Digg this topic Add to my del.icio.us Submit to SlashDot  
Reply to this topicStart new topic
> Image file Offset, various VM disks images
bilou_gateux
post May 17 2007, 12:41 PM
Post #1


Advanced Member
***

Group: Advanced user
Posts: 68
Joined: 1-August 06
Member No.: 97


France


i would like to have in this topic various examples of correct offset to use to mount well knowns image formats:
VMware vmdk, Microsoft SDI, and so on.

Probably Jaclaz has already posted in other threads here or on 911cd.net forums different well documented infos about this.

If we could put them together here, it would help to find the required steps to compute the offset.
Go to the top of the page
 
+Quote Post
bilou_gateux
post May 17 2007, 01:08 PM
Post #2


Advanced Member
***

Group: Advanced user
Posts: 68
Joined: 1-August 06
Member No.: 97


France


http://www.911cd.net/forums//index.php?s=&...st&p=127894
QUOTE (cdob @ Feb 20 2007, 03:25 PM) *
There are different images.

XP embedded sdi image: a hard disk image with a header.
8 sector header: sector zero of a hard disk. And partion geometry use CHS 63 sectors.
Therefore boot sector of first partition is at sector 71.
A hd sector contains 512 byte data.

71*512=36352


SDI is a portable file format for XP Embedded images: -b 36352
Go to the top of the page
 
+Quote Post
bilou_gateux
post May 17 2007, 01:59 PM
Post #3


Advanced Member
***

Group: Advanced user
Posts: 68
Joined: 1-August 06
Member No.: 97


France


http://wiki.osx86project.org/wiki/index.ph...oot_Related_FAQ

QUOTE
The VMWare disk image contains more than just one partition, it's a *disk* image, so it represents the entire drive and not a single partition.
.../...
it depends entirely on the partition layout of the image in question. Also, this assumes that the image has only one partition, since it copies the entire disk but skips the first 32256 bytes (63 sectors) to the beginning of the first partition.

Here's the explanation that explain how I computed that the first partition (yes theres is only one in the image) start at sector 63:

in the image the first partition start at CHS 0/1/1 (from the partition table in last 66 bytes of the first 512 bytes of the image, aka the MBR)

The equation to convert from CHS to LBA follows:
LBA = ( ( CYL * HPC + HEAD ) * SPT ) + SECT - 1

Where:
LBA: linear base address of the block
CYL: value of the cylinder CHS coordinate
HPC: number of heads per cylinder for the disk
HEAD: value of the head CHS coordinate
SPT: number of sectors per track for the disk
SECT: value of the sector CHS coordinate

with (from file tiger-x86.vmdk)
ddb.geometry.sectors = "63"
ddb.geometry.heads = "16"
ddb.geometry.cylinders = "9825"

LBA = (0 + 1) * 63 + (1 - 1) = 63
that is sector 63

63*512 = 32256


vmdk VMware flat disk images: -b 32256
Go to the top of the page
 
+Quote Post
jaclaz
post May 22 2007, 10:03 AM
Post #4


Finder
***

Group: Advanced user
Posts: 1,622
Joined: 14-July 06
Member No.: 2


Italy


Here are some links to where info has been posted:
cdob here on SDI and VMDK images:
http://www.911cd.net/forums//index.php?sho...=19333&st=9

Virtualbox .vdi image:
http://www.911cd.net/forums//index.php?sho...19155&st=22

from further tests it appears that the offset is NOT fixed, it seems to be dependant on disk size.

Basically, it is very easy to determine where the "real" RAW image starts, with the help of gsar or similar search utility, as long as the image has been formatted.

Both MBR and bootsectors have the "magic signature" 55AA as LAST two bytes.

Microsoft DOS 6.22 MBR starts with FA33C0
Microsoft's Win9.x/ME/Win2k/XP/2003 MBR starts with 33C08E

FAT 12/16 bootrecord starts with EB3C90
FAT 32 bootrecord starts with EB5890
NTFS bootrecord starts with EB5290

jaclaz
Go to the top of the page
 
+Quote Post
Olof Lagerkvist
post May 30 2007, 12:00 AM
Post #5


Advanced Member
***

Group: Developer
Posts: 122
Joined: 27-April 07
From: Borås, Sweden
Member No.: 6,234


Sweden


I just add from the thread "Mount Nero Image" the offset for the ISO image in a Nero .nrg file. The offset seems to be 307200 bytes, so -b 307200 or -b 600b as parameter to imdisk.exe should work (witchever is easiest to remember).
Go to the top of the page
 
+Quote Post
Sherpya
post May 30 2007, 01:49 AM
Post #6


Advanced Member
***

Group: Developer
Posts: 43
Joined: 29-May 07
From: Italy
Member No.: 7,875


Italy


you may implement an automatic offset "suggestion" in the cpl (i.e. the offset field may be already filled), by looking at first bytes of the file like unix file utility does
Go to the top of the page
 
+Quote Post
Olof Lagerkvist
post May 30 2007, 01:53 AM
Post #7


Advanced Member
***

Group: Developer
Posts: 122
Joined: 27-April 07
From: Borås, Sweden
Member No.: 6,234


Sweden


QUOTE (Sherpya @ May 30 2007, 03:49 AM) *
you may implement an automatic offset "suggestion" in the cpl (i.e. the offset field may be already filled), by looking at first bytes of the file like unix file utility does


Yes, I have plans for implementing that. I am collecting information about different image file formats so that it could be used for automatically finding offset values in future releases.
Go to the top of the page
 
+Quote Post
Sherpya
post Jul 16 2007, 10:59 PM
Post #8


Advanced Member
***

Group: Developer
Posts: 43
Joined: 29-May 07
From: Italy
Member No.: 7,875


Italy


this may be interesting:
http://fuse.sourceforge.net/wiki/index.php/FuseIso
as they said it would be easy to mount alchool and clone cd images
Go to the top of the page
 
+Quote Post
« Next Oldest · ImDisk · Next Newest »
 

Fast ReplyReply to this topicStart new topic

Members Who Viewed Topic Today ()

 

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

RSS Lo-Fi Version Time is now: 3rd March 2008 - 08:21 AM

MKPortal ©2003-2006 mkportal.it