Lines Matching +full:suspend +full:- +full:to +full:- +full:disk
2 #------------------------------------------------------------------------------
5 # Microsoft hard disk images for:
10 # Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/
11 # Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc
12 0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC
14 #0 string conectix Microsoft Virtual Hard Disk image
16 !:mime application/x-virtualbox-vhd
18 # Features is a bit field used to indicate specific feature support
20 # Reserved. This bit must always be set to 1.
27 # Dynamic Disk Header cookie like cxsparse
28 #>(16.Q) string x "%-.8s"
29 # This field contains a Unicode string (UTF-16) of the parent hard disk filename
33 >28 string x \b, Creator %-4.4s
48 #>40 ubequad x \b, o.-Size %#llx
49 # Current Size is same as original size, but change when disk is expanded
52 # Disk Geometry: cylinder, heads, and sectors/track for hard disk
61 # Disk Type: 3~Dynamic hard disk
65 # universally unique identifier (UUID) to associate a parent with its differencing image
67 #>76 ubequad x \b-%16.16llx
74 # URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx
76 # MS-VHDX/[MS-VHDX].pdf
78 # TODO: find and display values like virtual size, disk size, cluster_size, etc
84 >0x10000 string head Microsoft Disk Image eXtended
86 #!:mime application/x-virtualbox-vhdx
90 # The Checksum field is a CRC-32C hash over the entire 4 KB structure
96 #>>>0x10018 ubequad x \b-%llx
99 #>>>0x10028 ubequad x \b-%llx
102 >>>0x10038 ubequad x \b-%llx
103 # LogVersion. If not 0 there is a log to replay
105 # Version. This field must be set to 1
124 # Log Entry Reserved must be set to 0
128 #>>>(0x10048.q+40) ubequad x \b-%llx
138 >0x30000 ulelong !0x69676572 Microsoft Disk Image Extended, 1st region INVALID
139 >0x30000 ulelong =0x69676572 Microsoft Disk Image Extended; region
140 # region Checksum. CRC-32C hash over the entire 64-KB table
147 >>0x30010 use vhdx-id
152 # 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
155 >>0x30030 use vhdx-id
158 # 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
163 0 name vhdx-id
164 # https://www.windowstricks.in/online-windows-guid-converter
165 # 2DC27766-F623-4200-9D64-115E9BFD4A08 BAT GUID
171 >>>0 use vhdx-id-hex
172 # 8B7CA206-4790-4B9A-B8FE-575F050F886E Metadata region GUID
178 >>>0 use vhdx-id-hex
179 # 2FA54224-CD1B-4876-B211-5DBED83BF4B8 Virtual Disk Size GUID
180 # 2442A52F1BCD7648B2115DBED83BF4B8 Virtual Disk Size ID
181 # value "virtual size" can be verified by command `qemu-img info `
184 # no Virtual Disk Size ID
186 >>>0 use vhdx-id-hex
189 >>0 use vhdx-id-hex
191 0 name vhdx-id-hex
193 >8 ubequad x \b-%16.16llx
197 0 string LibvirtQemudSave Libvirt QEMU Suspend Image
203 0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image
206 >4 byte 3 disk image
210 >4 byte 2 undoable disk image
213 0 string/b VMDK VMware4 disk image
214 0 string/b KDMV VMware4 disk image
216 #--------------------------------------------------------------------
223 !:mime application/x-qemu-disk
225 # Uncomment the following line to display Magic (only used for debugging
230 # https://www.gnome.org/~markmc/qcow-image-format-version-1.html
233 # Using the existence of the Backing File Offset to determine whether
234 # to read Backing File Information
236 # Note that this isn't a null-terminated string; the length is actually
237 # (16.L). Assuming a null-terminated string happens to work usually, but it
242 # Really useful if you want to know if your backing
247 # Size is stored in bytes in a big-endian u64.
251 >>36 belong 1 \b, AES-encrypted
253 # https://www.gnome.org/~markmc/qcow-image-format.html
255 # Using the existence of the Backing File Offset to determine whether
256 # to read Backing File Information
258 # Note that this isn't a null-terminated string; the length is actually
259 # (16.L). Assuming a null-terminated string happens to work usually, but it
267 >>32 belong 1 \b, AES-encrypted
270 # Using the existence of the Backing File Offset to determine whether
271 # to read Backing File Information
273 # Note that this isn't a null-terminated string; the length is actually
274 # (16.L). Assuming a null-terminated string happens to work usually, but it
282 >>32 belong 1 \b, AES-encrypted
286 0 string/b QEVM QEMU suspend to disk image
293 # Sun xVM VirtualBox Disk Image
295 # VirtualBox Disk Image
296 0x40 ulelong 0xbeda107f VirtualBox Disk Image
303 # URL: https://www.virtualbox.org/manual/ch08.html#vboxmanage-modifynvram
304 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nvram-virtualbox.trid.xml
307 # first 64 bytes seems to be constant
311 >>>0 use virtualbox-nvram
313 0 name virtualbox-nvram
315 #!:mime application/octet-stream
316 !:mime application/x-virtualbox-nvram
319 0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image,
323 0 lelong 0x02468ace Bochs Sparse disk image
328 # Reference: https://gitlab.com/qemu/qemu/-/blob/master/replay/replay.c
334 >>>>3 byte 6 (QEMU 2.10-2.11)
335 >>>>3 byte 7 (QEMU 2.12-4.1)
338 >>>>3 byte 10 (QEMU 5.1-7.0)