added APFS pattern

[HrantTadevosyan]

• Tested on 1G+ samples

For Reviewers

This should parse the container, volume superblocks. It should be able to identify the root, snapshot trees, the user can iterate over the B+Trees with helper functions. Individual blocks can be verified as well with these helper functions. Additionally, there are space manager, reaper and bitmap parsed structures. Lastly, it will try to find the root directory of the first volume in the container.

Unfortunately, I can not add <1M sample file for unit tests, since I don't know how'd I do it. The tools that I use allow only 1G+ disks to be created.

References

• https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf
• https://github.com/linux-apfs/linux-apfs-rw
• https://github.com/sgan81/apfs-fuse
• https://github.com/libyal/libfsapfs

[paxcut]

Can you talk a bit about how you create the disk files that explains why they need to be so big? From what I have read, it may be possible to extract the file system that are stored in dmg installations made using apfs which could be as small as kilobytes. I have a couple virtual machines running catalina and older versions that may be used to create small disks and fill them with files. my computer is really old and can have trouble when I use those vms so I avoid them if possible.

[paxcut]

I noticed a possible runtime error in the pattern. I posted details and a possible resolution.

[paxcut]

I see you are passing a value of 0 to several instances of btree_node_phys_t for the second template argument. Later on you use this argument to set the last template argument of kvgen_t struct called vol_incomp which then is used to test this conditional

  if (vol_incomp.APFS_INCOMPAT_CASE_INSENSITIVE ||
                        vol_incomp.APFS_INCOMPAT_NORMALIZATION_INSENSITIVE) {

When you pass 0 as template argument the type of the variable will become u32 or something like that instead of apfs_incompatible_features_t which it needs to be or else the if statement will return a runtime error. You need to make sure the conditional is never evaluated when you pass 0 as a template argument or you could define a variable

apfs_incompatible_features_t zero = 0;

and then use btree_node_phys_t<block_size, zero> node @ off; instead of using 0 and also change all the other cases where 0 is being used. This way you don't need to worry about the conditional.

[HrantTadevosyan]

• I use VirtualBuddy, which does not allow me to create <1G disks. But... I see this issue in their repo:
  Allow disk size to be smaller than 1GB netbox-community/netbox#14692
  Most likely I have to update my old VirtualBuddy.... in future. c;

• Oh that's a very good catch. I have never seen that error on my sample disks. But good point. I'll fix it once I come back to this. I'll tag you, once I push my changes (for you to double check).