1 2#------------------------------------------------------------------------------ 3# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $ 4# From: James Nobis <quel@quelrod.net> 5# Microsoft hard disk images for: 6# Virtual Server 7# Virtual PC 8# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx 9# .vhd 100 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 11 12# libvirt 13# From: Philipp Hahn <hahn@univention.de> 140 string LibvirtQemudSave Libvirt QEMU Suspend Image 15>0x10 lelong x \b, version %u 16>0x14 lelong x \b, XML length %u 17>0x18 lelong 1 \b, running 18>0x1c lelong 1 \b, compressed 19 200 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 21# From: Alex Beregszaszi <alex@fsn.hu> 220 string/b COWD VMWare3 23>4 byte 3 disk image 24>>32 lelong x (%d/ 25>>36 lelong x \b%d/ 26>>40 lelong x \b%d) 27>4 byte 2 undoable disk image 28>>32 string >\0 (%s) 29 300 string/b VMDK VMware4 disk image 310 string/b KDMV VMware4 disk image 32 33#-------------------------------------------------------------------- 34# Qemu Emulator Images 35# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 36# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 37# Made by reading sources, reading documentation, and doing trial and error 38# on existing QCOW files 390 string/b QFI\xFB QEMU QCOW Image 40 41# Uncomment the following line to display Magic (only used for debugging 42# this magic number) 43#>0 string/b x , Magic: %s 44 45# There are currently 2 Versions: "1" and "2". 46# http://www.gnome.org/~markmc/qcow-image-format-version-1.html 47>4 belong 1 (v1) 48 49# Using the existence of the Backing File Offset to determine whether 50# to read Backing File Information 51>>12 belong >0 \b, has backing file ( 52# Note that this isn't a null-terminated string; the length is actually 53# (16.L). Assuming a null-terminated string happens to work usually, but it 54# may spew junk until it reaches a \0 in some cases. 55>>>(12.L) string >\0 \bpath %s 56 57# Modification time of the Backing File 58# Really useful if you want to know if your backing 59# file is still usable together with this image 60>>>>20 bedate >0 \b, mtime %s) 61>>>>20 default x \b) 62 63# Size is stored in bytes in a big-endian u64. 64>>24 bequad x \b, %lld bytes 65 66# 1 for AES encryption, 0 for none. 67>>36 belong 1 \b, AES-encrypted 68 69# http://www.gnome.org/~markmc/qcow-image-format.html 70>4 belong 2 (v2) 71# Using the existence of the Backing File Offset to determine whether 72# to read Backing File Information 73>>8 bequad >0 \b, has backing file 74# Note that this isn't a null-terminated string; the length is actually 75# (16.L). Assuming a null-terminated string happens to work usually, but it 76# may spew junk until it reaches a \0 in some cases. Also, since there's no 77# .Q modifier, we just use the bottom four bytes as an offset. Note that if 78# the file is over 4G, and the backing file path is stored after the first 4G, 79# the wrong filename will be printed. (This should be (8.Q), when that syntax 80# is introduced.) 81>>>(12.L) string >\0 (path %s) 82>>24 bequad x \b, %lld bytes 83>>32 belong 1 \b, AES-encrypted 84 85>4 belong 3 (v3) 86# Using the existence of the Backing File Offset to determine whether 87# to read Backing File Information 88>>8 bequad >0 \b, has backing file 89# Note that this isn't a null-terminated string; the length is actually 90# (16.L). Assuming a null-terminated string happens to work usually, but it 91# may spew junk until it reaches a \0 in some cases. Also, since there's no 92# .Q modifier, we just use the bottom four bytes as an offset. Note that if 93# the file is over 4G, and the backing file path is stored after the first 4G, 94# the wrong filename will be printed. (This should be (8.Q), when that syntax 95# is introduced.) 96>>>(12.L) string >\0 (path %s) 97>>24 bequad x \b, %lld bytes 98>>32 belong 1 \b, AES-encrypted 99 100>4 default x (unknown version) 101 1020 string/b QEVM QEMU suspend to disk image 103 104# QEMU QED Image 105# http://wiki.qemu.org/Features/QED/Specification 1060 string/b QED\0 QEMU QED Image 107 108# VDI Image 109# Sun xVM VirtualBox Disk Image 110# From: Richard W.M. Jones <rich@annexia.org> 111# VirtualBox Disk Image 1120x40 ulelong 0xbeda107f VirtualBox Disk Image 113>0x44 uleshort >0 \b, major %u 114>0x46 uleshort >0 \b, minor %u 115>0 string >\0 (%s) 116>368 lequad x \b, %lld bytes 117 1180 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 119>32 string x type %s, 120>48 string x subtype %s 121 1220 lelong 0x02468ace Bochs Sparse disk image 123 124