apfs::BlockReader¶

class BlockReader¶

NOTE: If you’re using the public API, you will never actually have to use this directly yourself! A utility class that reads raw memory from blocks in chunks of BLOCK_SIZE.

Public Functions¶

bytes_t read_block(uint64_t block_num) const¶

Read a block and return its raw bytes.

bytes_t read_blocks(uint64_t block_num, uint64_t num_blocks) const¶

Read some blocks and return their raw bytes.

template<typename T>
inline T read_object(uint64_t block_num) const¶

Read an APFS object (that begins with obj_phys_t) from a given block, verify its checksum, and return it.

template<typename T>
inline T read_struct(uint64_t block_num) const¶

Read any object from a given block and return it.

Does not verify any checksums, this is just a reinterpret cast.

template<typename KeyType, typename Compare = std::less<KeyType>>
BTree<KeyType, Compare> read_btree(uint64_t block_num) const¶

Reads an btree_node_phys_t and calls the constructor for BTree<KeyType>

This is for when operator< is defined

template<typename KeyType, typename Compare>
BTree<KeyType, Compare> read_btree(uint64_t block_num, Compare lt) const¶

Reads an btree_node_phys_t and calls the constructor for BTree<KeyType>

This is for when we must pass a comparator

std::vector<x_field> parse_xfields(bytes_t &data) const¶

Parse extended fields (xfields)

BlockReader(std::string filename, bool apfs = true, uint64_t offset = 0)¶

Filename of the data stream, and whether or not we’re reading from an APFS partition directly (the other option is a disk, with an MBR)

BlockReader(FILE *fd)¶

This constructor gains ownership of the FILE passed.

apfs is implicitly false and offset is 0, because this is meant for when the disk file can’t be opened by us, as a non-privileged process. Only an issue on Windows

Public Members¶

size_t BLOCK_SIZE = NX_DEFAULT_BLOCK_SIZE¶

The block size.