标签归档:虚拟磁盘

VirtualBox虚拟机磁盘结构-WinHex模板

以下是VirtualBox虚拟机磁盘结构的WinHex模板,研究此结构的可以借鉴。

 

template "VirtualBox虚拟机磁盘结构 v1.1"
description "VirtualBox虚拟机磁盘结构 v1.1"

sector-aligned
applies_to disk
requires 0x0 "3C 3C 3C 20 53 75 6E 20 56 69 72 74 75 61 6C 42 6F 78 20 44 69 73 6B 20 49 6D 61 67 65 20 3E 3E 3E"

begin

Char[64] "标签"
Hex 4 "标签 7F 10 DA BE"
Uint16 "版本号高"
Uint16 "版本号低"
Uint32 "结构大小(字节)" //从当前位置开始
Hex 4 "磁盘类型" //1动态扩展 2固定大小
Hex 4 "镜像标志"
char[256] "镜像备注"
UInt32 "offBlocks"
UInt32 "数据区起始偏移地址(字节)"
Section "老标准"
UInt32 "柱面"
UInt32 "磁头"
UInt32 "扇区"
UInt32 "扇区大小(字节)"
Section ""
Uint32 "BIOS的硬盘转换模式(现在未用)"
Int64 "虚拟磁盘大小(字节)"
UInt32 "块大小字节数"
Uint32 "附加块"
UInt32 "块总数"
UInt32 "使用中的块数"
numbering 1
section "镜像 UUID"
{
read-only guid "GUID (GUID~)"
move -16
hex 16 "GUID (HEX~)"
section ""
}[4]
Section "新标准"
UInt32 "柱面(新建时为0)"
UInt32 "磁头(新建时为0)"
UInt32 "扇区(新建时为0)"
UInt32 "扇区大小(字节)"

Section "说明:"
Section ""
Section "位图项总数=要新建虚拟硬盘大小(GB)*1024"
Section ""
Section "vdi虚拟硬盘文件大小(字节)="
Section "要新建虚拟硬盘大小(GB)*1024*4+512"
Section ""
Section "一块大小为2048扇区1048576字节1MB)"

end

VHDX 虚拟磁盘格式结构

Windows 8中支持的VHDX虚拟磁盘格式,以下是虚拟磁盘结构代码。

 

//Structure 1: File Type Identifier
struct VHDX_FILE_IDENTIFIER {
	UINT64 	Signature;
	UINT16 	Creator[256];
};

//Structure 2: Header
struct VHDX_HEADER {
	UINT32 	Signature;
	UINT32 	Checksum;
	UINT64 	SequenceNumber;
	GUID 		FileWriteGuid;
	GUID 		DataWriteGuid;
	GUID 		LogGuid;
	UINT16 	LogVersion;
	UINT16 	Version;
	UINT32 	LogLength;
	UINT64 	LogOffset;
	UINT8[502] 	Reserved;
};

//Structure 3: Region Table Header
struct VHDX_REGION_TABLE_HEADER {
	UINT32 	Signature;
	UINT32 	Checksum;
	UINT32 	EntryCount;
	UINT32 	Reserved;
};

//Structure 4: Region Table Entry
struct VHDX_REGION_TABLE_ENTRY {
	GUID 		Guid;
	UINT64 	FileOffset;
	UINT32 	Length;
	UINT32 	Required:1;
	UINT32 	Reserved:31;
};

//Structure 5: Log Entry Header
struct VHDX_LOG_ENTRY_HEADER {
	UINT32 	Signature;
	UINT32 	Checksum;
	UINT32 	EntryLength;
	UINT32 	Tail;
	UINT64 	SequenceNumber;
	UINT32 	DescriptorCount;
	UINT32 	Reserved;
	GUID 		LogGuid;
	UINT64 	FlushedFileOffset;
	UINT64 	LastFileOffset;
};

//Structure 6: Log Zero Descriptor
struct VHDX_LOG_ZERO_DESCRIPTOR {
	UINT32 	ZeroSignature;
	UINT32 	Reserved;
	UINT64 	ZeroLength;
	UINT64 	FileOffset;
	UINT64 	SequenceNumber;
};

//Structure 7: Log Data Descriptor
struct VHDX_LOG_DATA_DESCRIPTOR {
	UINT32 	DataSignature;
	UINT32 	TrailingBytes;
	UINT64 	LeadingBytes;
	UINT64 	FileOffset;
	UINT64 	SequenceNumber;
};

//Structure 8: Log Data Sector
struct VHDX_LOG_DATA_SECTOR {
	UINT32 	DataSignature;
	UINT32 	SequenceHigh;
	UINT8 	Data[4084];
	UINT32 	SequenceLow;
};

//Structure 9: BAT Entry
struct VHDX_BAT_ENTRY {
	UINT64 	State:3;
	UINT64 	Reserved:17;
	UINT64 	FileOffsetMB:44;
};

//Structure 10: Metadata Table Header
struct VHDX_METADATA_TABLE_HEADER {
	UINT64 	Signature;
	UINT16 	Reserved;
	UINT16 	EntryCount;
	UINT32 	Reserved2[5];
};

//Structure 11: Metadata Table Entry
struct VHDX_METADATA_TABLE_ENTRY {
	GUID	 	ItemId;
	UINT32 	Offset;
	UINT32 	Length;
	UINT32 	IsUser:1;
	UINT32 	IsVirtualDisk:1;
	UINT32 	IsRequired:1;
	UINT32 	Reserved:29;
	UINT32 	Reserved2;
};

//Structure 12: File Parameters Metadata Item
struct VHDX_FILE_PARAMETERS {
	UINT32 	BlockSize;
	UINT32 	LeaveBlocksAllocated:1;
	UINT32 	HasParent:1;
	UINT32 	Reserved:30;
};

//Structure 13: Virtual Disk Size Metadata Item
struct VHDX_VIRTUAL_DISK_SIZE {
	UINT64 	VirtualDiskSize;
};

//Structure 14: Page 83 Data Metadata Item
struct VHDX_PAGE83_DATA {
	GUID 		Page83Data;
};

//Structure 15: Logical Sector Size Metadata Item
struct VHDX_VIRTUAL_DISK_LOGICAL_SECTOR_SIZE {
	UINT32 	LogicalSectorSize;
};

//Structure 16: Logical Sector Size Metadata Item
struct VHDX_VIRTUAL_DISK_PHYSICAL_SECTOR_SIZE {
	UINT32 	PhysicalSectorSize;
};

//Structure 17: Parent Locator Header
struct VHDX_PARENT_LOCATOR_HEADER {
	GUID 		LocatorType;
	UINT16 	Reserved;
	UINT16 	KeyValueCount;
};

//Structure 18: Parent Locator Entry
struct VHDX_PARENT_LOCATOR_ENTRY {
	UINT32 	KeyOffset;
	UINT32 	ValueOffset;
	UINT16 	KeyLength;
	UINT16 	ValueLength;
};