1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
#------------------------------------------------------------------------------
# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $
# From: James Nobis <quel@quelrod.net>
# Microsoft hard disk images for:
# Virtual Server
# Virtual PC
# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx
# .vhd
0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC
# libvirt
# From: Philipp Hahn <hahn@univention.de>
0 string LibvirtQemudSave Libvirt QEMU Suspend Image
>0x10 lelong x \b, version %u
>0x14 lelong x \b, XML length %u
>0x18 lelong 1 \b, running
>0x1c lelong 1 \b, compressed
0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image
# From: Alex Beregszaszi <alex@fsn.hu>
0 string/b COWD VMWare3
>4 byte 3 disk image
>>32 lelong x (%d/
>>36 lelong x \b%d/
>>40 lelong x \b%d)
>4 byte 2 undoable disk image
>>32 string >\0 (%s)
0 string/b VMDK VMware4 disk image
0 string/b KDMV VMware4 disk image
#--------------------------------------------------------------------
# Qemu Emulator Images
# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
# Made by reading sources, reading documentation, and doing trial and error
# on existing QCOW files
0 string/b QFI\xFB QEMU QCOW Image
# Uncomment the following line to display Magic (only used for debugging
# this magic number)
#>0 string/b x , Magic: %s
# There are currently 2 Versions: "1" and "2".
# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
>4 belong 1 (v1)
# Using the existence of the Backing File Offset to determine whether
# to read Backing File Information
>>12 belong >0 \b, has backing file (
# Note that this isn't a null-terminated string; the length is actually
# (16.L). Assuming a null-terminated string happens to work usually, but it
# may spew junk until it reaches a \0 in some cases.
>>>(12.L) string >\0 \bpath %s
# Modification time of the Backing File
# Really useful if you want to know if your backing
# file is still usable together with this image
>>>>20 bedate >0 \b, mtime %s)
>>>>20 default x \b)
# Size is stored in bytes in a big-endian u64.
>>24 bequad x \b, %lld bytes
# 1 for AES encryption, 0 for none.
>>36 belong 1 \b, AES-encrypted
# http://www.gnome.org/~markmc/qcow-image-format.html
>4 belong 2 (v2)
# Using the existence of the Backing File Offset to determine whether
# to read Backing File Information
>>8 bequad >0 \b, has backing file
# Note that this isn't a null-terminated string; the length is actually
# (16.L). Assuming a null-terminated string happens to work usually, but it
# may spew junk until it reaches a \0 in some cases. Also, since there's no
# .Q modifier, we just use the bottom four bytes as an offset. Note that if
# the file is over 4G, and the backing file path is stored after the first 4G,
# the wrong filename will be printed. (This should be (8.Q), when that syntax
# is introduced.)
>>>(12.L) string >\0 (path %s)
>>24 bequad x \b, %lld bytes
>>32 belong 1 \b, AES-encrypted
>4 belong 3 (v3)
# Using the existence of the Backing File Offset to determine whether
# to read Backing File Information
>>8 bequad >0 \b, has backing file
# Note that this isn't a null-terminated string; the length is actually
# (16.L). Assuming a null-terminated string happens to work usually, but it
# may spew junk until it reaches a \0 in some cases. Also, since there's no
# .Q modifier, we just use the bottom four bytes as an offset. Note that if
# the file is over 4G, and the backing file path is stored after the first 4G,
# the wrong filename will be printed. (This should be (8.Q), when that syntax
# is introduced.)
>>>(12.L) string >\0 (path %s)
>>24 bequad x \b, %lld bytes
>>32 belong 1 \b, AES-encrypted
>4 default x (unknown version)
0 string/b QEVM QEMU suspend to disk image
# QEMU QED Image
# http://wiki.qemu.org/Features/QED/Specification
0 string/b QED\0 QEMU QED Image
# VDI Image
# Sun xVM VirtualBox Disk Image
# From: Richard W.M. Jones <rich@annexia.org>
# VirtualBox Disk Image
0x40 ulelong 0xbeda107f VirtualBox Disk Image
>0x44 uleshort >0 \b, major %u
>0x46 uleshort >0 \b, minor %u
>0 string >\0 (%s)
>368 lequad x \b, %lld bytes
0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image,
>32 string x type %s,
>48 string x subtype %s
0 lelong 0x02468ace Bochs Sparse disk image
|
