Jump to content











Photo
* * * * * 1 votes

Image file Offset


  • Please log in to reply
9 replies to this topic

#1 bilou_gateux

bilou_gateux

    Frequent Member

  • Expert
  • 208 posts
  •  
    France

Posted 17 May 2007 - 12:41 PM

i would like to have in this topic various examples of correct offset to use to mount well knowns image formats:
VMware vmdk, Microsoft SDI, and so on.

Probably Jaclaz has already posted in other threads here or on 911cd.net forums different well documented infos about this.

If we could put them together here, it would help to find the required steps to compute the offset.

#2 bilou_gateux

bilou_gateux

    Frequent Member

  • Expert
  • 208 posts
  •  
    France

Posted 17 May 2007 - 01:08 PM

There are different images.

XP embedded sdi image: a hard disk image with a header.
8 sector header: sector zero of a hard disk. And partion geometry use CHS 63 sectors.
Therefore boot sector of first partition is at sector 71.
A hd sector contains 512 byte data.

71*512=36352


Note: The first 4 KB of each SDI image file consists of the SDI header information.

SDI Disk image: 4096 SDI header + 32256 DISK BLOB offset: -b 36352

#3 bilou_gateux

bilou_gateux

    Frequent Member

  • Expert
  • 208 posts
  •  
    France

Posted 17 May 2007 - 01:59 PM

[url="http://wiki.osx86project.org/wiki/index.ph...oot_Related_FAQ"]http://wiki.osx86pro...oot_Related_FAQ[/url]

The VMWare disk image contains more than just one partition, it's a *disk* image, so it represents the entire drive and not a single partition.
.../...
it depends entirely on the partition layout of the image in question. Also, this assumes that the image has only one partition, since it copies the entire disk but skips the first 32256 bytes (63 sectors) to the beginning of the first partition.

Here's the explanation that explain how I computed that the first partition (yes theres is only one in the image) start at sector 63:

in the image the first partition start at CHS 0/1/1 (from the partition table in last 66 bytes of the first 512 bytes of the image, aka the MBR)

The equation to convert from CHS to LBA follows:
LBA = ( ( CYL * HPC + HEAD ) * SPT ) + SECT - 1

Where:
LBA: linear base address of the block
CYL: value of the cylinder CHS coordinate
HPC: number of heads per cylinder for the disk
HEAD: value of the head CHS coordinate
SPT: number of sectors per track for the disk
SECT: value of the sector CHS coordinate

with (from file tiger-x86.vmdk)
ddb.geometry.sectors = "63"
ddb.geometry.heads = "16"
ddb.geometry.cylinders = "9825"

LBA = (0 + 1) * 63 + (1 - 1) = 63
that is sector 63

63*512 = 32256


vmdk VMware flat disk images: -b 32256

#4 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7,100 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 22 May 2007 - 10:03 AM

Here are some links to where info has been posted:
cdob here on SDI and VMDK images:
http://www.911cd.net...o...=19333&st=9

Virtualbox .vdi image:
http://www.911cd.net...o...19155&st=22
from further tests it appears that the offset is NOT fixed, it seems to be dependant on disk size.

Basically, it is very easy to determine where the "real" RAW image starts, with the help of gsar or similar search utility, as long as the image has been formatted.

Both MBR and bootsectors have the "magic signature" 55AA as LAST two bytes.

Microsoft DOS 6.22 MBR starts with FA33C0
Microsoft's Win9.x/ME/Win2k/XP/2003 MBR starts with 33C08E

FAT 12/16 bootrecord starts with EB3C90
FAT 32 bootrecord starts with EB5890
NTFS bootrecord starts with EB5290

jaclaz

#5 Olof Lagerkvist

Olof Lagerkvist

    Silver Member

  • Developer
  • 995 posts
  • Location:Borås, Sweden
  •  
    Sweden

Posted 30 May 2007 - 12:00 AM

I just add from the thread "Mount Nero Image" the offset for the ISO image in a Nero .nrg file. The offset seems to be 307200 bytes, so -b 307200 or -b 600b as parameter to imdisk.exe should work (witchever is easiest to remember).

#6 Sherpya

Sherpya

    Member

  • Developer
  • 51 posts
  • Location:Italy
  •  
    Italy

Posted 30 May 2007 - 01:49 AM

you may implement an automatic offset "suggestion" in the cpl (i.e. the offset field may be already filled), by looking at first bytes of the file like unix file utility does

#7 Olof Lagerkvist

Olof Lagerkvist

    Silver Member

  • Developer
  • 995 posts
  • Location:Borås, Sweden
  •  
    Sweden

Posted 30 May 2007 - 01:53 AM

you may implement an automatic offset "suggestion" in the cpl (i.e. the offset field may be already filled), by looking at first bytes of the file like unix file utility does


Yes, I have plans for implementing that. I am collecting information about different image file formats so that it could be used for automatically finding offset values in future releases.

#8 Sherpya

Sherpya

    Member

  • Developer
  • 51 posts
  • Location:Italy
  •  
    Italy

Posted 16 July 2007 - 10:59 PM

this may be interesting:
http://fuse.sourcefo...dex.php/FuseIso
as they said it would be easy to mount alchool and clone cd images

#9 Oleg_II

Oleg_II

    Frequent Member

  • Advanced user
  • 298 posts
  • Location:Somewhere in the East

Posted 04 April 2008 - 05:25 AM

Microsoft Virtual Server 2005 SP1 has the ability to mount VirtualPC VHD images (I also read they are used in Vista backups?). It is made with a command-line utility Vhdmount.exe. I get it working without installing Virtual Server by installing only two drivers (vhdbus.sys and vhdstor.sys).

Works fine but I wonder if it is possible to use ImDisk for this purpose (mounting VHD images)? Somebody knows the offset for VHD images?

#10 Nuno Brito

Nuno Brito

    Platinum Member

  • Team Reboot
  • 10,159 posts
  • Location:boot.wim
  • Interests:I'm just a quiet simple person with a very quiet simple life living one day at a time..
  •  
    European Union

Posted 04 April 2008 - 08:24 AM

Hi Oleg_II, long time no see.

Look here for the white papers: http://download.micr...ec_10_18_06.doc

Or use google cache if/when MS removes this documentation:
http://216.239.59.10...m...;cd=6&gl=pt

:thumbsup:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users