset += read_len
+            length -= read_len
+            block_idx += 1
+
+        return b"".join(result)

{dissect_hypervisor-3.20.dev2 → dissect_hypervisor-3.21}/dissect/hypervisor/disk/vmdk.py

@@ -407,7 +407,7 @@ RE_EXTENT_DESCRIPTOR = re.compile(
     ^
     (?P<access_mode>RW|RDONLY|NOACCESS)\s
     (?P<sectors>\d+)\s
-    (?P<type>SPARSE|ZERO|FLAT|VMFS|VMFSSPARSE|VMFSRDM|VMFSRAW)
+    (?P<type>SESPARSE|SPARSE|ZERO|FLAT|VMFS|VMFSSPARSE|VMFSRDM|VMFSRAW)
     (\s(?P<filename>\".+\"))?
     (\s(?P<start_sector>\d+))?
     (\s(?P<partition_uuid>\S+))?
@@ -535,8 +535,10 @@ def open_parent(path: Path, filename_hint: str) -> VMDK:
         hint_path, _, filename = filename_hint.rpartition("/")
         filepath = path.joinpath(filename)
         if not filepath.exists():
-            _, _, hint_path_name = hint_path.rpartition("/")
-            filepath = path.parent.joinpath(hint_path_name).joinpath(filename)
+            filepath = path.joinpath(filename_hint)
+            if not filepath.exists():
+                _, _, hint_path_name = hint_path.rpartition("/")
+                filepath = path.parent.joinpath(hint_path_name).joinpath(filename)
         vmdk = VMDK(filepath)
     except Exception as err:
         raise IOError(f"Failed to open parent disk with hint {filename_hint} from path {path}: {err}")

{dissect_hypervisor-3.20.dev2 → dissect_hypervisor-3.21}/dissect.hypervisor.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.hypervisor
-Version: 3.20.dev2
+Version: 3.21
 Summary: A Dissect module implementing parsers for various hypervisor disk, backup and configuration files
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -26,6 +26,7 @@ Requires-Dist: dissect.cstruct<5,>=4
 Requires-Dist: dissect.util<4,>=3
 Provides-Extra: full
 Requires-Dist: pycryptodome; extra == "full"
+Requires-Dist: backports.zstd; python_version < "3.14" and extra == "full"
 Provides-Extra: dev
 Requires-Dist: dissect.hypervisor[full]; extra == "dev"
 Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"