Add support for nativeParentHint

Author: Schamper

dissect/hypervisor/disk/vmdk.py

@@ -77,8 +77,11 @@ def __init__(self, fh: BinaryIO | Path, parent: BinaryIO | VMDK | None = None):
                 fh.close()
 
             # The descriptor file determines the parent
-            if self.parent is None and self.descriptor.attributes["parentCID"] != "ffffffff":
-                self.parent = open_parent(path.parent, self.descriptor.attributes["parentFileNameHint"])
+            if self.parent is None:
+                if self.descriptor.attributes["parentCID"] != "ffffffff":
+                    self.parent = open_parent(path.parent, self.descriptor.attributes["parentFileNameHint"])
+                elif self.descriptor.attributes.get("ddb.nativeParentCID", "ffffffff") != "ffffffff":
+                    self.parent = open_parent(path.parent, self.descriptor.attributes["ddb.nativeParentHint"])
 
             # Open all extents listed in the descriptor
             for extent_descriptor in self.descriptor.extents:
@@ -91,8 +94,11 @@ def __init__(self, fh: BinaryIO | Path, parent: BinaryIO | VMDK | None = None):
             extent = Extent.from_fh(fh, path)
 
             # The single file VMDK may have a parent in the embedded descriptor
-            if extent.descriptor and extent.descriptor.attributes["parentCID"] != "ffffffff":
-                self.parent = open_parent(path.parent, extent.descriptor.attributes["parentFileNameHint"])
+            if extent.descriptor:
+                if extent.descriptor.attributes["parentCID"] != "ffffffff":
+                    self.parent = open_parent(path.parent, extent.descriptor.attributes["parentFileNameHint"])
+                elif extent.descriptor.attributes.get("ddb.nativeParentCID", "ffffffff") != "ffffffff":
+                    self.parent = open_parent(path.parent, extent.descriptor.attributes["ddb.nativeParentHint"])
 
             self.extents.append(extent)
 

tests/disk/test_vmdk.py

@@ -254,3 +254,19 @@ def mock_exists(path: Path) -> bool:
         # Case: Fallback to sibling — try ../sibling/hint.vmdk
         vmdk = open_parent(Path("base"), "sibling/hint.vmdk")
         assert str(vmdk.path) == "mocked-path"
+
+
+def test_native_parent_hint(tmp_path: Path) -> None:
+    """Test that we correctly handle the ddb.nativeParentHint attribute for both descriptor and extent descriptors."""
+
+    descriptor = b"""# Disk DescriptorFile
+parentCID=ffffffff
+
+ddb.nativeParentCID = "8c5389b7"
+ddb.nativeParentHint = "disk-name.vmdk"
+"""
+    tmp_path.joinpath("descriptor.vmdk").write_bytes(descriptor)
+
+    with patch("dissect.hypervisor.disk.vmdk.open_parent") as mock_open_parent:
+        VMDK(tmp_path.joinpath("descriptor.vmdk"))
+        mock_open_parent.assert_called_with(tmp_path, "disk-name.vmdk")