Dissecting Apple's Sparse Image Format (ASIF)
18 hours ago
- #File Format
- #Reverse Engineering
- #Apple
- Apple announced ASIF, a new sparse disk image format for virtual machines in macOS 26 Tahoe.
- ASIF is similar to existing sparse virtual disk formats like VMDK, VHDX, or QCOW2.
- The author reverse-engineered ASIF by analyzing a test file and the diskimagescontroller binary.
- Key ASIF header fields include directory_offsets, chunk_size, and sector_count.
- ASIF uses directories with tables and entries to map chunks, with bitmaps for allocation tracking.
- Reading data involves calculating chunk indices via tables and groups based on offset and block size.
- The implementation is available in dissect.hypervisor and integrates with Dissect tools.