Small self-advertisement: as an alternative to dissect.cstruct, a fun side-project of mine (C parser + C interpreter in Python) can do a very similar thing:
Image as in “filesystem snapshot” not as in “media file”.
show comments
saagarjha
I have to admit that using C syntax as a string to parse something from Python is definitely a choice. I'm not even sure I would use C structs to lay things out in C…
show comments
fragmede
I like a good jaunt with IDApro as much as the next RE, but my question is what does ASIF do that Qcow2 doesn't?
My other question is why does it take so long to copy an app out of a dmg and into /Applications. Like, just change some pointers to pointers to data on disk and shit.
show comments
ARTKILL
Worth noting ASIF's compression tradeoff also affects Spotlight indexing —
since the content is opaque until mounted, you lose searchability on
unmounted disk images that you'd get with a regular folder structure.
Small self-advertisement: as an alternative to dissect.cstruct, a fun side-project of mine (C parser + C interpreter in Python) can do a very similar thing:
https://github.com/albertz/PyCParser/blob/master/demos/disse...
More info on how ASIF differs from the decades-old sparseimage format: https://news.ycombinator.com/item?id=44259132
Image as in “filesystem snapshot” not as in “media file”.
I have to admit that using C syntax as a string to parse something from Python is definitely a choice. I'm not even sure I would use C structs to lay things out in C…
I like a good jaunt with IDApro as much as the next RE, but my question is what does ASIF do that Qcow2 doesn't?
My other question is why does it take so long to copy an app out of a dmg and into /Applications. Like, just change some pointers to pointers to data on disk and shit.
Worth noting ASIF's compression tradeoff also affects Spotlight indexing — since the content is opaque until mounted, you lose searchability on unmounted disk images that you'd get with a regular folder structure.