Virt Block

VMDK3 is a format which QEMU has implemented r/w support, it is the only image format that VMware Workstation 3 produces, and was updated to what we call VMDK4 since Workstation 4.0. The older format is no longer valid in latest VMware Workstation versions, so I have to install Workstation 3 to get an image sample.

On the other hand there is a mysterious format found in “VMware Virtual Disk Specification 1.1″, called “ESX Server Sparse Extents”. It is not appearing in various ESX Server versions (2.0, 3.5 and 4.0), not seen anywhere except the Specification.

Those two formats are mentioned here as they have the same magic bytes (“COWD”) and image header structure, so we wonder if VMDK3 is alias to ESX Server Sparse Extents. What I did was compare the Specification to the image sample I got from Workstation 3, and also to VMDK3 code in QEMU block driver. It turns out that we do have ready support of this old format, but it differs somewhere from how ESX Server Sparse is documented. The major differences are as follows:

• header.version:

  specification ==1 but vmdk3 == 3

• header.flags:

  specification == 3 but vmdk3 == 0×1b

• L2 table entries:

  specification == 4096 but vmdk3 == 512

That the two header fields vary could explain why look-up table sizes differ, and as a result the sector access calculation can’t be constant for two formats. The obstacle for us is that these header fields are not documented except for the given magic number, and all that we know is the two cases with different random numbers.

Finally, the conclusion is that VMDK3 and “ESX Server Sparse Extents” are quite similar to each other but not completely identical in several fields. It is more reasonable to say they are different versions of the ‘COWD’ magic’d image type. We get the former version from very outmoded VMware software, but can’t find any implementation of the latter.