dmg-core 0.1.2

Pure-Rust forensic Apple Disk Image (DMG/UDIF) reader — every block codec, a Read + Seek virtual disk, zero C dependencies.

Decodes macOS DMG containers (UDIF): locates the 512-byte koly trailer at EOF, parses the embedded XML plist for partition block tables (blkx/mish), and serves the virtual sector stream through Read + Seek, decompressing blocks on demand. Every codec hdiutil emits is supported — ADC, zlib, bzip2, LZFSE, LZMA — all in pure Rust. #![forbid(unsafe_code)] is not used (the workspace denies unsafe), there are no C bindings, and the parser is fuzzed against malformed input.

[dependencies]
dmg-core = "0.1"   # imported as `dmg`

Quick start

use dmg::DmgReader;
use std::fs::File;
use std::io::{Read, Seek, SeekFrom};

// `open` takes any `Read + Seek` (a File, a Cursor, a decoded container…).
let mut reader = DmgReader::open(File::open("disk.dmg")?)?;
println!("virtual disk: {} bytes", reader.virtual_disk_size());

let mut sector = [0u8; 512];
reader.read_exact(&mut sector)?;       // first sector
reader.seek(SeekFrom::Start(1 << 20))?; // seek anywhere
# Ok::<(), dmg::DmgError>(())

Because DmgReader is Read + Seek, it drops straight into any partition or filesystem analyzer that accepts a reader.

Supported block types

Every codec is validated against real hdiutil-produced fixtures (each converts byte-identically to the raw image). Block sizes are bounded against the file and a per-block cap, so a malformed image fails loud rather than over-allocating.

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd