libextractor

diskimage_extractor.c (57917B)

---

 /*
      This file is part of libextractor.
      Copyright (C) 2026 Vidyut Samanta and Christian Grothoff
 
      libextractor is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
      by the Free Software Foundation; either version 3, or (at your
      option) any later version.
 
      libextractor is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      General Public License for more details.
 
      You should have received a copy of the GNU General Public License
      along with libextractor; see the file COPYING.  If not, write to the
      Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
      Boston, MA 02110-1301, USA.
  */
 /**
  * @file plugins/diskimage_extractor.c
  * @brief plugin to support virtual disk images: QCOW/QCOW2, VMDK,
  *        VHD and VHDX
  * @author Christian Grothoff
  *
  * These four formats answer the same questions, so one plugin answers
  * them once: how big does the disk claim to be, which virtual machine
  * or tool wrote it, is it a differencing image (and what is its parent,
  * because then there are sibling files the investigator also needs),
  * and is it encrypted.
  *
  * Deliberately *not* done here: identifying the guest file system
  * inside the image.  That means following the allocation tables to the
  * first sectors of the guest disk, which is a second-pass job; this
  * plugin never reads more than a handful of headers.
  *
  * References:
  * - QCOW2: `docs/interop/qcow2.txt' in the QEMU source tree.
  * - VMDK: "Virtual Disk Format 5.0" (VMware technical note).
  * - VHD: "Virtual Hard Disk Image Format Specification" 1.0 (Microsoft).
  * - VHDX: [MS-VHDX], "Virtual Hard Disk v2 (VHDX) File Format".
  */
 #include "platform.h"
 #include "extractor.h"
 #include "forensics.h"
 
 
 /**
  * Name we report our meta data under.
  */
 #define DISKIMAGE "diskimage"
 
 /**
  * Evaluate @a call and return 1 from the enclosing function if the
  * caller asked us to stop extracting.
  */
 #define CHECK(call) do { if (0 != (call)) return 1; } while (0)
 
 /**
  * Largest VMDK text descriptor we will read.  Real descriptors are a
  * few hundred bytes; the header field giving the size is attacker
  * controlled, so it needs a hard cap.
  */
 #define VMDK_MAX_DESCRIPTOR (32 * 1024)
 
 /**
  * Largest number of lines we look at in a VMDK descriptor.
  */
 #define VMDK_MAX_LINES 1024
 
 /**
  * Largest number of region table entries [MS-VHDX] allows.
  */
 #define VHDX_MAX_REGIONS 2047
 
 /**
  * Largest number of metadata table entries [MS-VHDX] allows.
  */
 #define VHDX_MAX_METADATA 2047
 
 /**
  * Largest single VHDX metadata item we will read.  The largest one we
  * care about is the parent locator; everything else is 4 to 16 bytes.
  */
 #define VHDX_MAX_ITEM (16 * 1024)
 
 /**
  * Seconds between the VHD epoch (2000-01-01T00:00:00Z) and the Unix
  * epoch.
  */
 #define VHD_EPOCH 946684800LL
 
 
 /**
  * Compare a NUL-terminated key from a file against a literal, ignoring
  * ASCII case.  Not `strcasecmp()' because that is locale-dependent.
  *
  * @param key NUL-terminated key from the file
  * @param want the literal to compare against
  * @return 1 if they match, 0 if not
  */
 static int
 key_is (const char *key,
         const char *want)
 {
   size_t i;
 
   for (i = 0; '\0' != want[i]; i++)
   {
     char a = key[i];
     char b = want[i];
 
     if ( ('A' <= a) && ('Z' >= a) )
       a = (char) (a - 'A' + 'a');
     if ( ('A' <= b) && ('Z' >= b) )
       b = (char) (b - 'A' + 'a');
     if (a != b)
       return 0;
   }
   return ('\0' == key[i]);
 }
 
 
 /**
  * Copy @a src into @a dst, truncating if it does not fit.
  *
  * @param dst destination buffer
  * @param dst_size number of bytes in @a dst, including the NUL
  * @param src NUL-terminated source string
  */
 static void
 copy_bounded (char *dst,
               size_t dst_size,
               const char *src)
 {
   size_t i;
 
   for (i = 0; (i + 1 < dst_size) && ('\0' != src[i]); i++)
     dst[i] = src[i];
   dst[i] = '\0';
 }
 
 
 /**
  * Strip leading and trailing white space from @a s in place.
  *
  * @param s the string to trim, modified in place
  * @return pointer into @a s at the first non-blank character
  */
 static char *
 trim_inplace (char *s)
 {
   size_t len;
 
   while ( (' ' == *s) ||
           ('\t' == *s) ||
           ('\r' == *s) )
     s++;
   len = strlen (s);
   while ( (0 < len) &&
           ( (' ' == s[len - 1]) ||
             ('\t' == s[len - 1]) ||
             ('\r' == s[len - 1]) ) )
     len--;
   s[len] = '\0';
   return s;
 }
 
 
 /**
  * Remove one layer of double quotes from @a s, in place.
  *
  * @param s the string, modified in place
  * @return pointer to the unquoted string
  */
 static char *
 unquote_inplace (char *s)
 {
   size_t len = strlen (s);
 
   if ( (2 <= len) &&
        ('"' == s[0]) &&
        ('"' == s[len - 1]) )
   {
     s[len - 1] = '\0';
     return &s[1];
   }
   return s;
 }
 
 
 /**
  * Parse an unsigned decimal number, rejecting anything that is not
  * exactly a number.
  *
  * @param s the string
  * @param[out] value where to store the result
  * @return 1 on success, 0 if @a s is not a bounded decimal number
  */
 static int
 parse_u64 (const char *s,
            uint64_t *value)
 {
   uint64_t v = 0;
   int digits = 0;
 
   for (size_t i = 0; '\0' != s[i]; i++)
   {
     if ( ('0' > s[i]) ||
          ('9' < s[i]) )
       return 0;
     if (v > (UINT64_MAX - 9) / 10)
       return 0;   /* would overflow */
     v = v * 10 + (uint64_t) (s[i] - '0');
     digits++;
     if (20 < digits)
       return 0;
   }
   if (0 == digits)
     return 0;
   *value = v;
   return 1;
 }
 
 
 /**
  * Emit the MIME type of the format we just identified.
  *
  * @param ec extraction context
  * @param mime the MIME type
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 emit_mime (struct EXTRACTOR_ExtractContext *ec,
            const char *mime)
 {
   return (0 != ec->proc (ec->cls,
                          DISKIMAGE,
                          EXTRACTOR_METATYPE_MIMETYPE,
                          EXTRACTOR_METAFORMAT_UTF8,
                          "text/plain",
                          mime,
                          strlen (mime) + 1)) ? 1 : 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* QCOW / QCOW2                                                       */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Report the QCOW2 version 3 feature bits that say something about the
  * state the image was left in.
  *
  * @param ec extraction context
  * @param incompatible the incompatible feature bit field
  * @param compatible the compatible feature bit field
  * @param autoclear the autoclear feature bit field
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 qcow_features (struct EXTRACTOR_ExtractContext *ec,
                uint64_t incompatible,
                uint64_t compatible,
                uint64_t autoclear)
 {
   /* Bit 0 is left set while the image is open for writing: seeing it
      in a file at rest means the writer died without closing it.  Bit 1
      is set by QEMU itself when it detects inconsistent metadata. */
   if (0 != (incompatible & 1ULL))
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "dirty bit set"
                                      " (image was not closed cleanly)"));
   if (0 != (incompatible & 2ULL))
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "corrupt bit set"
                                      " (image marked corrupt by QEMU)"));
   if (0 != (incompatible & 4ULL))
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "data is in an external data file"));
   if (0 != (incompatible & 16ULL))
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "extended L2 entries"));
   if (0 != (compatible & 1ULL))
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "lazy refcounts"));
   if (0 != (autoclear & 1ULL))
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "persistent dirty bitmaps"));
   return 0;
 }
 
 
 /**
  * Extract from a QCOW or QCOW2 image.  The magic has already matched.
  *
  * @param ec extraction context
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 extract_qcow (struct EXTRACTOR_ExtractContext *ec)
 {
   unsigned char hdr[112];
   size_t have;
   uint32_t version;
   uint64_t backing_offset;
   uint32_t backing_size;
   uint64_t size;
 
   memset (hdr,
           0,
           sizeof (hdr));
   /* A version 3 header is 104 or 112 bytes, a version 2 header 72 and
      a version 1 header 48; take the largest that the file holds. */
   if (EXTRACTOR_forensic_read_ (ec, 0, hdr, sizeof (hdr)))
     have = sizeof (hdr);
   else if (EXTRACTOR_forensic_read_ (ec, 0, hdr, 72))
     have = 72;
   else if (EXTRACTOR_forensic_read_ (ec, 0, hdr, 48))
     have = 48;
   else
     return 0;   /* magic matched but there is no header behind it */
   version = EXTRACTOR_forensic_be32_ (&hdr[4]);
   if ( (0 == version) ||
        (3 < version) )
     return 0;   /* not a QCOW generation we know how to read */
   CHECK (emit_mime (ec,
                     "application/x-qemu-disk"));
   CHECK (EXTRACTOR_forensic_emit_ (ec,
                                    DISKIMAGE,
                                    EXTRACTOR_METATYPE_FORMAT,
                                    "%s",
                                    (1 == version) ? "QCOW" : "QCOW2"));
   CHECK (EXTRACTOR_forensic_emit_ (ec,
                                    DISKIMAGE,
                                    EXTRACTOR_METATYPE_FORMAT_VERSION,
                                    "%u",
                                    (unsigned int) version));
   /* The backing file reference and the virtual size sit at the same
      place in all three generations. */
   size = EXTRACTOR_forensic_be64_ (&hdr[24]);
   if ( (0 != size) &&
        (size < (1ULL << 62)) )
     CHECK (EXTRACTOR_forensic_emit_size_ (ec,
                                           DISKIMAGE,
                                           EXTRACTOR_METATYPE_VOLUME_SIZE,
                                           size));
   backing_offset = EXTRACTOR_forensic_be64_ (&hdr[8]);
   backing_size = EXTRACTOR_forensic_be32_ (&hdr[16]);
   if ( (0 != backing_offset) &&
        (0 != backing_size) &&
        (EXTRACTOR_FORENSIC_MAX_STRING >= backing_size) &&
        (backing_offset <= (uint64_t) INT64_MAX - backing_size) )
   {
     char name[EXTRACTOR_FORENSIC_MAX_STRING];
 
     if (EXTRACTOR_forensic_read_ (ec,
                                   (int64_t) backing_offset,
                                   name,
                                   backing_size))
       CHECK (EXTRACTOR_forensic_emit_text_ (ec,
                                             DISKIMAGE,
                                             EXTRACTOR_METATYPE_PARENT_IMAGE,
                                             name,
                                             backing_size));
   }
   if ( (1 == version) ||
        (72 > have) )
     return 0;   /* everything below moved in, or arrived with, version 2 */
   {
     uint32_t cluster_bits = EXTRACTOR_forensic_be32_ (&hdr[20]);
     uint32_t crypt = EXTRACTOR_forensic_be32_ (&hdr[32]);
     uint32_t snapshots = EXTRACTOR_forensic_be32_ (&hdr[60]);
 
     /* 9..21 is what QEMU itself accepts; outside that the field is
        either garbage or would make 1 << cluster_bits undefined. */
     if ( (9 <= cluster_bits) &&
          (21 >= cluster_bits) )
       CHECK (EXTRACTOR_forensic_emit_size_ (ec,
                                             DISKIMAGE,
                                             EXTRACTOR_METATYPE_BLOCK_SIZE,
                                             1ULL << cluster_bits));
     if (0 != crypt)
       CHECK (EXTRACTOR_forensic_emit_ (ec,
                                        DISKIMAGE,
                                        EXTRACTOR_METATYPE_ENCRYPTION,
                                        "%s",
                                        (1 == crypt)
                                        ? "AES"
                                        : ( (2 == crypt)
                                            ? "LUKS"
                                            : "unknown")));
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ENTRY_COUNT,
                                      "%u",
                                      (unsigned int) snapshots));
   }
   if ( (3 == version) &&
        (104 <= have) )
   {
     uint64_t incompatible = EXTRACTOR_forensic_be64_ (&hdr[72]);
     uint64_t compatible = EXTRACTOR_forensic_be64_ (&hdr[80]);
     uint64_t autoclear = EXTRACTOR_forensic_be64_ (&hdr[88]);
     uint32_t header_length = EXTRACTOR_forensic_be32_ (&hdr[100]);
 
     CHECK (qcow_features (ec,
                           incompatible,
                           compatible,
                           autoclear));
     /* The compression type byte only exists when the matching
        incompatible bit is set; otherwise the image is plain zlib. */
     if ( (0 != (incompatible & 8ULL)) &&
          (104 < header_length) &&
          (105 <= have) )
       CHECK (EXTRACTOR_forensic_emit_ (ec,
                                        DISKIMAGE,
                                        EXTRACTOR_METATYPE_COMMENT,
                                        "compression type: %s",
                                        (0 == hdr[104])
                                        ? "zlib"
                                        : ( (1 == hdr[104])
                                            ? "zstd"
                                            : "unknown")));
   }
   return 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* VMDK                                                               */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Parse one `RW <sectors> <type> "<file>"' extent line of a VMDK text
  * descriptor.
  *
  * @param ec extraction context
  * @param line the line, NUL-terminated, modified in place
  * @param[in,out] extents number of extents seen so far
  * @param[in,out] sectors total number of sectors seen so far
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 vmdk_extent_line (struct EXTRACTOR_ExtractContext *ec,
                   char *line,
                   unsigned int *extents,
                   uint64_t *sectors)
 {
   char *p = line;
   char *count;
   uint64_t n;
 
   (*extents)++;
   while ( ('\0' != *p) &&
           (' ' != *p) )
     p++;   /* skip the access mode */
   while (' ' == *p)
     p++;
   count = p;
   while ( ('0' <= *p) &&
           ('9' >= *p) )
     p++;
   if (' ' == *p)
   {
     *p = '\0';
     p++;
     if ( (parse_u64 (count,
                      &n)) &&
          (n < (1ULL << 53)) )
       *sectors += n;
     while (' ' == *p)
       p++;
     while ( ('\0' != *p) &&
             (' ' != *p) )
       p++;   /* skip the extent type */
     while (' ' == *p)
       p++;
   }
   if ('"' == *p)
   {
     char *end;
 
     p++;
     end = p;
     while ( ('\0' != *end) &&
             ('"' != *end) )
       end++;
     if ('"' == *end)
     {
       *end = '\0';
       /* The extent files are sibling files an investigator has to
          collect as well, so name them -- but only the first few. */
       if (EXTRACTOR_FORENSIC_MAX_ITEMS >= *extents)
         CHECK (EXTRACTOR_forensic_emit_text_ (ec,
                                               DISKIMAGE,
                                               EXTRACTOR_METATYPE_FILENAME,
                                               p,
                                               strlen (p)));
     }
   }
   return 0;
 }
 
 
 /**
  * Parse the text descriptor of a VMDK, either the copy embedded in a
  * sparse extent header or a stand-alone descriptor file.
  *
  * @param ec extraction context
  * @param text the descriptor, modified in place; need not be
  *        NUL-terminated, @a len bounds it
  * @param len number of bytes in @a text
  * @param sparse 1 if this is the copy embedded in a sparse extent
  *        header, whose binary fields already gave us the version and
  *        the virtual size; 0 for a stand-alone descriptor file, where
  *        both have to come from the text
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 vmdk_descriptor (struct EXTRACTOR_ExtractContext *ec,
                  char *text,
                  size_t len,
                  int sparse)
 {
   char parent_cid[64];
   char parent_hint[EXTRACTOR_FORENSIC_MAX_STRING];
   char adapter[64];
   uint64_t cylinders = 0;
   uint64_t heads = 0;
   uint64_t track_sectors = 0;
   uint64_t total_sectors = 0;
   unsigned int extents = 0;
   unsigned int lines = 0;
   unsigned int keys = 0;
   size_t pos = 0;
 
   parent_cid[0] = '\0';
   parent_hint[0] = '\0';
   adapter[0] = '\0';
   /* A NUL inside the descriptor ends it: everything past it is the
      zero padding of the descriptor slot. */
   for (size_t i = 0; i < len; i++)
     if ('\0' == text[i])
     {
       len = i;
       break;
     }
   while ( (pos < len) &&
           (VMDK_MAX_LINES > lines) )
   {
     char *line;
     char *eq;
     size_t end = pos;
 
     lines++;
     while ( (end < len) &&
             ('\n' != text[end]) )
       end++;
     line = &text[pos];
     text[end] = '\0';   /* safe: either the '\n' or the end of the slot */
     pos = end + 1;
     line = trim_inplace (line);
     if ( ('\0' == line[0]) ||
          ('#' == line[0]) )
       continue;
     if ( (0 == strncmp (line, "RW ", 3)) ||
          (0 == strncmp (line, "RDONLY ", 7)) ||
          (0 == strncmp (line, "NOACCESS ", 9)) )
     {
       CHECK (vmdk_extent_line (ec,
                                line,
                                &extents,
                                &total_sectors));
       continue;
     }
     eq = strchr (line,
                  '=');
     if (NULL == eq)
       continue;
     *eq = '\0';
     {
       char *key = trim_inplace (line);
       char *value = unquote_inplace (trim_inplace (&eq[1]));
 
       if ('\0' == value[0])
         continue;
       /* A descriptor that repeats a key a thousand times must not turn
          into a thousand meta data items; a real one has about fifteen
          keys, so stopping here loses nothing. */
       if (EXTRACTOR_FORENSIC_MAX_ITEMS <= keys)
         continue;
       keys++;
       if (key_is (key,
                   "CID"))
         CHECK (EXTRACTOR_forensic_emit_text_ (ec,
                                               DISKIMAGE,
                                               EXTRACTOR_METATYPE_VOLUME_SERIAL,
                                               value,
                                               strlen (value)));
       else if (key_is (key,
                        "parentCID"))
         copy_bounded (parent_cid,
                       sizeof (parent_cid),
                       value);
       else if (key_is (key,
                        "parentFileNameHint"))
         copy_bounded (parent_hint,
                       sizeof (parent_hint),
                       value);
       else if ( (! sparse) &&
                 (key_is (key,
                          "version")) )
         CHECK (EXTRACTOR_forensic_emit_text_ (ec,
                                               DISKIMAGE,
                                               EXTRACTOR_METATYPE_FORMAT_VERSION,
                                               value,
                                               strlen (value)));
       else if (key_is (key,
                        "createType"))
         CHECK (EXTRACTOR_forensic_emit_text_ (ec,
                                               DISKIMAGE,
                                               EXTRACTOR_METATYPE_FORMAT,
                                               value,
                                               strlen (value)));
       else if (key_is (key,
                        "ddb.virtualHWVersion"))
         CHECK (EXTRACTOR_forensic_emit_ (ec,
                                          DISKIMAGE,
                                          EXTRACTOR_METATYPE_SOFTWARE_VERSION,
                                          "virtual hardware version %.16s",
                                          value));
       else if (key_is (key,
                        "ddb.toolsVersion"))
         CHECK (EXTRACTOR_forensic_emit_ (ec,
                                          DISKIMAGE,
                                          EXTRACTOR_METATYPE_SOFTWARE_VERSION,
                                          "VMware Tools version %.16s",
                                          value));
       else if (key_is (key,
                        "ddb.adapterType"))
         copy_bounded (adapter,
                       sizeof (adapter),
                       value);
       else if (key_is (key,
                        "ddb.geometry.cylinders"))
         (void) parse_u64 (value,
                           &cylinders);
       else if (key_is (key,
                        "ddb.geometry.heads"))
         (void) parse_u64 (value,
                           &heads);
       else if (key_is (key,
                        "ddb.geometry.sectors"))
         (void) parse_u64 (value,
                           &track_sectors);
       else if ( (0 == strncmp (key, "ddb.uuid", 8)) ||
                 (key_is (key, "ddb.longContentID")) )
         CHECK (EXTRACTOR_forensic_emit_text_ (ec,
                                               DISKIMAGE,
                                               EXTRACTOR_METATYPE_VOLUME_SERIAL,
                                               value,
                                               strlen (value)));
     }
   }
   if ('\0' != adapter[0])
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_COMMENT,
                                      "adapter type: %.32s",
                                      adapter));
   if ( (0 != cylinders) &&
        (0 != heads) &&
        (0 != track_sectors) )
   {
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_COMMENT,
                                      "geometry: %llu cylinders,"
                                      " %llu heads, %llu sectors per track",
                                      (unsigned long long) cylinders,
                                      (unsigned long long) heads,
                                      (unsigned long long) track_sectors));
   }
   if (0 != extents)
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ENTRY_COUNT,
                                      "%u",
                                      extents));
   /* A stand-alone descriptor has no binary header to take the virtual
      size from, so add up the extents instead. */
   if ( (! sparse) &&
        (0 != total_sectors) &&
        (total_sectors < (1ULL << 53)) )
     CHECK (EXTRACTOR_forensic_emit_size_ (ec,
                                           DISKIMAGE,
                                           EXTRACTOR_METATYPE_VOLUME_SIZE,
                                           total_sectors * 512ULL));
   /* `ffffffff' is the documented "no parent" value. */
   if ( ('\0' != parent_cid[0]) &&
        (! key_is (parent_cid,
                   "ffffffff")) )
   {
     if ('\0' != parent_hint[0])
       CHECK (EXTRACTOR_forensic_emit_text_ (ec,
                                             DISKIMAGE,
                                             EXTRACTOR_METATYPE_PARENT_IMAGE,
                                             parent_hint,
                                             strlen (parent_hint)));
     else
       CHECK (EXTRACTOR_forensic_emit_ (ec,
                                        DISKIMAGE,
                                        EXTRACTOR_METATYPE_PARENT_IMAGE,
                                        "parent CID %.32s",
                                        parent_cid));
   }
   return 0;
 }
 
 
 /**
  * Extract from a VMDK sparse extent.  The `KDMV' magic has already
  * matched.
  *
  * @param ec extraction context
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 extract_vmdk_sparse (struct EXTRACTOR_ExtractContext *ec)
 {
   unsigned char hdr[80];
   uint64_t capacity;
   uint64_t grain;
   uint64_t desc_offset;
   uint64_t desc_size;
 
   if (! EXTRACTOR_forensic_read_ (ec,
                                   0,
                                   hdr,
                                   sizeof (hdr)))
     return 0;
   CHECK (emit_mime (ec,
                     "application/x-vmdk"));
   CHECK (EXTRACTOR_forensic_emit_ (ec,
                                    DISKIMAGE,
                                    EXTRACTOR_METATYPE_FORMAT,
                                    "%s",
                                    "VMDK"));
   CHECK (EXTRACTOR_forensic_emit_ (ec,
                                    DISKIMAGE,
                                    EXTRACTOR_METATYPE_FORMAT_VERSION,
                                    "%u",
                                    (unsigned int) EXTRACTOR_forensic_le32_ (
                                      &hdr[4])));
   capacity = EXTRACTOR_forensic_le64_ (&hdr[12]);
   if ( (0 != capacity) &&
        (capacity < (1ULL << 53)) )
   {
     CHECK (EXTRACTOR_forensic_emit_size_ (ec,
                                           DISKIMAGE,
                                           EXTRACTOR_METATYPE_VOLUME_SIZE,
                                           capacity * 512ULL));
   }
   grain = EXTRACTOR_forensic_le64_ (&hdr[20]);
   if ( (0 != grain) &&
        (grain < (1ULL << 32)) )
     CHECK (EXTRACTOR_forensic_emit_size_ (ec,
                                           DISKIMAGE,
                                           EXTRACTOR_METATYPE_BLOCK_SIZE,
                                           grain * 512ULL));
   /* An unclean shutdown flag survives in the file, so it says the VM
      was not powered down before the image was taken. */
   if (0 != hdr[72])
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "unclean shutdown"));
   if (0 != EXTRACTOR_forensic_le16_ (&hdr[77]))
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_COMMENT,
                                      "%s",
                                      "grains are DEFLATE compressed"));
   desc_offset = EXTRACTOR_forensic_le64_ (&hdr[28]);
   desc_size = EXTRACTOR_forensic_le64_ (&hdr[36]);
   if ( (0 == desc_offset) ||
        (0 == desc_size) )
     return 0;   /* descriptor lives in a separate file */
   if ( (desc_offset > (uint64_t) INT64_MAX / 512) ||
        (desc_size > VMDK_MAX_DESCRIPTOR / 512) )
     return 0;   /* nonsense, or more than we are willing to read */
   {
     size_t bytes = (size_t) (desc_size * 512);
     char *text;
     int ret;
 
     if (NULL == (text = malloc (bytes + 1)))
       return 0;
     if (! EXTRACTOR_forensic_read_ (ec,
                                     (int64_t) (desc_offset * 512),
                                     text,
                                     bytes))
     {
       free (text);
       return 0;
     }
     text[bytes] = '\0';
     ret = vmdk_descriptor (ec,
                            text,
                            bytes,
                            1);
     free (text);
     return ret;
   }
 }
 
 
 /**
  * Extract from a stand-alone VMDK text descriptor file.  The
  * `# Disk DescriptorFile' banner has already matched.
  *
  * @param ec extraction context
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 extract_vmdk_text (struct EXTRACTOR_ExtractContext *ec)
 {
   uint64_t fsize = ec->get_size (ec->cls);
   size_t bytes;
   char *text;
   int ret;
 
   CHECK (emit_mime (ec,
                     "application/x-vmdk"));
   CHECK (EXTRACTOR_forensic_emit_ (ec,
                                    DISKIMAGE,
                                    EXTRACTOR_METATYPE_FORMAT,
                                    "%s",
                                    "VMDK"));
   if ( (UINT64_MAX == fsize) ||
        (0 == fsize) )
     return 0;
   bytes = (fsize > VMDK_MAX_DESCRIPTOR) ? VMDK_MAX_DESCRIPTOR : (size_t) fsize;
   if (NULL == (text = malloc (bytes + 1)))
     return 0;
   if (! EXTRACTOR_forensic_read_ (ec,
                                   0,
                                   text,
                                   bytes))
   {
     free (text);
     return 0;
   }
   text[bytes] = '\0';
   ret = vmdk_descriptor (ec,
                          text,
                          bytes,
                          0);
   free (text);
   return ret;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* VHD (Microsoft Virtual PC / Hyper-V version 1)                     */
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Read the dynamic disk header of a VHD and report what it says about
  * the block size and, for a differencing disk, the parent.
  *
  * @param ec extraction context
  * @param offset file offset of the dynamic disk header
  * @param differencing 1 if the footer said this is a differencing disk
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 vhd_dynamic_header (struct EXTRACTOR_ExtractContext *ec,
                     uint64_t offset,
                     int differencing)
 {
   unsigned char dyn[576];
   unsigned char name[512];
   uint32_t block_size;
 
   if (offset > (uint64_t) INT64_MAX - sizeof (dyn))
     return 0;
   if (! EXTRACTOR_forensic_read_ (ec,
                                   (int64_t) offset,
                                   dyn,
                                   sizeof (dyn)))
     return 0;
   if (0 != memcmp (dyn,
                    "cxsparse",
                    8))
     return 0;
   block_size = EXTRACTOR_forensic_be32_ (&dyn[32]);
   if ( (0 != block_size) &&
        (block_size <= (64 * 1024 * 1024)) )
     CHECK (EXTRACTOR_forensic_emit_size_ (ec,
                                           DISKIMAGE,
                                           EXTRACTOR_METATYPE_BLOCK_SIZE,
                                           block_size));
   if (! differencing)
     return 0;
   CHECK (EXTRACTOR_forensic_emit_guid_ (ec,
                                         DISKIMAGE,
                                         EXTRACTOR_METATYPE_PARENT_IMAGE,
                                         &dyn[40],
                                         0));
   /* The parent name is UTF-16 *big* endian here, unlike everywhere
      else in Windows; swap it so the shared helper can take it. */
   for (size_t i = 0; i + 1 < sizeof (name); i += 2)
   {
     name[i] = dyn[64 + i + 1];
     name[i + 1] = dyn[64 + i];
   }
   CHECK (EXTRACTOR_forensic_emit_utf16le_ (ec,
                                            DISKIMAGE,
                                            EXTRACTOR_METATYPE_PARENT_IMAGE,
                                            name,
                                            sizeof (name)));
   return 0;
 }
 
 
 /**
  * Extract from a VHD image given its 512 byte footer.
  *
  * @param ec extraction context
  * @param foot the footer
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 extract_vhd (struct EXTRACTOR_ExtractContext *ec,
              const unsigned char *foot)
 {
   uint32_t format_version;
   uint32_t host_os;
   uint32_t disk_type;
   uint64_t current_size;
   uint64_t data_offset;
   int64_t created;
 
   CHECK (emit_mime (ec,
                     "application/x-vhd"));
   CHECK (EXTRACTOR_forensic_emit_ (ec,
                                    DISKIMAGE,
                                    EXTRACTOR_METATYPE_FORMAT,
                                    "%s",
                                    "VHD"));
   format_version = EXTRACTOR_forensic_be32_ (&foot[12]);
   CHECK (EXTRACTOR_forensic_emit_ (ec,
                                    DISKIMAGE,
                                    EXTRACTOR_METATYPE_FORMAT_VERSION,
                                    "%u.%u",
                                    (unsigned int) (format_version >> 16),
                                    (unsigned int) (format_version & 0xFFFF)));
   /* The creator application is a four character code -- `vpc ' for
      Virtual PC, `win ' for Hyper-V, `qemu', `tap ' for Xen, `d2v ' for
      Disk2vhd -- followed by a major.minor version. */
   {
     uint32_t cver = EXTRACTOR_forensic_be32_ (&foot[32]);
     char app[5];
 
     memcpy (app,
             &foot[28],
             4);
     app[4] = '\0';
     for (unsigned int i = 0; i < 4; i++)
       if ( (0x20 > (unsigned char) app[i]) ||
            (0x7E < (unsigned char) app[i]) )
         app[i] = ' ';
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_CREATED_BY_SOFTWARE,
                                      "%s %u.%u",
                                      app,
                                      (unsigned int) (cver >> 16),
                                      (unsigned int) (cver & 0xFFFF)));
   }
   host_os = EXTRACTOR_forensic_be32_ (&foot[36]);
   if (0x5769326BU == host_os)
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_AUTHORING_OS,
                                      "%s",
                                      "Windows"));
   else if (0x4D616320U == host_os)
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_AUTHORING_OS,
                                      "%s",
                                      "Macintosh"));
   /* The time stamp counts seconds from 2000-01-01, not from the Unix
      epoch. */
   created = (int64_t) EXTRACTOR_forensic_be32_ (&foot[24]);
   CHECK (EXTRACTOR_forensic_emit_unix_time_ (ec,
                                              DISKIMAGE,
                                              EXTRACTOR_METATYPE_CREATION_DATE,
                                              created + VHD_EPOCH));
   current_size = EXTRACTOR_forensic_be64_ (&foot[48]);
   if ( (0 != current_size) &&
        (current_size < (1ULL << 62)) )
     CHECK (EXTRACTOR_forensic_emit_size_ (ec,
                                           DISKIMAGE,
                                           EXTRACTOR_METATYPE_VOLUME_SIZE,
                                           current_size));
   CHECK (EXTRACTOR_forensic_emit_guid_ (ec,
                                         DISKIMAGE,
                                         EXTRACTOR_METATYPE_VOLUME_SERIAL,
                                         &foot[68],
                                         0));
   disk_type = EXTRACTOR_forensic_be32_ (&foot[60]);
   switch (disk_type)
   {
   case 2:
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "fixed disk"));
     break;
   case 3:
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "dynamic disk"));
     break;
   case 4:
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "differencing disk"));
     break;
   default:
     break;
   }
   if (0 != (foot[84] & 1))
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_ATTRIBUTES,
                                      "%s",
                                      "saved state present (VM was suspended)"));
   data_offset = EXTRACTOR_forensic_be64_ (&foot[16]);
   if ( ( (3 == disk_type) ||
          (4 == disk_type) ) &&
        (0 != data_offset) &&
        (UINT64_MAX != data_offset) )
     return vhd_dynamic_header (ec,
                                data_offset,
                                4 == disk_type);
   return 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* VHDX                                                               */
 /* ------------------------------------------------------------------ */
 
 /**
  * Region table GUID of the VHDX metadata region,
  * 8B7CA206-4790-4B9A-B8FE-575F050F886E, in file order.
  */
 static const unsigned char vhdx_metadata_region[16] = {
   0x06, 0xA2, 0x7C, 0x8B, 0x90, 0x47, 0x9A, 0x4B,
   0xB8, 0xFE, 0x57, 0x5F, 0x05, 0x0F, 0x88, 0x6E
 };
 
 /**
  * Metadata item GUID "File Parameters",
  * CAA16737-FA36-4D43-B3B6-33F0AA44E76B, in file order.
  */
 static const unsigned char vhdx_file_parameters[16] = {
   0x37, 0x67, 0xA1, 0xCA, 0x36, 0xFA, 0x43, 0x4D,
   0xB3, 0xB6, 0x33, 0xF0, 0xAA, 0x44, 0xE7, 0x6B
 };
 
 /**
  * Metadata item GUID "Virtual Disk Size",
  * 2FA54224-CD1B-4876-B211-5DBED83BF4B8, in file order.
  */
 static const unsigned char vhdx_virtual_disk_size[16] = {
   0x24, 0x42, 0xA5, 0x2F, 0x1B, 0xCD, 0x76, 0x48,
   0xB2, 0x11, 0x5D, 0xBE, 0xD8, 0x3B, 0xF4, 0xB8
 };
 
 /**
  * Metadata item GUID "Virtual Disk ID",
  * BECA12AB-B2E6-4523-93EF-C309E000C746, in file order.
  */
 static const unsigned char vhdx_virtual_disk_id[16] = {
   0xAB, 0x12, 0xCA, 0xBE, 0xE6, 0xB2, 0x23, 0x45,
   0x93, 0xEF, 0xC3, 0x09, 0xE0, 0x00, 0xC7, 0x46
 };
 
 /**
  * Metadata item GUID "Logical Sector Size",
  * 8141BF1D-A96F-4709-BA47-F233A8FAAB5F, in file order.
  */
 static const unsigned char vhdx_logical_sector_size[16] = {
   0x1D, 0xBF, 0x41, 0x81, 0x6F, 0xA9, 0x09, 0x47,
   0xBA, 0x47, 0xF2, 0x33, 0xA8, 0xFA, 0xAB, 0x5F
 };
 
 /**
  * Metadata item GUID "Physical Sector Size",
  * CDA348C7-445D-4471-9CC9-E9885251C556, in file order.
  */
 static const unsigned char vhdx_physical_sector_size[16] = {
   0xC7, 0x48, 0xA3, 0xCD, 0x5D, 0x44, 0x71, 0x44,
   0x9C, 0xC9, 0xE9, 0x88, 0x52, 0x51, 0xC5, 0x56
 };
 
 /**
  * Metadata item GUID "Parent Locator",
  * A8D35F2D-B30B-454D-ABF7-D3D84834AB0C, in file order.
  */
 static const unsigned char vhdx_parent_locator[16] = {
   0x2D, 0x5F, 0xD3, 0xA8, 0x0B, 0xB3, 0x4D, 0x45,
   0xAB, 0xF7, 0xD3, 0xD8, 0x48, 0x34, 0xAB, 0x0C
 };
 
 
 /**
  * Report what the VHDX parent locator says about the parent image.
  *
  * The locator is a small table of UTF-16LE key/value pairs; the keys
  * that matter are `relative_path', `volume_path' and
  * `absolute_win32_path', each of which names the file the differencing
  * image depends on.
  *
  * @param ec extraction context
  * @param item the parent locator metadata item
  * @param len number of bytes in @a item
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 vhdx_parent_paths (struct EXTRACTOR_ExtractContext *ec,
                    const unsigned char *item,
                    size_t len)
 {
   uint16_t count;
 
   if (20 > len)
     return 0;
   count = EXTRACTOR_forensic_le16_ (&item[18]);
   if (EXTRACTOR_FORENSIC_MAX_ITEMS < count)
     count = EXTRACTOR_FORENSIC_MAX_ITEMS;
   for (uint16_t i = 0; i < count; i++)
   {
     size_t base = 20 + (size_t) i * 12;
     uint32_t key_offset;
     uint32_t value_offset;
     uint16_t key_len;
     uint16_t value_len;
     char key[64];
 
     if (base + 12 > len)
       break;
     key_offset = EXTRACTOR_forensic_le32_ (&item[base]);
     value_offset = EXTRACTOR_forensic_le32_ (&item[base + 4]);
     key_len = EXTRACTOR_forensic_le16_ (&item[base + 8]);
     value_len = EXTRACTOR_forensic_le16_ (&item[base + 10]);
     if ( (key_offset > len) ||
          (key_len > len - key_offset) ||
          (value_offset > len) ||
          (value_len > len - value_offset) )
       continue;   /* the entry points outside the item */
     if ( (0 == value_len) ||
          (0 == key_len) ||
          (sizeof (key) * 2 <= key_len) )
       continue;
     /* The keys are ASCII spelled in UTF-16LE; fold them down by hand
        so we can compare them without another conversion buffer. */
     {
       size_t out = 0;
 
       for (size_t k = 0; k + 1 < key_len; k += 2)
       {
         if (0 != item[key_offset + k + 1])
         {
           out = 0;
           break;   /* not ASCII, so not a key we know */
         }
         key[out++] = (char) item[key_offset + k];
       }
       if (0 == out)
         continue;
       key[out] = '\0';
     }
     if ( (key_is (key,
                   "relative_path")) ||
          (key_is (key,
                   "volume_path")) ||
          (key_is (key,
                   "absolute_win32_path")) )
       CHECK (EXTRACTOR_forensic_emit_utf16le_ (ec,
                                                DISKIMAGE,
                                                EXTRACTOR_METATYPE_PARENT_IMAGE,
                                                &item[value_offset],
                                                value_len));
   }
   return 0;
 }
 
 
 /**
  * Read one VHDX metadata item and report it.
  *
  * @param ec extraction context
  * @param guid the item GUID from the metadata table
  * @param offset absolute file offset of the item
  * @param len number of bytes in the item
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 vhdx_metadata_item (struct EXTRACTOR_ExtractContext *ec,
                     const unsigned char *guid,
                     uint64_t offset,
                     uint32_t len)
 {
   unsigned char item[64];
 
   if (0 == memcmp (guid,
                    vhdx_virtual_disk_size,
                    sizeof (vhdx_virtual_disk_size)))
   {
     uint64_t size;
 
     if ( (8 > len) ||
          (! EXTRACTOR_forensic_read_ (ec,
                                       (int64_t) offset,
                                       item,
                                       8)) )
       return 0;
     size = EXTRACTOR_forensic_le64_ (item);
     if ( (0 != size) &&
          (size < (1ULL << 62)) )
       CHECK (EXTRACTOR_forensic_emit_size_ (ec,
                                             DISKIMAGE,
                                             EXTRACTOR_METATYPE_VOLUME_SIZE,
                                             size));
     return 0;
   }
   if (0 == memcmp (guid,
                    vhdx_virtual_disk_id,
                    sizeof (vhdx_virtual_disk_id)))
   {
     if ( (16 > len) ||
          (! EXTRACTOR_forensic_read_ (ec,
                                       (int64_t) offset,
                                       item,
                                       16)) )
       return 0;
     return EXTRACTOR_forensic_emit_guid_ (ec,
                                           DISKIMAGE,
                                           EXTRACTOR_METATYPE_VOLUME_SERIAL,
                                           item,
                                           1);
   }
   if (0 == memcmp (guid,
                    vhdx_file_parameters,
                    sizeof (vhdx_file_parameters)))
   {
     uint32_t block_size;
     uint32_t flags;
 
     if ( (8 > len) ||
          (! EXTRACTOR_forensic_read_ (ec,
                                       (int64_t) offset,
                                       item,
                                       8)) )
       return 0;
     block_size = EXTRACTOR_forensic_le32_ (item);
     flags = EXTRACTOR_forensic_le32_ (&item[4]);
     if ( (0 != block_size) &&
          (block_size <= (256 * 1024 * 1024)) )
       CHECK (EXTRACTOR_forensic_emit_size_ (ec,
                                             DISKIMAGE,
                                             EXTRACTOR_METATYPE_BLOCK_SIZE,
                                             block_size));
     if (0 != (flags & 1U))
       CHECK (EXTRACTOR_forensic_emit_ (ec,
                                        DISKIMAGE,
                                        EXTRACTOR_METATYPE_ATTRIBUTES,
                                        "%s",
                                        "fixed disk (blocks left allocated)"));
     if (0 != (flags & 2U))
       CHECK (EXTRACTOR_forensic_emit_ (ec,
                                        DISKIMAGE,
                                        EXTRACTOR_METATYPE_ATTRIBUTES,
                                        "%s",
                                        "differencing disk"));
     return 0;
   }
   if ( (0 == memcmp (guid,
                      vhdx_logical_sector_size,
                      sizeof (vhdx_logical_sector_size))) ||
        (0 == memcmp (guid,
                      vhdx_physical_sector_size,
                      sizeof (vhdx_physical_sector_size))) )
   {
     int logical = (0 == memcmp (guid,
                                 vhdx_logical_sector_size,
                                 sizeof (vhdx_logical_sector_size)));
 
     if ( (4 > len) ||
          (! EXTRACTOR_forensic_read_ (ec,
                                       (int64_t) offset,
                                       item,
                                       4)) )
       return 0;
     return EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_COMMENT,
                                      "%s sector size: %u bytes",
                                      logical ? "logical" : "physical",
                                      (unsigned int) EXTRACTOR_forensic_le32_ (
                                        item));
   }
   if (0 == memcmp (guid,
                    vhdx_parent_locator,
                    sizeof (vhdx_parent_locator)))
   {
     unsigned char *locator;
     int ret;
 
     if ( (20 > len) ||
          (VHDX_MAX_ITEM < len) )
       return 0;
     if (NULL == (locator = malloc (len)))
       return 0;
     if (! EXTRACTOR_forensic_read_ (ec,
                                     (int64_t) offset,
                                     locator,
                                     len))
     {
       free (locator);
       return 0;
     }
     ret = vhdx_parent_paths (ec,
                              locator,
                              len);
     free (locator);
     return ret;
   }
   return 0;
 }
 
 
 /**
  * Walk the VHDX metadata table and report the items we understand.
  *
  * @param ec extraction context
  * @param region_offset file offset of the metadata region
  * @param region_length number of bytes in the metadata region
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 vhdx_metadata_table (struct EXTRACTOR_ExtractContext *ec,
                      uint64_t region_offset,
                      uint32_t region_length)
 {
   unsigned char head[32];
   unsigned char *table;
   uint16_t count;
   size_t table_bytes;
   int ret = 0;
 
   if (! EXTRACTOR_forensic_read_ (ec,
                                   (int64_t) region_offset,
                                   head,
                                   sizeof (head)))
     return 0;
   if (0 != memcmp (head,
                    "metadata",
                    8))
     return 0;
   count = EXTRACTOR_forensic_le16_ (&head[10]);
   if (VHDX_MAX_METADATA < count)
     return 0;   /* more than the format allows: do not trust the table */
   if (0 == count)
     return 0;
   table_bytes = (size_t) count * 32;
   if (region_length < 32 + table_bytes)
     return 0;
   if (NULL == (table = malloc (table_bytes)))
     return 0;
   if (! EXTRACTOR_forensic_read_ (ec,
                                   (int64_t) (region_offset + 32),
                                   table,
                                   table_bytes))
   {
     free (table);
     return 0;
   }
   for (uint16_t i = 0; i < count; i++)
   {
     const unsigned char *e = &table[(size_t) i * 32];
     uint32_t item_offset = EXTRACTOR_forensic_le32_ (&e[16]);
     uint32_t item_len = EXTRACTOR_forensic_le32_ (&e[20]);
 
     if ( (0 == item_len) ||
          (VHDX_MAX_ITEM < item_len) )
       continue;
     /* The item offset is relative to the start of the region and both
        it and the item have to stay inside it. */
     if ( (item_offset < 32) ||
          (item_offset > region_length) ||
          (item_len > region_length - item_offset) )
       continue;
     if (0 != vhdx_metadata_item (ec,
                                  e,
                                  region_offset + item_offset,
                                  item_len))
     {
       ret = 1;
       break;
     }
   }
   free (table);
   return ret;
 }
 
 
 /**
  * Walk a VHDX region table looking for the metadata region.
  *
  * @param ec extraction context
  * @param offset file offset of the region table (192KB or 256KB)
  * @param fsize size of the file, UINT64_MAX if unknown
  * @param[out] found set to 1 if the metadata region was reported
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 vhdx_region_table (struct EXTRACTOR_ExtractContext *ec,
                    uint64_t offset,
                    uint64_t fsize,
                    int *found)
 {
   unsigned char head[16];
   unsigned char *entries;
   uint32_t count;
   int ret = 0;
 
   if (! EXTRACTOR_forensic_read_ (ec,
                                   (int64_t) offset,
                                   head,
                                   sizeof (head)))
     return 0;
   if (0 != memcmp (head,
                    "regi",
                    4))
     return 0;
   count = EXTRACTOR_forensic_le32_ (&head[8]);
   if ( (0 == count) ||
        (VHDX_MAX_REGIONS < count) )
     return 0;
   if (NULL == (entries = malloc ((size_t) count * 32)))
     return 0;
   if (! EXTRACTOR_forensic_read_ (ec,
                                   (int64_t) (offset + 16),
                                   entries,
                                   (size_t) count * 32))
   {
     free (entries);
     return 0;
   }
   for (uint32_t i = 0; i < count; i++)
   {
     const unsigned char *e = &entries[(size_t) i * 32];
     uint64_t region_offset;
     uint32_t region_length;
 
     if (0 != memcmp (e,
                      vhdx_metadata_region,
                      sizeof (vhdx_metadata_region)))
       continue;
     region_offset = EXTRACTOR_forensic_le64_ (&e[16]);
     region_length = EXTRACTOR_forensic_le32_ (&e[24]);
     if ( (0 == region_offset) ||
          (0 == region_length) ||
          (region_offset > (uint64_t) INT64_MAX - region_length) )
       continue;
     if ( (UINT64_MAX != fsize) &&
          (region_offset + region_length > fsize) )
       continue;   /* truncated file: the region is not there */
     *found = 1;
     ret = vhdx_metadata_table (ec,
                                region_offset,
                                region_length);
     break;
   }
   free (entries);
   return ret;
 }
 
 
 /**
  * Extract from a VHDX image.  The `vhdxfile' signature has already
  * matched.
  *
  * @param ec extraction context
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 extract_vhdx (struct EXTRACTOR_ExtractContext *ec)
 {
   unsigned char creator[512];
   unsigned char head[80];
   uint64_t best_sequence = 0;
   int have_head = 0;
   uint64_t fsize;
   int found = 0;
 
   memset (head,
           0,
           sizeof (head));
   CHECK (emit_mime (ec,
                     "application/x-vhdx"));
   CHECK (EXTRACTOR_forensic_emit_ (ec,
                                    DISKIMAGE,
                                    EXTRACTOR_METATYPE_FORMAT,
                                    "%s",
                                    "VHDX"));
   if (EXTRACTOR_forensic_read_ (ec,
                                 8,
                                 creator,
                                 sizeof (creator)))
     CHECK (EXTRACTOR_forensic_emit_utf16le_ (ec,
                                              DISKIMAGE,
                                              EXTRACTOR_METATYPE_CREATED_BY_SOFTWARE,
                                              creator,
                                              sizeof (creator)));
   /* Two copies of the header live at 64KB and 128KB; the one with the
      higher sequence number is current.  We do not verify the CRC-32C
      the format puts on each of them, so a corrupt header is reported
      as if it were good. */
   for (unsigned int i = 0; i < 2; i++)
   {
     unsigned char candidate[80];
     uint64_t sequence;
 
     if (! EXTRACTOR_forensic_read_ (ec,
                                     (int64_t) (0x10000 + i * 0x10000),
                                     candidate,
                                     sizeof (candidate)))
       continue;
     if (0 != memcmp (candidate,
                      "head",
                      4))
       continue;
     sequence = EXTRACTOR_forensic_le64_ (&candidate[8]);
     if ( (have_head) &&
          (sequence < best_sequence) )
       continue;
     memcpy (head,
             candidate,
             sizeof (head));
     best_sequence = sequence;
     have_head = 1;
   }
   if (have_head)
   {
     CHECK (EXTRACTOR_forensic_emit_ (ec,
                                      DISKIMAGE,
                                      EXTRACTOR_METATYPE_FORMAT_VERSION,
                                      "%u",
                                      (unsigned int)
                                      EXTRACTOR_forensic_le16_ (&head[66])));
     /* A non-zero LogGuid means the log holds entries that were never
        replayed into the image: the writer did not shut down. */
     {
       int empty = 1;
 
       for (unsigned int i = 0; i < 16; i++)
         if (0 != head[48 + i])
         {
           empty = 0;
           break;
         }
       if (! empty)
         CHECK (EXTRACTOR_forensic_emit_ (ec,
                                          DISKIMAGE,
                                          EXTRACTOR_METATYPE_COMMENT,
                                          "%s",
                                          "unflushed log present"
                                          " (image was not shut down cleanly)"));
     }
   }
   fsize = ec->get_size (ec->cls);
   /* The region table sits at a fixed 192KB, with a backup at 256KB. */
   CHECK (vhdx_region_table (ec,
                             0x30000,
                             fsize,
                             &found));
   if (! found)
     CHECK (vhdx_region_table (ec,
                               0x40000,
                               fsize,
                               &found));
   return 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 
 
 /**
  * Main entry method for the virtual disk image extraction plugin.
  *
  * @param ec extraction context provided to the plugin
  */
 void
 EXTRACTOR_diskimage_extract_method (struct EXTRACTOR_ExtractContext *ec);
 
 void
 EXTRACTOR_diskimage_extract_method (struct EXTRACTOR_ExtractContext *ec)
 {
   unsigned char magic[16];
   unsigned char foot[512];
   uint64_t fsize;
 
   if (! EXTRACTOR_forensic_read_ (ec,
                                   0,
                                   magic,
                                   sizeof (magic)))
     return;
   if (0 == memcmp (magic,
                    "QFI\xfb",
                    4))
   {
     (void) extract_qcow (ec);
     return;
   }
   if (0 == memcmp (magic,
                    "KDMV",
                    4))
   {
     (void) extract_vmdk_sparse (ec);
     return;
   }
   if (0 == memcmp (magic,
                    "# Disk Descripto",
                    16))
   {
     (void) extract_vmdk_text (ec);
     return;
   }
   if (0 == memcmp (magic,
                    "vhdxfile",
                    8))
   {
     (void) extract_vhdx (ec);
     return;
   }
   if (0 == memcmp (magic,
                    "conectix",
                    8))
   {
     /* A dynamic or differencing VHD mirrors its footer at the front,
        so we already have it and need no seek. */
     if (EXTRACTOR_forensic_read_ (ec,
                                   0,
                                   foot,
                                   sizeof (foot)))
       (void) extract_vhd (ec,
                           foot);
     return;
   }
   /* Only a fixed VHD is left, and its footer is at the very end.  That
      costs a seek on every file we were handed, so pay it only for the
      files that could be one: a VHD is a whole number of 512 byte
      sectors plus the footer, hence always 512 byte aligned.  (Virtual
      PC 2004 and older wrote a 511 byte footer; those are not
      recognised.) */
   fsize = ec->get_size (ec->cls);
   if ( (UINT64_MAX == fsize) ||
        (1024 > fsize) ||
        ((uint64_t) INT64_MAX < fsize) ||
        (0 != (fsize % 512)) )
     return;
   if (! EXTRACTOR_forensic_read_ (ec,
                                   (int64_t) (fsize - 512),
                                   foot,
                                   sizeof (foot)))
     return;
   if (0 != memcmp (foot,
                    "conectix",
                    8))
     return;
   (void) extract_vhd (ec,
                       foot);
 }
 
 
 /* end of diskimage_extractor.c */