$30 off During Our Annual Pro Sale. View details »

Analyze Filesystem in Virtual Machine Image

Masahiro331
September 01, 2022

Analyze Filesystem in Virtual Machine Image

Masahiro331

September 01, 2022
Tweet

More Decks by Masahiro331

Other Decks in Technology

Transcript

  1. Ծ૝Ϛγϯ͔ΒϑΝΠϧγεςϜΛ ղੳͨ͠࿩ ౻ଜڡ߂ !NBTBIJSP

  2. ࠓ೔ͷൃද಺༰ w Ծ૝ϚγϯΠϝʔδͷߏ଄ w -JOVYͷσΟεΫϑΥʔϚοτ΍ɺϑΝΠϧγεςϜσʔλߏ଄ w ωετ͞Εͨσʔλߏ଄ͳͲΛಡΈࠐΉࡍͷ࣮૷ํ਑ w ͦͷଞHPݴޠͰͷ࣮૷5JQT

  3. എܠ Filesystem (Required) Virtual Machine Image (Required) Disk Partition 


    (Required) Logical Volume (Optional) File (Required) w Ծ૝ϚγϯΠϝʔδ͔ΒಁաతʹϑΝΠϧγεςϜΛղੳ͢Δ࢓૊ΈΛ։ൃ͍ͨ͠ w কདྷతʹ੬ऑੑݕ஌ͳͲʹԠ༻͢Δ͜ͱΛ໨ඪʹ͍ͯ͠Δ ੲ4FD)BDLͰগ͠΍͍ͬͯͨʢઌߦݚڀతͳ΍ͭʣIUUQTTFDIBDLOJDUHPKQBDIJFWFNFOUQEG@QEG Ծ૝ϚγϯΠϝʔδ͔ΒಁաతʹϑΝΠϧΛಡΈࠐΉͨΊʹ͸ɺ ͭͷσʔλߏ଄ΛಡΈࠐΜͰ͍͘ඞཁ͕͋Δɻ ࠓ೔͸͜ΕΒͷσʔλΛಡΈࠐΜͰ͍͘࿩Λ͠·͢ɻ
  4. Virtual Machine Image Disk Partition Logical Volume Filesystem File

  5. Ծ૝Ϛγϯͱ͸ ϗετ04্ʹผͷ04Λىಈ͢Δ࢓૊ΈͰɺओʹҎԼͷΑ͏ͳ੡඼Ͱఏڙ͞Ε͍ͯΔɻ 
 ·ͨɺ੡඼͝ͱʹԾ૝ϚγϯͷΠϝʔδϑΥʔϚοτ͕ఆٛ͞Ε͍ͯΔɻ w 7.XBSFW4QIFSF&94Jʢ7.%,ʣ w 0SBDMF7.7JSUVBM#PYʢ7%*ʣ w ,7.ʢ2$08ʣ

    w 8JOEPXT)ZQFS7ʢ7)% 7)%9ʣ
  6. Ծ૝ϚγϯΠϝʔδͱ͸ Ծ૝ϚγϯΠϝʔδͱ͸ɺϒʔτՄೳͳΦϖϨʔςΟϯάγεςϜ͕Πϯετʔϧ͞Εͨ σΟεΫΛ֨ೲͨ͠ϑΝΠϧɻ Ծ૝ϚγϯΠϝʔδ͕ఏڙ͢Δओͳػೳ w σʔλͷѹॖ w ޮ཰తͳόοΫΞοϓػೳ

  7. Ծ૝ϚγϯΠϝʔδͱσʔλѹॖ Ծ૝ϚγϯͷݩͱͳΔσΟεΫ͸಺෦ʹϑΝΠϧγεςϜ͕֨ೲ͞Ε͍ͯΔͨΊɺඇৗʹ େ͖ͳσʔλͱͳ͍ͬͯΔɻ σΟεΫ͸CZUFͰຬͨ͞Εۭ͖ͨྖҬ΋ଟ͘ɺ͜ΕΒΛল͖ͭͭ೚ҙͷѹॖΞϧΰϦζ ϜͰσʔλΛѹॖ͍ͯ͠Δɻ (#ͷσΟεΫ ࢖༻཰ σʔλ͋Γ (#ͷԾ૝σΟεΫ Πϝʔδϔομ

  8. ิ଍ѹॖͷྲྀΕ σΟεΫ σʔλ͋Γ Ծ૝σΟεΫ Πϝʔδϔομ /CZUFͷ#MPDL ɾɾɾ ɾɾɾ ɾɾɾ ɾɾɾ

    ࣮ࡍʹ͸σΟεΫྖҬΛ೚ҙͷϒϩοΫαΠζͰ෼ׂͯ͠ɺσʔλ͕ଘࡏͨ͠Βѹॖͯ͠ Ծ૝σΟεΫʹ֨ೲ͠ɺσʔλ͕ͳ͍৔߹͸ແࢹ͢Δɻͱ͍ͬͨ࢓૊Έ
  9. Ծ૝ϚγϯΠϝʔδͷ͋Δ͋Δߏ଄ ΄ͱΜͲͷԾ૝ϚγϯΠϝʔδ͸)FBEFS 5BCMF &OUSZͷͭͷσʔλΛ͍࣋ͬͯΔɻ w σΟεΫͷαΠζ w Ծ૝σΟεΫͷαΠζ w #MPDLͷαΠζ

    w 5BCMFͷҐஔ )FBEFS w &OUSZͷҐஔͱσΟεΫΦϑηο τͷඥ෇͚ w ςʔϒϧ಺ͷ/൪໨͕࣮σʔλͷ 0 ff TFU/ #MPDL4J[FͷσʔλΛ ࢦ͢Έ͍ͨͳ࣮૷͕ଟ͍ 5BCMF w &OUSZͷαΠζ w σΟεΫͷ࣮σʔλʢѹॖࡁΈ &OUSZ &OUSZ )FBEFS &OUSZ 5BCMF %BUB %BUB Ծ૝σΟεΫ σΟεΫ
  10. Virtual Machine Image Disk Partition Logical Volume Filesystem File

  11. σΟεΫύʔςΟγϣϯͱ͸ )%% 44%ͳͲͷ෺ཧσΟεΫΛ۠੾Δ࢓૊ΈɻҎԼͷೋ͕ͭଘࡏ͍ͯ͠Δɻ w .#3ʢ.BUFS#PPU3FDPSEʣ w (15ʢ(6*%ύʔςΟγϣϯςʔϒϧʣ ݱࡏओྲྀͱͳ͍ͬͯΔͷ͸(15

  12. σΟεΫύʔςΟγϣϯͷσʔλߏ଄ w ىಈՄೳͳύʔςΟγϣϯΛ୳͠ ࣮ͯߦ͢ΔϚγϯޠ w (15͸&'*ͷ֦ுػೳΛར༻ͯ͠ ͍Δ #PPU-PBEFS w ύʔςΟγϣϯͷઌ಄ΞυϨε

    w ύʔςΟγϣϯͷαΠζ w ύʔςΟγϣϯͷλΠϓ 
 ʢ4XBQ #PPU σʔλͳͲʣ 1BSUJUJPO5BCMF #PPU1BSUJUJPO #PPU-PEFS %BUB1BSUJUJPO 1BSUJUJPO5BCMF σΟεΫύʔςΟγϣϯ σΟεΫύʔςΟγϣϯͷσʔλ͸ओʹɺ#PPU-PBEFS 1BUJUJPO&OUSZͷσʔλΛ࣋ͬͯ ͍Δ
  13. ิ଍.#3ͱ(15 (15ͷઌ಄σʔλ͸.#3ͷσʔλ͕ೖ͓ͬͯΓɺ(15JO.#3Έ͍ͨͳσʔλߏ଄ʹͳͬ ͍ͯΔɻ 6&'*ͷ࢓༷ॻIUUQTVF fi PSHTJUFTEFGBVMU fi MFTSFTPVSDFT6&'*@4QFD@@QEG

  14. Virtual Machine Image Disk Partition Logical Volume Filesystem File

  15. -PHJDBM7PMVNFͱ͸ -7.ʢMPHJDBMWPMVNFNBOBHFSʣ͸ɺෳ਺ͷϋʔυσΟεΫ΍ύʔςΟγϣϯΛ·͕ͨͬͯ هԱྖҬΛ·ͱΊͯɺ୯Ұͷ࿦ཧϘϦϡʔϜʢ-7ʣͱͯ͠ѻ͏͜ͱͷͰ͖ΔσΟεΫ؅ཧػೳ ෺ཧσΟεΫ %JTL1BSUJUJPO #PPU 4EB 4EB 17 #PPU

    QW QW 7( CPPU SPPUWPMVNF -7 CPPU MW MW ෺ཧσΟεΫ
  16. -PHJDBM7PMVNFͷσʔλߏ଄ Ծ૝ϚγϯΠϝʔδ΍ɺ%JTL1BSUJUJPOͱಉ༷ʹ)FBEFSͳͲΛύʔε͢ΔͱҎԼͷΑ͏ͳ $PO fi HϑΝΠϧΛऔಘ͢Δ͜ͱ͕Ͱ͖ɺ͜ͷϑΝΠϧΛύʔε͢Δ͜ͱͰσʔλͷಡΈࠐΈ͕Մೳ

  17. Virtual Machine Image Disk Partition Logical Volume Filesystem File

  18. ϑΝΠϧγεςϜͱ͸ ετϨʔδ্ʹσΟϨΫτϦ΍ϑΝΠϧͱ͍ͬͨσʔλߏ଄Λ࡞ΓɺͦΕΒʹର͢Δݖݶ ؅ཧɺಡΈࠐΈɺॻ͖ࠐΈͷΠϯλʔϑΣʔεΛఏڙ͢Δػೳ αʔό΍1$Ͱ͸ɺओʹҎԼͷΑ͏ͳϑΝΠϧγεςϜ͕ීٴ͍ͯ͠Δɻ w &95&959'4ʢ-JOVYʣ w '"5/5'43F'4ʢ8JOEPXTʣ w "1'4)'4ʢJ04

    .BD
  19. ϑΝΠϧγεςϜͷσʔλߏ଄ ϑΝΠϧγεςϜ͕ڞ௨͍ͯ࣋ͬͯ͠Δσʔλߏ଄͸ɺ4VQFS#MPDL *OPEF5BCMF  *OPEF &YUFOU5SFF %BUB#MPDL +PVSOBMͷͭΛ͍࣋ͬͯΔ͜ͱ͕ଟ͍ w ϒϩοΫαΠζ

    w ϑΝΠϧγεςϜͷαΠζ w *OPEF5BCMFͷҐஔ w *OPEFͷݸ਺΍αΠζ 4VQFS#MPDL w JOPEFͷ഑ྻ *OPEF5BCMF w ϑΝΠϧͷछྨݖݶ৘ใ 
 ʢσΟϨΫτϦ ϑΝΠϧ 4ZNMJOLͳͲʣ w &YUFOU5SFF΋͘͠͸ϒϩοΫ΁ͷΞυϨε w ͦͷଞɺTUBUͰऔಘͰ͖Δσʔλ *OPEF w *OPEFͱ%BUB#MPDLͷϚοϐϯά &YUFOU5SFF w ϑΝΠϧͷσʔλ 
 %BUB#MPDL w σΟεΫʹର͢Δॻ͖ࠐΈ࣌ͷτ ϥϯβΫγϣϯϩά w σʔλͷϝλσʔλͳͲΛอޢ͢ Δ +PVSOBM
  20. ิ଍JOPEFͱσʔλϒϩοΫʹ͍ͭͯ ϑΝΠϧγεςϜʹ͓͚Δશͯͷσʔλ͸ʮϑΝΠϧʯͱͯ͠ѻΘΕɺσΟϨΫτϦͳͲ΋ ϑΝΠϧͱͯ͠ఆٛ͞Ε͍ͯΔɻͦΕΒϑΝΠϧͷϝλσʔλΛ*OPEFͱ͍͏ɻ ϒϩοΫαΠζΛ௒͑Δσʔλ͸σΟεΫ্Ͱ࿈ଓ͠ͳ͍Մೳੑ͕͋ΔͨΊɺͦΕΒΛ࿦ཧత ʹ݁߹͢ΔͨΊʹ&YUFOU5SFFͱݺ͹ΕΔσʔλߏ଄͕༻͍ΒΕ͍ͯΔɻ *OPEF σʔλϒϩοΫ ʢ࣮ࡍͷσʔλ͕ೖͬͯΔྖҬʣ &YUFOU5SFF σʔλϒϩοΫ

    ʢ࣮ࡍͷσʔλ͕ೖͬͯΔྖҬʣ σʔλϒϩοΫ ʢ࣮ࡍͷσʔλ͕ೖͬͯΔྖҬʣ σʔλ͕ϒϩοΫαΠζΑΓ খ͍͞৔߹ σʔλ͕ϒϩοΫαΠζΑΓ େ͖͍৔߹
  21. ͜͜·Ͱͷ࿩ Filesystem Virtual Machine Image Disk Partition Logical Volume File

    XFS /etc/os-release … other files Boot Code … Other filesystem LVM Master Boot Record GUID Partition Table Other Volumes… Compressed Virtual Machine Image … Ծ૝ϚγϯΠϝʔδͷதʹ͸ҎԼͷΑ͏ͳܗͰσʔλ͕֨ೲ͞Ε͍ͯΔɻ
  22. ͔͜͜Β(PݴޠͰͲ͏࣮૷͍͔ͯ͘͠ʁΈ͍ͨͳ࿩ʹͳΓ·͢

  23. Ծ૝ϚγϯΠϝʔδ͔ΒϑΝΠϧγεςϜΛղੳ લड़ͷ௨Γɺ֤ϨΠϠʔΛύʔε͢Δ͜ͱͰɺԾ૝ϚγϯΠϝʔδ͔ΒϑΝΠϧΛղੳՄ ೳʹࢥ͑Δ͕ɺԾ૝ϚγϯΠϝʔδΛղౚ͢ΔͱɺσʔλαΠζ͕૿େ͢ΔՄೳੑ͕͋Δ ͨΊɺѹॖঢ়ଶͰղੳΛ࣮ߦ͍ͨ͠ɻ Filesystem Virtual Machine Image Disk Partition

    Logical Volume File .#d਺(# ਺े(#d਺5#
  24. Ծ૝ϚγϯΠϝʔδ͔ΒϑΝΠϧγεςϜΛղੳ ѹॖ͞ΕͨԾ૝ϚγϯΠϝʔδ͔ΒϑΝΠϧγεςϜΛղੳ͢ΔͨΊʹɺҎԼͷઓུΛऔΔ w Ծ૝ϚγϯΠϝʔδ͔Β'JMFTZTUFNΛಁաతʹ୯ҰϑΝΠϧͱͯ͠ѻ͑ΔΑ͏ʹ͢Δ w ϑΝΠϧͱͯ͠։͍ͨ'JMFTZTUFNʹSFBEEJS΍ɺPQFOEJSͰ͖ΔΑ͏ʹ͢Δ Filesystem Virtual Machine Image

    Disk Partition Logical Volume File 'JMFTZTUFNΛந৅తͳʮϑΝΠϧʯͱͯ͠ಁաతʹಡΈࠐΈ͍ͨ 'JMFTZTUFNʹରͯ͠ʮPQFOEJSʯ΍ʮSFBEEJSʯΛ࣮ߦͰ͖ΔΑ͏ʹ͍ͨ͠
  25. ωετ͞ΕͨϨΠϠʔΛϑΝΠϧͱͯ͠ಁաతʹಡΈࠐΉ ϑΝΠϧΛಡΈࠐΉͨΊʹඞཁͳػೳ͸ҎԼ w 'JMF4FFL P ff TFUJOU XIFODFJOU 
 ϑΝΠϧϙΠϯλͷҐஔΛࢦఆͨ͠ҐஔʹҠಈͤ͞Δ͜ͱ͕Ͱ͖Δؔ਺

    w 'JMF3FBE CVG<>CZUF 
 ϑΝΠϧϙΠϯλ͔Β೚ҙͷόΠτ਺ΛಡΈࠐΉؔ਺ ͜ΕΒͷؔ਺͸ҎԼͷؔ਺Λ࣮૷͢Δ͜ͱͰຬͨ͢͜ͱ͕Մೳ w 'JMF3FBE"U P ff TFUJOU CVG<>CZUF 
 ೚ҙͷϑΝΠϧΦϑηοτ͔Β೚ҙͷόΠτΛಡΈࠐΉؔ਺ w 'JMF4J[F 
 ϑΝΠϧͷαΠζΛऔಘ
  26. Ծ૝ϚγϯΠϝʔδΛந৅Խ͢Δ w ӈਤͷΑ͏ʹ'JMFΠϯλʔϑΣʔεΛఆٛ͠ ֤ϨΠϠʔʹ࣮૷͢Δ

  27. Ծ૝ϚγϯΠϝʔδΛந৅Խ͢Δ Compressed Virtual Machine Image ѹॖ͞Εͨσʔλ Virtual Machine Image ղౚ͞Εͨσʔλ

    Yͷσʔλ 3FBE"U CVG 1IZTJDBM0 ff TFU 3FBE"U CVG -PHJDBM0 ff TFU PT'JMF 'JMF*OUFSGBDF 5SBOTMBUF0 ff TFU
  28. %JTL1BSUJUJPOΛந৅Խ͢Δ w %JTL1BSUJUJPO͸'JMFΛड͚औΓɺෳ਺ͷ 'JMFΛฦ࣮͢૷Λ͢Δ w ֤ύʔςΟγϣϯͷ։࢝ҐஔΛ'JMFͷॳظ 0 ff TFUͱͯ͠ѻ͏ͨΊɺͦΕΒΛม׵͢Δ

  29. %JTL1BSUJUJPOΛந৅Խ͢Δ Compressed Virtual Machine Image ѹॖ͞Εͨσʔλ Virtual Machine Image ղౚ͞Εͨσʔλ

    Yͷσʔλ 3FBE"U CVG 1IZTJDBM0 ff TFU 3FBE"U CVG -PHJDBM0 ff TFU PT'JMF 'JMF*OUFSGBDF 5SBOTMBUF0 ff TFU Disk Partition #PPU1BSUJUJPO'JMF 1BSUJUJPO'JMF" %JTL*OUFSGBDF 5SBOTMBUF0 ff TFU 'JMF*OUFSGBDF 3FBE"U CVG -PHJDBM0 ff TFU -JTU  'JMFͷ։࢝஍఺͕มΘΔͨΊ 0 ff TFUΛ૬ରతʹͣΒ͢ඞཁ͕͋Δ
  30. ϑΝΠϧγεςϜΛந৅Խ͢Δ w ͜Ε·Ͱͷ࣮૷Ͱɺ4FFL 3FBE͕Մೳͳ୯ҰͷϑΝΠϧͱͯ͠'JMFTZTUFNΛѻ͑Δ w JPGTΠϯλʔϑΣʔεΛ࣮૷͢Δ͜ͱͰɺϑΝΠϧγεςϜΛந৅Խͯ͠ѻ͑Δ ࣮૷͕͢͜ͿΔෳࡶͳͷͰׂѪ 
 ެࣜͷϦϑΝϨϯεʢIUUQTQLHHPEFWJPGTʣ 


    ࢀߟ࣮૷ʢIUUQTHJUIVCDPNNBTBIJSPHPYGT fi MFTZTUFN
  31. ϑΝΠϧγεςϜΛந৅Խ͢Δ Compressed Virtual Machine Image ѹॖ͞Εͨσʔλ Virtual Machine Image ղౚ͞Εͨσʔλ

    Yͷσʔλ 3FBE"U CVG 1IZTJDBM0 ff TFU 3FBE"U CVG -PHJDBM0 ff TFU PT'JMF 'JMF*OUFSGBDF 5SBOTMBUF0 ff TFU Disk Partition #PPU1BSUJUJPO'JMF 1BSUJUJPO'JMF" %JTL*OUFSGBDF 5SBOTMBUF0 ff TFU 'JMF*OUFSGBDF 3FBE"U CVG -PHJDBM0 ff TFU -JTU  'JMFͷ։࢝஍఺͕มΘΔͨΊ 0 ff TFUΛ૬ରతʹͣΒ͢ඞཁ͕͋Δ Filesystem 'JMFTZTUFN #PPU'JMF 'JMF*OUFSGBDF 'JMFTZTUFN*OUFSGBDF 8BML%JS 'JMF0QFO