cugu / apfs.ksy Goto Github PK

View Code? Open in Web Editor NEW

81.0 81.0 13.0 203 KB

APFS filesystem format for Kaitai Struct

License: MIT License

apfs.ksy's People

Contributors

Stargazers

Watchers

Forkers

hddscan greycat tempelmann cn-taoye jtsylve zchee hakanai iosforensics ydkhatri johndpope star1190 org-mars

apfs.ksy's Issues

Markdown file from blog post?

I think it'd be nice to maintain a version of your blog post as a Markdown file here, since it's far more readable than the ksy file, if you're just getting started. I've spotted several typos anyways, and with more discoveries it'd be nice to describe them in a more human readable format. I'd be happy to contribute the initial conversion.

Rename `padding` in header

As noted in #2 by @GreyCat padding in the header should be renamed.

Licensing

Please add some sort of open source license indication (both in this repository, as LICENSE file and/or README), and into .ksy file, using meta/license tag? It's much better to do it early, or it would be necessary to contact all contributors over the time later to get their agreement.

There are 3 contributors now (technically, 2, until you've approved my patch). As for myself, I'm totally ok with any OSI-approved license. @hddscan, you?

the lastest apfs.ksy cannot build code

line 713:
id:unknown_992
need a type or size

New mystery object type 0x12

In an encrypted image, a new section appears, the purpose of which is not immediately evident.

Header:
- 88 47 97 BE 00 4F 68 01 06 04 00 00 00 00 00 00
- 28 00 00 00 00 00 00 00 <- the only value that actually changes for all 0x12 blocks in my image. If interpreted as a block ID, it points at a root node, but not the one I'd expect it to point at.
- 12 00 00 80 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
64 00 00 00 00 00 00 00
FF FF FF FF FF FF FF FF
01 00 00 00
Then what looks like 40 byte blocks...
- 1
  - 02 00 00 00 00 00 00 00
  - 02 00 00 40 00 10 00 00 - 0x40000002 and 0x1000
  - 02 04 00 00 00 00 00 00 - looks like an object ID
  - 58 00 00 00 00 00 00 00
  - 13 00 00 00 00 00 00 00
- 2
  - 00 00 00 00 00 00 00 00
  - 0D 00 00 00 00 10 00 00
  - 00 00 00 00 00 00 00 00
  - 02 04 00 00 00 00 00 00 - looks like an object ID
  - 01 00 00 00 00 00 00 00
- 3
  - 03 00 00 00 00 00 00 00
  - 02 00 00 40 00 10 00 00 - 0x40000002 and 0x1000
  - 02 04 00 00 00 00 00 00 - looks like an object ID
  - 60 00 00 00 00 00 00 00
  - 13 00 00 00 00 00 00 00
- 4
  - 04 00 00 00 00 00 00 00
  - 02 00 00 40 00 10 00 00 - 0x40000002 and 0x1000
  - 02 04 00 00 00 00 00 00 - looks like an object ID
  - 6F 00 00 00 00 00 00 00
  - 13 00 00 00 00 00 00 00

...

00000000  85 4b 97 be 04 4b 68 01  06 04 00 00 00 00 00 00  |.K...Kh.........|
00000010  27 00 00 00 00 00 00 00  12 00 00 80 00 00 00 00  |'...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 64 00 00 00  |............d...|
00000030  00 00 00 00 ff ff ff ff  ff ff ff ff 01 00 00 00  |................|
00000040  02 00 00 00 00 00 00 00  02 00 00 40 00 10 00 00  |...........@....|
00000050  02 04 00 00 00 00 00 00  58 00 00 00 00 00 00 00  |........X.......|
00000060  13 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  0d 00 00 00 00 10 00 00  00 00 00 00 00 00 00 00  |................|
00000080  02 04 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00000090  03 00 00 00 00 00 00 00  02 00 00 40 00 10 00 00  |...........@....|
000000a0  02 04 00 00 00 00 00 00  60 00 00 00 00 00 00 00  |........`.......|
000000b0  13 00 00 00 00 00 00 00  04 00 00 00 00 00 00 00  |................|
000000c0  02 00 00 40 00 10 00 00  02 04 00 00 00 00 00 00  |...@............|
000000d0  6f 00 00 00 00 00 00 00  13 00 00 00 00 00 00 00  |o...............|
000000e0  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000100  00 00 00 00 00 00 00 00  06 00 00 00 00 00 00 00  |................|
00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000130  07 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000150  00 00 00 00 00 00 00 00  08 00 00 00 00 00 00 00  |................|
00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000180  09 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001a0  00 00 00 00 00 00 00 00  0a 00 00 00 00 00 00 00  |................|
000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001d0  0b 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 00 00 00 00 00 00 00  0c 00 00 00 00 00 00 00  |................|
00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000220  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000230  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000240  00 00 00 00 00 00 00 00  0e 00 00 00 00 00 00 00  |................|
00000250  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000270  0f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000280  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000290  00 00 00 00 00 00 00 00  10 00 00 00 00 00 00 00  |................|
000002a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000002c0  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000002d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000002e0  00 00 00 00 00 00 00 00  12 00 00 00 00 00 00 00  |................|
000002f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000310  13 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000320  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000330  00 00 00 00 00 00 00 00  14 00 00 00 00 00 00 00  |................|
00000340  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000360  15 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000370  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000380  00 00 00 00 00 00 00 00  16 00 00 00 00 00 00 00  |................|
00000390  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000003b0  17 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000003c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000003d0  00 00 00 00 00 00 00 00  18 00 00 00 00 00 00 00  |................|
000003e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000400  19 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000410  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000420  00 00 00 00 00 00 00 00  1a 00 00 00 00 00 00 00  |................|
00000430  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000450  1b 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000460  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000470  00 00 00 00 00 00 00 00  1c 00 00 00 00 00 00 00  |................|
00000480  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000004a0  1d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000004b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000004c0  00 00 00 00 00 00 00 00  1e 00 00 00 00 00 00 00  |................|
000004d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000004f0  1f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000500  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000510  00 00 00 00 00 00 00 00  20 00 00 00 00 00 00 00  |........ .......|
00000520  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000540  21 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |!...............|
00000550  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000560  00 00 00 00 00 00 00 00  22 00 00 00 00 00 00 00  |........".......|
00000570  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000590  23 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |#...............|
000005a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000005b0  00 00 00 00 00 00 00 00  24 00 00 00 00 00 00 00  |........$.......|
000005c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000005e0  25 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |%...............|
000005f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000600  00 00 00 00 00 00 00 00  26 00 00 00 00 00 00 00  |........&.......|
00000610  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000630  27 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |'...............|
00000640  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000650  00 00 00 00 00 00 00 00  28 00 00 00 00 00 00 00  |........(.......|
00000660  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000680  29 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |)...............|
00000690  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000006a0  00 00 00 00 00 00 00 00  2a 00 00 00 00 00 00 00  |........*.......|
000006b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000006d0  2b 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |+...............|
000006e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000006f0  00 00 00 00 00 00 00 00  2c 00 00 00 00 00 00 00  |........,.......|
00000700  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000720  2d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |-...............|
00000730  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000740  00 00 00 00 00 00 00 00  2e 00 00 00 00 00 00 00  |................|
00000750  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000770  2f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |/...............|
00000780  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000790  00 00 00 00 00 00 00 00  30 00 00 00 00 00 00 00  |........0.......|
000007a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000007c0  31 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |1...............|
000007d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000007e0  00 00 00 00 00 00 00 00  32 00 00 00 00 00 00 00  |........2.......|
000007f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000810  33 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |3...............|
00000820  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000830  00 00 00 00 00 00 00 00  34 00 00 00 00 00 00 00  |........4.......|
00000840  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000860  35 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |5...............|
00000870  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000880  00 00 00 00 00 00 00 00  36 00 00 00 00 00 00 00  |........6.......|
00000890  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000008b0  37 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |7...............|
000008c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000008d0  00 00 00 00 00 00 00 00  38 00 00 00 00 00 00 00  |........8.......|
000008e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000900  39 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |9...............|
00000910  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000920  00 00 00 00 00 00 00 00  3a 00 00 00 00 00 00 00  |........:.......|
00000930  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000950  3b 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |;...............|
00000960  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000970  00 00 00 00 00 00 00 00  3c 00 00 00 00 00 00 00  |........<.......|
00000980  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000009a0  3d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |=...............|
000009b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000009c0  00 00 00 00 00 00 00 00  3e 00 00 00 00 00 00 00  |........>.......|
000009d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000009f0  3f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |?...............|
00000a00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000a10  00 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00  |........@.......|
00000a20  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000a40  41 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |A...............|
00000a50  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000a60  00 00 00 00 00 00 00 00  42 00 00 00 00 00 00 00  |........B.......|
00000a70  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000a90  43 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |C...............|
00000aa0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000ab0  00 00 00 00 00 00 00 00  44 00 00 00 00 00 00 00  |........D.......|
00000ac0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000ae0  45 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |E...............|
00000af0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000b00  00 00 00 00 00 00 00 00  46 00 00 00 00 00 00 00  |........F.......|
00000b10  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000b30  47 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |G...............|
00000b40  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000b50  00 00 00 00 00 00 00 00  48 00 00 00 00 00 00 00  |........H.......|
00000b60  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000b80  49 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |I...............|
00000b90  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000ba0  00 00 00 00 00 00 00 00  4a 00 00 00 00 00 00 00  |........J.......|
00000bb0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000bd0  4b 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |K...............|
00000be0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000bf0  00 00 00 00 00 00 00 00  4c 00 00 00 00 00 00 00  |........L.......|
00000c00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000c20  4d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |M...............|
00000c30  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000c40  00 00 00 00 00 00 00 00  4e 00 00 00 00 00 00 00  |........N.......|
00000c50  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000c70  4f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |O...............|
00000c80  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000c90  00 00 00 00 00 00 00 00  50 00 00 00 00 00 00 00  |........P.......|
00000ca0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000cc0  51 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |Q...............|
00000cd0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000ce0  00 00 00 00 00 00 00 00  52 00 00 00 00 00 00 00  |........R.......|
00000cf0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000d10  53 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |S...............|
00000d20  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000d30  00 00 00 00 00 00 00 00  54 00 00 00 00 00 00 00  |........T.......|
00000d40  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000d60  55 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |U...............|
00000d70  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000d80  00 00 00 00 00 00 00 00  56 00 00 00 00 00 00 00  |........V.......|
00000d90  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000db0  57 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |W...............|
00000dc0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000dd0  00 00 00 00 00 00 00 00  58 00 00 00 00 00 00 00  |........X.......|
00000de0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000e00  59 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |Y...............|
00000e10  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000e20  00 00 00 00 00 00 00 00  5a 00 00 00 00 00 00 00  |........Z.......|
00000e30  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000e50  5b 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |[...............|
00000e60  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000e70  00 00 00 00 00 00 00 00  5c 00 00 00 00 00 00 00  |........\.......|
00000e80  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000ea0  5d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |]...............|
00000eb0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000ec0  00 00 00 00 00 00 00 00  5e 00 00 00 00 00 00 00  |........^.......|
00000ed0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000ef0  5f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |_...............|
00000f00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000f10  00 00 00 00 00 00 00 00  60 00 00 00 00 00 00 00  |........`.......|
00000f20  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000f40  61 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |a...............|
00000f50  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000f60  00 00 00 00 00 00 00 00  62 00 00 00 00 00 00 00  |........b.......|
00000f70  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000f90  63 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |c...............|
00000fa0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000fb0  00 00 00 00 00 00 00 00  ff ff ff ff 00 00 00 00  |................|
00000fc0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000

Significant difference between space manager blocks documented here vs. Apple docs

This is a table of the differences between what's documented here and what Apple eventually released in the docs:

Current KSY	Apple Docs
	sm_o (obj_phys_t)
block_size (u4)	sm_block_size (uint32_t)
blocks_per_chunk (u4)	sm_blocks_per_chunk (uint32_t)
chunks_per_cib (u4)	sm_chunks_per_cib (uint32_t)
cibs_per_cab (u4)	sm_cibs_per_cab (uint32_t)
block_count (u4)	sm_dev[0].sm_block_count (uint64_t)
chunk_count (u4)
cib_count (u4)	sm_dev[0].sm_chunk_count (uint64_t)
cab_count (u4)
entry_count (u4)	sm_dev[0].sm_cib_count (uint32_t)
unknown_68 (u4)	sm_dev[0].sm_cab_count (uint32_t)
free_block_count (u8)	sm_dev[0].sm_free_count (uint64_t)
entries_offset (u4)	sm_dev[0].sm_addr_offset (uint32_t)
unknown_84 (92)	sm_dev[0].sm_reserved (uint32_t)
	sm_dev[0].sm_reserved2 (uint64_t)
	sm_dev[1].sm_block_count (uint64_t)
	sm_dev[1].sm_chunk_count (uint64_t)
	sm_dev[1].sm_cib_count (uint32_t)
	sm_dev[1].sm_cab_count (uint32_t)
	sm_dev[1].sm_free_count (uint64_t)
	sm_dev[1].sm_addr_offset (uint32_t)
	sm_dev[1].sm_reserved (uint32_t)
	sm_dev[1].sm_reserved2 (uint64_t)
	sm_flags (uint32_t)
	sm_ip_bm_tx_multiplier (uint32_t)
	sm_ip_block_count (uint64_t)
	sm_ip_bm_size_in_blocks (uint32_t)
	sm_ip_bm_block_count (uint32_t)
	sm_ip_bm_base (paddr_t)
prev_spaceman_internal_pool_block (u8)	sm_ip_base (paddr_t)
	sm_fs_reserve_block_count (uint64_t)
	sm_fs_reserve_alloc_count (uint64_t)
	sm_fq[SFQ_COUNT] (spaceman_free_queue_t)
	sm_ip_bm_free_head (uint16_t)
	sm_ip_bm_free_tail (uint16_t)
	sm_ip_bm_xid_offset (uint32_t)
	sm_ip_bitmap_offset (uint32_t)
	sm_ip_bm_free_next_offset (uint32_t)
	sm_version (uint32_t)
	sm_struct_size (uint32_t)
	sm_datazone (spaceman_datazone_info_phys_t)

I tried updating my own parsing code to match theirs, but some of my existing data didn't seem to parse using their documented structure. However, I noticed that there's a version field in the structure, and even in my own data set, I see many different values for that field. I haven't quite figured out whether we've screwed up writing the parsing code, or whether there really are multiple versions of the structure for different versions of APFS, or it could possibly even be a little of each.

My first minimalistic test case doesn't appear to be parseable

I thought I'd make an APFS container with no volumes:

dd if=/dev/zero of=/tmp/image.img bs=1024 count=1024
newfs_apfs -C /tmp/image.img

This way I figured I can get the container parsing working without having to get involved with volume parsing, and do volume parsing after getting the container working.

At 0x1000 I have a table block, the main checkpoint superblock descriptor. According to multiple sources, offset 0x20 should be the table type, which is set to 1. As far as I can tell, this means the block is supposed to have a footer, but the bytes towards the end of the block are all zero. Zero would be an invalid footer presumably, because one of the fields is the total record count, but the total record count in the header is 2.

So I couldn't figure it out, and went looking to see if anyone else had a working parser for the format. Which lead me here. :)

When I tried to open my image in Kaitai with this .ksy file, I get "Call stack: undefined EOFError: requested 4096 bytes, but only 0 bytes available". But it's also the first time I've ever used Kaitai, so I could also be doing something wrong, or something could have truncated my file when I put it in.

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.