Module object 

Object header (obj_phys_t) parsing and Fletcher-64 checksum verification.

Every APFS on-disk object begins with a 32-byte header (Apple APFS Reference, obj_phys_t; MAX_CKSUM_SIZE = 8):

off	size	field
0	8	o_cksum
8	8	o_oid
16	8	o_xid
24	4	o_type
28	4	o_subtype

o_type & OBJECT_TYPE_MASK (0x0000ffff) selects the object type; OBJ_STORAGETYPE_MASK (0xc0000000) carries physical/ephemeral/virtual flags.

Object-type constants (complete, from Apple): INVALID 0x0, NX_SUPERBLOCK 0x1, BTREE 0x2, BTREE_NODE 0x3, SPACEMAN 0x5, …, OMAP 0xb, CHECKPOINT_MAP 0xc, FS 0xd, FSTREE 0xe, …, INTEGRITY_META 0x1e, FEXT_TREE 0x1f, plus the keybag 4CC object types. The authoritative table lives in forensicnomicon; this module decodes against it.

Structs

ObjPhys

A parsed object header.

Constants

OBJ_PHYS_LEN

Size in bytes of the obj_phys_t header.

Functions

fletcher64_checksum

Compute the APFS Fletcher-64 object checksum over block, treating the first 8 bytes (the stored o_cksum) as zero.

fletcher64_stored

Read the stored Fletcher-64 checksum (o_cksum, the first 8 bytes of an object). Bounds-checked: 0 if the block is shorter than 8 bytes.