none
Mistake in Virtual Hard Disk Image Format Specification? RRS feed

  • Question

  • I want to calculate the end offset of a parent locator in a VHD. Here is a part of the VHD header:

    Cookie: cxsparse
    Data offset: 0xffffffffffffffff
    Table offset: 0x2000
    Header version: 0x00010000
    Max table entries: 10240
    Block size: 0x200000
    Checksum: 4294956454
    Parent Unique Id: 0x9678bf077e719640b55e40826ce5d178
    Parent time stamp: 525527478
    Reserved: 0
    Parent Unicode name:
    Parent locator 1:
    - platform code: 0x57326b75
    - platform_data_space: 4096
    - platform_data_length: 86
    - reserved: 0
    - platform_data_offset: 0x1000
    Parent locator 2:
    - platform code: 0x57327275
    - platform_data_space: 65536
    - platform_data_length: 34
    - reserved: 0
    - platform_data_offset: 0xc000

    Some definitions from the Virtual Hard Disk Image Format Specification:

    Table Offset: This field stores the absolute byte offset of the Block Allocation Table (BAT) in the file.
    Platform Data Space: This field stores the number of 512-byte sectors needed to store the parent hard disk locator.
    Platform Data Offset: This field stores the absolute file offset in bytes where the platform specific file locator data is stored.

    Based on this the end offset of the two parent locators should be:

    data offset + 512 * data space:
    0x1000 + 512 * 4096 = 0x201000
    0xc000 + 512 * 65536 = 0x200c000

    But if one uses only data offset + data space:
    0x1000 + 4096 = 0x2000 end of parent locator 1, begin of BAT
    0xc000 + 65536 = 0x1c000

    This latter calculation makes much more sense: the end of the first parent locator is the beginning of the BAT (see header data above); and since the first BAT entry is 0xe7 (sector offset), this corresponds to file offset 0x1ce00 (sector offset * 512), which is OK, if the second parent locator ends at 0x1c000.

    But if one uses the formula data offset + 512 * data space, he ends up having other data written in the parent locator.

    So is this a mistake in the specification, and the sentence

    "Platform Data Space: This field stores the number of 512-byte sectors needed to store the parent hard disk locator."

    should be

    "Platform Data Space: This field stores the number of bytes needed to store the parent hard disk locator."?

    Wednesday, November 23, 2016 9:07 AM