├── README.md
└── VMDKTemplate.bt


/README.md:
--------------------------------------------------------------------------------
1 | # VMDK-Template
2 | 010 Editor Template for parsing VMware Disk(vmdk) images. 
3 | This is not foolproof and has only been tested with sparse images.
4 | Refer to the [official docs](https://www.vmware.com/support/developer/vddk/vmdk_50_technote.pdf) for more info.
5 | 


--------------------------------------------------------------------------------
/VMDKTemplate.bt:
--------------------------------------------------------------------------------
 1 | //--------------------------------------
 2 | //--- 010 Editor v5.0.1 Binary Template
 3 | //
 4 | // File: VMDKTemplate.bt
 5 | // Author: ExtremeCoders
 6 | // Revision: 001
 7 | // Purpose: Template for VMDK Files
 8 | //--------------------------------------
 9 | typedef ubyte uint8;
10 | #define SECTOR_SIZE 512
11 | 
12 | typedef uint64 SectorType;
13 | typedef uint8 Bool;
14 | 
15 | typedef struct SparseExtentHeader
16 | {    
17 |     uint32 magicNumber <format=hex>;
18 |     uint32 version;
19 |     uint32 hasValidNewLineDetectionList : 1;
20 |     uint32 isRedundantGrainTableUsed : 1;
21 |     uint32 isZeroedGTEUsed : 1;
22 |     uint32      : 13;
23 |     uint32 areGrainsCompressed : 1;
24 |     uint32 areMarkersUsed : 1;
25 |     SectorType capacity;
26 |     SectorType grainSize;
27 |     SectorType descriptorOffset;
28 |     SectorType descriptorSize;
29 |     uint32 numGTEsPerGT;
30 |     SectorType rgdOffset;
31 |     SectorType gdOffset;
32 |     SectorType overHead;
33 |     Bool uncleanShutdown;
34 |     char singleEndLineChar;
35 |     char nonEndLineChar;
36 |     char doubleEndLineChar1;
37 |     char doubleEndLineChar2;
38 |     uint16 compressAlgorithm;
39 |     uint8 pad[433];
40 | };
41 | 
42 | typedef struct GrainDirectory(uint numEntries)
43 | {
44 |     uint32 grainDirectoryEntry[numEntries]; 
45 | };
46 | 
47 | typedef struct GrainTable
48 | {
49 |     uint32 grainTableEntry[spe.numGTEsPerGT];
50 | };
51 | 
52 | typedef struct Sector
53 | {
54 |     ubyte data[SECTOR_SIZE];
55 | };
56 | 
57 | typedef struct Grain
58 | {
59 |     Sector sector[128]; // Each grain contains 128 sectors
60 | };
61 | 
62 | LittleEndian();
63 | 
64 | SparseExtentHeader spe;
65 | FSeek(spe.gdOffset * SECTOR_SIZE);
66 | 
67 | // Calculate number of grain directory entry 
68 | local int numGDEntries;
69 | for (numGDEntries = 0; numGDEntries < 64; numGDEntries++)
70 | {
71 |     if (ReadInt(FTell() + numGDEntries*4) == 0) break;    
72 | }
73 | 
74 | GrainDirectory gd(numGDEntries);
75 | 
76 | local int i, j, sectorNum;
77 | sectorNum = 0;
78 | 
79 | for (i = 0; i < numGDEntries; i++)
80 | {
81 |     FSeek(gd.grainDirectoryEntry[i] * SECTOR_SIZE);
82 |     GrainTable gt;
83 |     for (j = 0; j < spe.numGTEsPerGT; j++) 
84 |     {
85 |         FSeek(gt.grainTableEntry[j] * SECTOR_SIZE);
86 |         Grain g;
87 |         sectorNum++;
88 |     }
89 | }
90 | 


--------------------------------------------------------------------------------