Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Mistake in Virtual Hard Disk Image Format Specification?

Tags:

windows

vhd

I want to calculate the end offset of a parent locator in a VHD. Here is a part of the VHD header:

Cookie: cxsparse
Data offset: 0xffffffffffffffff
Table offset: 0x2000
Header version: 0x00010000
Max table entries: 10240
Block size: 0x200000
Checksum: 4294956454
Parent Unique Id: 0x9678bf077e719640b55e40826ce5d178
Parent time stamp: 525527478
Reserved: 0
Parent Unicode name:
Parent locator 1:
- platform code: 0x57326b75
- platform_data_space: 4096
- platform_data_length: 86
- reserved: 0
- platform_data_offset: 0x1000
Parent locator 2:
- platform code: 0x57327275
- platform_data_space: 65536
- platform_data_length: 34
- reserved: 0
- platform_data_offset: 0xc000

Some definitions from the Virtual Hard Disk Image Format Specification:

"Table Offset: This field stores the absolute byte offset of the Block Allocation Table (BAT) in the file. Platform Data Space: This field stores the number of 512-byte sectors needed to store the parent hard disk locator. Platform Data Offset: This field stores the absolute file offset in bytes where the platform specific file locator data is stored. Platform Data Length. This field stores the actual length of the parent hard disk locator in bytes."

Based on this the end offset of the two parent locators should be: data offset + 512 * data space:

0x1000 + 512 * 4096 = 0x201000
0xc000 + 512 * 65536 = 0x200c000

But if one uses only data offset + data space:

0x1000 + 4096 = 0x2000 //end of parent locator 1, begin of BAT
0xc000 + 65536 = 0x1c000

This latter calculation makes much more sense: the end of the first parent locator is the beginning of the BAT (see header data above); and since the first BAT entry is 0xe7 (sector offset), this corresponds to file offset 0x1ce00 (sector offset * 512), which is OK, if the second parent locator ends at 0x1c000.

But if one uses the formula data offset + 512 * data space, he ends up having other data written in the parent locator. (But, in this example there would be no data corruption, since Platform Data Length is very small)

So is this a mistake in the specification, and the sentence

"Platform Data Space: This field stores the number of 512-byte sectors needed to store the parent hard disk locator."

should be

"Platform Data Space: This field stores the number of bytes needed to store the parent hard disk locator."?

like image 982
robert Avatar asked Nov 23 '16 09:11

robert


1 Answers

Apparently Microsoft does not care about correcting their mistake, this being already discovered by Virtualbox developers. VHD.cpp contains the following comment:

/*
 * The VHD spec states that the DataSpace field holds the number of sectors
 * required to store the parent locator path.
 * As it turned out VPC and Hyper-V store the amount of bytes reserved for the
 * path and not the number of sectors.
 */
like image 84
robert Avatar answered Nov 15 '22 05:11

robert