Parallels Expandable Image File Format

A Parallels expandable image file consists of three consecutive parts:

header
BAT
data area

All numbers in a Parallels expandable image are stored in little-endian byte order.

Definitions

Sector: A 512-byte data chunk.
Cluster: A data chunk of the size specified in the image header. Currently, the default size is 1MiB (2048 sectors). In previous versions, cluster sizes of 63 sectors, 256 and 252 kilobytes were used.
BAT: Block Allocation Table, an entity that contains information for guest-to-host I/O data address translation.

Header

The header is placed at the start of an image and contains the following fields:

Bytes:
  0 - 15:    magic
             Must contain "WithoutFreeSpace" or "WithouFreSpacExt".

 16 - 19:    version
             Must be 2.

 20 - 23:    heads
             Disk geometry parameter for guest.

 24 - 27:    cylinders
             Disk geometry parameter for guest.

 28 - 31:    tracks
             Cluster size, in sectors.

 32 - 35:    nb_bat_entries
             Disk size, in clusters (BAT size).

 36 - 43:    nb_sectors
             Disk size, in sectors.

             For "WithoutFreeSpace" images:
             Only the lowest 4 bytes are used. The highest 4 bytes must be
             cleared in this case.

             For "WithouFreSpacExt" images, there are no such
             restrictions.

 44 - 47:    in_use
             Set to 0x746F6E59 when the image is opened by software in R/W
             mode; set to 0x312e3276 when the image is closed.

             A zero in this field means that the image was opened by an old
             version of the software that doesn't support Format Extension
             (see below).

             Other values are not allowed.

 48 - 51:    data_off
             An offset, in sectors, from the start of the file to the start of
             the data area.

             For "WithoutFreeSpace" images:
             - If data_off is zero, the offset is calculated as the end of BAT
               table plus some padding to ensure sector size alignment.
             - If data_off is non-zero, the offset should be aligned to sector
               size. However it is recommended to align it to cluster size for
               newly created images.

             For "WithouFreSpacExt" images:
             data_off must be non-zero and aligned to cluster size.

 52 - 55:    flags
             Miscellaneous flags.

             Bit 0: Empty Image bit. If set, the image should be
                    considered clear.

             Bits 1-31: Unused.

 56 - 63:    ext_off
             Format Extension offset, an offset, in sectors, from the start of
             the file to the start of the Format Extension Cluster.

             ext_off must meet the same requirements as cluster offsets
             defined by BAT entries (see below).

BAT

BAT is placed immediately after the image header. In the file, BAT is a contiguous array of 32-bit unsigned little-endian integers with (bat_entries * 4) bytes size.

Each BAT entry contains an offset from the start of the file to the corresponding cluster. The offset set in clusters for WithouFreSpacExt images and in sectors for WithoutFreeSpace images.

If a BAT entry is zero, the corresponding cluster is not allocated and should be considered as filled with zeroes.

Cluster offsets specified by BAT entries must meet the following requirements:

the value must not be lower than data offset (provided by header.data_off or calculated as specified above)
the value must be lower than the desired file size
the value must be unique among all BAT entries
the result of (cluster offset - data offset) must be aligned to cluster size

Data Area

The data area is an area from the data offset (provided by header.data_off or calculated as specified above) to the end of the file. It represents a contiguous array of clusters. Most of them are allocated by the BAT, some may be allocated by the ext_off field in the header while other may be allocated by extensions. All clusters allocated by ext_off and extensions should meet the same requirements as clusters specified by BAT entries.

Format Extension

The Format Extension is an area 1 cluster in size that provides additional format features. This cluster is addressed by the ext_off field in the header. The format of the Format Extension area is the following:

0 -  7:    magic
           Must be 0xAB234CEF23DCEA87

8 - 23:    m_CheckSum
           The MD5 checksum of the entire Header Extension cluster except
           the first 24 bytes.

The above are followed by feature sections or “extensions”. The last extension must be “End of features” (see below).

Each feature section has the following format:

 0 -  7:    magic
            The identifier of the feature:
            0x0000000000000000 - End of features
            0x20385FAE252CB34A - Dirty bitmap

 8 - 15:    flags
            External flags for extension:

            Bit 0: NECESSARY
                   If the software cannot load the extension (due to an
                   unknown magic number or error), the file should not be
                   changed. If this flag is unset and there is an error on
                   loading the extension, said extension should be dropped.

            Bit 1: TRANSIT
                   If there is an unknown extension with this flag set,
                   said extension should be left as is.

            If neither NECESSARY nor TRANSIT are set, the extension should be
            dropped.

16 - 19:    data_size
            The size of the following feature data, in bytes.

20 - 23:    unused32
            Align header to 8 bytes boundary.

variable:   data (data_size bytes)

The above is followed by padding to the next 8 bytes boundary, then the next extension starts.

The last extension must be “End of features” with all the fields set to 0.

Dirty bitmaps feature

This feature provides a way of storing dirty bitmaps in the image. The fields of its data area are:

 0 -  7:    size
            The bitmap size, should be equal to disk size in sectors.

 8 - 23:    id
            An identifier for backup consistency checking.

24 - 27:    granularity
            Bitmap granularity, in sectors. I.e., the number of sectors
            corresponding to one bit of the bitmap. Granularity must be
            a power of 2.

28 - 31:    l1_size
            The number of entries in the L1 table of the bitmap.

variable:   L1 offset table (l1_table), size: 8 * l1_size bytes

The dirty bitmap described by this feature extension is stored in a set of clusters inside the Parallels image file. The offsets of these clusters are saved in the L1 offset table specified by the feature extension. Each L1 table entry is a 64 bit integer as described below:

Given an offset in bytes into the bitmap data, corresponding L1 entry is:

l1_table[offset / cluster_size]

If an L1 table entry is 0, all bits in the corresponding cluster of the bitmap are assumed to be 0.

If an L1 table entry is 1, all bits in the corresponding cluster of the bitmap are assumed to be 1.

If an L1 table entry is not 0 or 1, it contains the corresponding cluster offset (in 512b sectors). Given an offset in bytes into the bitmap data the offset in bytes into the image file can be obtained as follows:

offset = l1_table[offset / cluster_size] * 512 + (offset % cluster_size)